Privacy Policy

01 Introduction

Wellness Workz respects your privacy and is committed to protecting the personal information you share with us.

This Privacy Policy explains what personal information we collect when you visit or buy from wellnessworkz.co.za, why we collect it, who we share it with, how long we keep it, and what rights you have.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”) and the Consumer Protection Act 68 of 2008 (“CPA”).

For the purposes of POPIA, Wellness Workz is the responsible party in respect of the personal information described in this policy.

By using this website, placing an order, creating an account or subscribing to our communications, you acknowledge that you have read and understood this Privacy Policy.

02 Who we are and how to contact us

The following details are provided in accordance with section 43 of ECTA and section 18 of POPIA:

• Trading name: Wellness Workz
• Registered legal name: Wellness Workz (Pty) Ltd
• Registration number: 2026/182552/07
• Registered address: PO Box 1460, Sun Valley, Capri, 7985
• Postal address: as above
• Email: info@wellnessworkz.co.za
• Telephone: 068 419 6945
• Website: https://wellnessworkz.co.za
• Information Officer: D. Lindup
• Information Officer email: info@wellnessworkz.co.za

All privacy queries, requests and complaints should be directed to our Information Officer at info@wellnessworkz.co.za.

03 Definitions

• Personal information — information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person, as defined in POPIA.
• Special personal information — personal information concerning a person’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour.
• Processing — any operation concerning personal information, including collecting, receiving, recording, storing, updating, using, disseminating, erasing or destroying it.
• Responsible party — the party that determines the purpose of and means for processing personal information (in this case, Wellness Workz).
• Operator — a third party that processes personal information on our behalf, under contract (for example our hosting provider or courier).
• Data subject — the person to whom the personal information relates (in this case, you).

04 What personal information we collect

We collect only the personal information that is adequate, relevant and not excessive for the purposes set out in this policy.

4.1 Information you give us

• Identity information — your first and last name. Collected at account registration, checkout, via our contact form, and at newsletter signup.
• Contact information — your email address and telephone or mobile number. Collected at account registration, checkout, via our contact form, and at newsletter signup.
• Delivery information — street address, suburb, city, province, postal code, delivery instructions and recipient name. Collected at checkout.
• Billing information — billing name and address, and a VAT number where you supply one. Collected at checkout.
• Order information — the products you order, quantities, order value, order number, order history and any order notes. Collected at checkout and during order fulfilment.
• Account information — your username, your password (stored in encrypted form), saved addresses and account preferences. Collected when you register an account.
• Communications — emails, contact form messages, WhatsApp or telephone enquiries, product reviews, and our replies to you. Collected when you contact us or submit a review.
• Marketing preferences — whether you have consented to, or opted out of, marketing communications. Collected at newsletter signup, at checkout, and when you unsubscribe.

4.2 Information collected automatically

When you browse the website, our servers and the services we use may automatically record:

• your IP address, and the approximate location derived from it (city or country level);
• your browser type and version, operating system and device type;
• the pages and products you view, time spent on pages, and the website that referred you;
• the date and time of your visit;
• cookie identifiers and session identifiers (see section 9).

4.3 Payment information

4.4 Special personal information and health information

We sell wellness and herbal supplement products. We do not require, and we ask that you do not send us, information about your health, medical conditions, medication or diagnoses.

If you voluntarily share health-related information with us — for example in an order note, a product review, or an email asking whether a product is suitable for you — you consent to us processing that information for the sole purpose of responding to you. We will not use it for marketing, we will not share it with third parties for their own purposes, and we will delete it once it is no longer needed to answer your query.

We do not provide medical advice. Nothing on this website is a substitute for consultation with a qualified healthcare professional.

4.5 Children

This website and our products are intended for persons aged 18 years and older. We do not knowingly collect the personal information of children (persons under 18) without the prior consent of a competent person, as required by section 34 of POPIA. If you believe a child has provided us with personal information, please contact us at info@wellnessworkz.co.za and we will delete it.

05 Why we process your personal information, and on what legal basis

POPIA requires that we have a lawful justification for processing your personal information. Set out below is each purpose, the information used, and the justification we rely on under section 11 of POPIA.

