Privacy notice (POPIA)
Health Brands SA · draft of 7 October 2026
1. Who we are
Health Brands SA (Pty) Ltd (“we”) is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for personal information collected through this store.
- Legal name: Health Brands SA (Pty) Ltd
- Registration number: 2017/056995/07
- VAT number: 4720291865
- Physical address: 293 Summit Road, Knoppieslaagte, Centurion, 0157
- Email: info@healthbrands.co.za
- Website: https://shop.healthbrands.co.za
- Directors: [VERIFY - list directors as required by ECTA s43]
Information Officer: [VERIFY - name and contact of the registered Information Officer].
2. What we collect
- Order details: name, email, mobile number, company name and VAT number (optional), delivery address and order notes.
- Quote and enquiry details: name, company, contact details, requirements and, where you choose, artwork file names.
- Payment: card and bank details are entered on PayFast's pages and are not seen or stored by us. PayFast tells us whether a payment succeeded.
- Technical: your cart and quote list are stored only in your own browser (local storage). We do not use advertising or tracking cookies.
3. Why we use it (purpose and lawful basis)
- To process and deliver your order, issue tax invoices and handle returns - necessary to perform our contract with you (POPIA s11(1)(b)).
- To prepare quotes you request - at your request, with your consent.
- To meet legal duties such as tax record keeping (s11(1)(c)).
- We do not send direct marketing without your opt-in consent, and every marketing message will include an opt-out.
4. Who we share it with (operators)
- PayFast (payment processing, South Africa).
- Our supplier partner and couriers - only what is needed to fulfil and deliver your order.
- Website hosting: Vercel Inc. (servers outside South Africa) and email delivery: Twilio SendGrid (United States).
5. Transfers outside South Africa
Our hosting and email providers process information outside South Africa. We rely on POPIA s72 (the transfer is necessary to perform our contract with you, and the providers are bound by agreements offering adequate protection). [REVIEW: confirm data processing agreements; a move to South African hosting is planned.]
6. How long we keep it
Order and invoice records: five years after the transaction (tax law). Quotes that do not become orders: 12 months. Then deleted or de-identified.
7. Security
Encrypted connections (HTTPS), no card data held by us, access restricted to staff who need it, and secrets held in a password vault.
8. Your rights
You may ask what information we hold about you, ask us to correct or delete it, object to processing, and withdraw consent, by emailing info@healthbrands.co.za. You may complain to the Information Regulator (South Africa): https://inforegulator.org.za.