This Privacy Policy explains how Herbs at Work handles the personal information you share with us when you browse the store, create an account, place an order, or contact our support channels. It is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA).
Herbs at Work is the 'responsible party' for the personal information we collect. You can reach us about anything in this policy at info@herbsatwork.co.za or via the contact details on our Contact page. We have appointed an Information Officer in line with POPIA; for any POPIA-specific request, write to info@herbsatwork.co.za with the subject line 'Information Officer' and we will route your message.
We collect the personal information needed to run the store and to serve you, including: your name, contact details, and delivery address; your account sign-in email and a hashed password; your order history and the items you have bought; any preparation notes you choose to give us (such as measurements, side selection, or dosage details); the messages you send us through support channels; and the payment confirmation we receive from PayFast or your bank (we do not see or store your full card number).
We use that information to: create and maintain your account; process and fulfil your orders; arrange delivery with The Courier Guy; send you order updates, dispatch notices, and replies to your support messages; keep tax and accounting records that the law requires us to keep; and improve the store. We do not use your information for advertising, and we do not sell it.
Our lawful basis for processing is mostly the need to perform the contract you have with us when you place an order, together with our legal obligations under tax, accounting, and consumer law. Where the information is optional (for example, a delivery instruction that is not strictly needed to fulfil the order), we rely on your consent and you can ask us to remove it at any time.
We share your information with a small set of trusted parties, only as much as each one needs to do its job: PayFast (or your bank, for EFT) to process payment; The Courier Guy to deliver your order; our email and hosting providers to send messages and run the store; and our accountant or tax authority where the law requires us to report. Each of these parties is bound by their own privacy and security obligations, and we have agreements in place where the law asks for one.
Some of these parties store data on infrastructure located outside South Africa. Where that happens, we take reasonable steps to make sure your information is still protected to a standard that is comparable to POPIA, and we limit what is sent to what each service needs to do its work.
We keep your account information for as long as your account is open, and we keep order, payment, and delivery records for at least five years from the date of the transaction, because the South African Revenue Service and the Consumer Protection Act require us to. Once those retention periods have passed, we delete or anonymise the information.
POPIA gives you the right to: ask whether we hold personal information about you and request a copy (you may be charged a prescribed fee for a manual request); ask us to correct or delete information that is wrong, out of date, or no longer needed; object to processing that you have not consented to; and lodge a complaint with the Information Regulator. To use any of these rights, write to info@herbsatwork.co.za. We will respond within the time POPIA allows.
If you are not happy with how we handle a privacy complaint, you can contact the Information Regulator directly at enquiries@inforegulator.org.za, by phone on 010 023 5200, or through the complaint process on their website at inforegulator.org.za.
We protect your information with reasonable technical and organisational safeguards, including encrypted connections (HTTPS), access controls limited to staff who need the information to do their work, and password and authentication controls on the systems that hold customer data. No system is perfectly secure, but we keep our safeguards under review.
This policy may be updated from time to time to reflect changes in the store, our suppliers, or the law. The version published here at the time you contact us or place an order is the version that applies. The 'last updated' date at the top of this policy shows when the current version came into effect.