• To process and deliver your order, and to handle returns, refunds and exchanges. We use your identity, contact, delivery, billing and order information. Basis: necessary to conclude or perform a contract with you — s11(1)(b).
• To take and confirm payment, and to prevent fraudulent transactions. We use your order and billing information, the payment result and your IP address. Basis: contract performance — s11(1)(b); and our legitimate interests in preventing fraud — s11(1)(f).
• To create and manage your customer account. We use your account, identity, contact and delivery information. Basis: contract performance — s11(1)(b); and your consent — s11(1)(a).
• To answer your enquiries and provide customer support. We use your contact information, our correspondence with you, and your order information. Basis: contract performance — s11(1)(b); and legitimate interests — s11(1)(f).
• To send transactional emails such as order confirmations, payment confirmations, shipping and tracking notices, and password resets. We use your identity, contact, order and delivery information. Basis: contract performance — s11(1)(b).
• To send newsletters, promotions and special offers. We use your identity and contact information and your marketing preferences. Basis: your consent — s11(1)(a); or, for existing customers, our legitimate interests in marketing similar products, subject always to your right to opt out — s69(3).
• To keep accounting, tax and invoicing records. We use your identity, contact, billing and order information. Basis: compliance with a legal obligation — s11(1)(c).
• To operate, secure and improve the website, prevent abuse and diagnose technical faults. We use technical and usage data, your IP address and cookies. Basis: legitimate interests — s11(1)(f).
• To understand how the site is used (analytics). We use technical and usage data and cookies. Basis: your consent — s11(1)(a) — where non-essential cookies are involved.
• To establish, exercise or defend a legal claim. We use whichever categories are relevant. Basis: protection of a legitimate interest — s11(1)(d) and (f).

Where we rely on your consent, you may withdraw that consent at any time by contacting us at info@wellnessworkz.co.za. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and we may still need to keep certain information in order to comply with the law or to complete an order already in progress.

06 Providing your information is voluntary — but sometimes necessary

You are not obliged to give us your personal information. However, certain information is mandatory if we are to conclude a sale with you: without your name, email address, delivery address and contact number we cannot process, take payment for, or deliver your order. Where a field on our website is marked as required, that information is mandatory for the relevant purpose. All other information is optional, and there is no consequence to leaving it out.

07 Who we share your personal information with

We do not sell, rent or trade your personal information. We share it only where necessary, and only with the recipients described below.

7.1 Operators and service providers

• Hostinger (web hosting). Receives all data stored on the website, including account, order and contact details. Purpose: hosting the website, its database and its email infrastructure.
• Payfast (payment gateway). Receives your name, email address, order number and order amount. You enter your payment details directly with them. Purpose: processing your payment securely.
• The Courier Guy / Ship Logic (delivery). Receives the recipient’s name, delivery address, contact number and email address, and parcel details. Purpose: collecting, tracking and delivering your order.
• Cloudflare (content delivery and security). Receives your IP address and browser and request data. Purpose: website speed, caching, and protection against attacks.
• Our email and marketing platform — Hostinger Reach. Receives your name, email address and marketing preferences. Purpose: sending the newsletters and promotional emails you have subscribed to.
• Our analytics provider — Google Analytics. Receives usage data, device data and cookie identifiers. Purpose: understanding how visitors use the site so that we can improve it.

Each of these parties acts as our operator under POPIA. They are required to process your personal information only on our instructions, to keep it confidential, and to apply appropriate security safeguards. They may not use it for their own purposes.

7.2 Other disclosures

We may also disclose personal information:

• to our professional advisors — accountants, auditors and attorneys — where necessary and under a duty of confidentiality;
• to the South African Revenue Service, a court, a regulator or a law-enforcement authority, where we are required to do so by law or by valid legal process;
• where necessary to establish, exercise or defend a legal claim, or to prevent fraud or other unlawful activity;
• to a purchaser or successor, if our business or its assets are sold or transferred — in which case your information will remain subject to protections no weaker than those in this policy.

08 Cross-border transfers of personal information

Some of the service providers listed above operate servers or group companies outside South Africa. This means your personal information may be transferred to, stored in, or accessed from another country.

In particular, our web host Hostinger is an international provider with data centres outside South Africa — our website is hosted in Hostinger’s European Union data centre — and Cloudflare operates a global network of edge servers.

In line with section 72 of POPIA, we transfer personal information outside South Africa only where at least one of the following applies:

• the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, and that includes provisions dealing with onward transfers;
• the transfer is necessary for the performance of our contract with you, or for the conclusion or performance of a contract concluded in your interest;
• you have consented to the transfer; or
• the transfer is for your benefit, and it is not reasonably practicable to obtain your consent but you would be likely to give it.

We contract with our service providers on terms that require them to maintain appropriate safeguards for your personal information wherever it is processed.

09 Cookies and similar technologies

A cookie is a small text file placed on your device when you visit a website. We use cookies to make the website work, to keep your shopping basket and login session intact, and — where you have consented — to understand how the site is used.

9.1 Types of cookies we use

• Strictly necessary cookies. These keep items in your cart, remember that you are logged in, secure the checkout, protect forms against abuse, and balance server load. They are set by WooCommerce, WordPress and Cloudflare. They cannot be disabled, because the site cannot function without them, and they are exempt from consent requirements.
• Functional cookies. These remember preferences such as saved addresses or recently viewed products. You can block them through your browser settings, but some features may stop working.
• Performance and analytics cookies. These measure visits, page views and traffic sources in aggregate so that we can improve the site. They are only set with your consent.
• Marketing cookies. We do not currently use marketing or advertising cookies. Any such cookies would only ever be set with your consent.

9.2 Managing cookies

You can accept, reject or delete cookies through your browser settings. Most browsers allow you to block all cookies, block third-party cookies only, or clear cookies when you close the browser. Instructions are available in the help section of Chrome, Safari, Firefox and Edge. Please note that blocking strictly necessary cookies will prevent you from logging in or completing a purchase.

We do not respond to “Do Not Track” browser signals, as there is currently no agreed standard for how they should be interpreted.

10 Direct marketing

We will only send you marketing emails or messages where:

• you have specifically consented to receive them — for example by subscribing to our newsletter or ticking the opt-in box at checkout; or
• you are an existing customer, we obtained your contact details in the course of a sale, and we are marketing our own similar products — as permitted by section 69(3) of POPIA. You are given the opportunity to object both when we collect your details and in every message we send.

You can opt out at any time, free of charge, by:

• clicking the “unsubscribe” link at the bottom of any marketing email; or
• emailing info@wellnessworkz.co.za with “Unsubscribe” in the subject line.

We will action opt-out requests promptly. You will still receive transactional messages relating to orders you place — order confirmations, delivery notifications and refund notices — as these are not marketing.

In terms of section 11 of the Consumer Protection Act, you also have the right to demand that we stop any direct marketing communication, or to pre-emptively block it, and to register a pre-emptive block on the National Opt-Out Register.

11 How we protect your personal information

As required by section 19 of POPIA, we take appropriate, reasonable technical and organisational measures to prevent the loss of, damage to, or unauthorised destruction of personal information, and unlawful access to or processing of it. These measures include:

• Encryption in transit — the entire website is served over HTTPS using a valid TLS certificate;
• Off-site payment processing — card data is handled entirely by our PCI-DSS compliant payment gateway and never touches our servers;
• Password protection — account passwords are stored in hashed (irreversible) form;
• Access control — administrative access to the website and its database is limited to authorised personnel, using individual accounts and strong passwords;
• Software maintenance — WordPress core, WooCommerce and our plugins are kept updated to address known vulnerabilities;
• Infrastructure security — firewalling, bot protection and DDoS mitigation provided by our host and our content delivery network;
• Backups — regular backups of the website and its database;
• Contractual safeguards — written agreements with our operators requiring confidentiality and adequate security.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential, and for notifying us immediately if you suspect unauthorised access to your account.

11.1 Security compromises

If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will — as required by section 22 of POPIA — notify the Information Regulator and notify you as soon as reasonably possible after discovering the compromise, unless a public body responsible for detecting crime informs us that notification would impede an investigation. Our notification will describe the possible consequences, the measures we intend to take, and what you can do to mitigate the potential harm.

12 How long we keep your personal information

We keep personal information only for as long as is necessary for the purpose it was collected for, unless a longer retention period is required or permitted by law.

• Order, invoice, payment and tax records — kept for 5 years from the end of the relevant tax period, as required by the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008.
• Customer account details — kept for as long as your account remains active, and for 3 years after your last order or login, after which the account may be deleted or anonymised.
• Marketing contact details and preferences — kept until you unsubscribe. We then keep a minimal suppression record indefinitely, so that we do not contact you again in error.
• Customer support correspondence — kept for 2 years from the date the query was resolved.
• Website logs and analytics data — typically kept for 12 months, or for the period set by the relevant service provider.
• Health information you volunteer — deleted once your query has been answered.

When a retention period expires, we securely delete, destroy or de-identify the information so that it can no longer be linked to you.

13 Your rights

Under POPIA you have the following rights in relation to your personal information. There is no charge for exercising them, except where a prescribed fee applies to a formal request for access to a record.

• The right to be notified that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person.
• The right of access — section 23. To confirm, free of charge, whether we hold personal information about you, and to request a record or description of that information, including details of any third parties who have had access to it. A prescribed fee may be payable for the record itself.
• The right to correction or deletion — section 24. To request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or that we destroy a record we are no longer authorised to keep.
• The right to object — section 11(3). To object, on reasonable grounds relating to your particular situation, to processing we carry out on the basis of legitimate interests or the public interest.
• The right to object to direct marketing — section 69. To object at any time, at no cost, to the use of your information for direct marketing.
• The right not to be subject to automated decision-making — section 71. Not to be subject to a decision with legal consequences for you based solely on automated processing intended to profile you. We do not make such decisions.
• The right to withdraw consent, where processing is based on your consent.
• The right to complain to the Information Regulator — see section 15 below.
• The right to institute civil proceedings in a court of competent jurisdiction regarding an alleged interference with the protection of your personal information.

13.1 How to exercise your rights

Email info@wellnessworkz.co.za, marked for the attention of the Information Officer, stating clearly which right you wish to exercise and what information it relates to.

To protect your privacy, we may ask you to verify your identity before we act on a request — for example by confirming the details of a recent order, or by providing a copy of an identity document. Requests for access or correction under sections 23 and 24 must be made on the prescribed Form 2, available on the Information Regulator’s website at www.inforegulator.org.za.

We will respond to your request within 30 days of receiving it. If we cannot meet that deadline, or if we are unable to give effect to your request, we will tell you and explain why.

14 Access to information (PAIA)

The Promotion of Access to Information Act 2 of 2000 (“PAIA”) gives you the right to request access to records we hold, where the record is required for the exercise or protection of a right. PAIA requests must be made on the prescribed Form 2 and submitted to our Information Officer at info@wellnessworkz.co.za. A prescribed fee may be payable. We will respond within 30 days, and will give reasons if access is refused.

15 Complaints to the Information Regulator

We would prefer the chance to resolve any concern directly — please contact us first at info@wellnessworkz.co.za. If you are not satisfied with how we have handled your personal information or your request, you have the right to lodge a complaint with the Information Regulator:

16 Links to other websites

Our website may contain links to third-party websites, including social media pages and supplier or product-information sites. This Privacy Policy does not apply to those websites. We have no control over their content or their privacy practices, and we are not responsible for them. We encourage you to read the privacy policy of any website you visit through a link from ours.

17 Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or the law. The current version will always be published at https://wellnessworkz.co.za/privacy-policy/, with the effective date shown at the top.

Where changes are material, we will bring them to your attention — for example by email, or by a prominent notice on the website — before they take effect. Your continued use of the website after an update constitutes acceptance of the revised policy.

18 Contact us

If you have any questions about this Privacy Policy, or about how we handle your personal information, please contact: