Privacy Policy
How we collect, use, store and protect your personal information — in plain language, as required by South African law.
Who we are and how to reach us
This Privacy Policy applies to Tea of Life (Pty) Ltd, the responsible party for all personal information collected through our website at teaoflife.co.za and any related services. It has been written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and the Consumer Protection Act 68 of 2008 (CPA).
What personal information we collect
We only collect personal information that is necessary for us to provide our products and services to you. Under POPIA, personal information means any information about an identifiable, living natural person.
Depending on how you interact with our website, we may collect the following:
Your full name, delivery address, billing address, email address, phone number, and payment details. Payment card information is processed securely by our payment provider and is never stored on our servers.
Your name, email address, and a password of your choice. You may also add a delivery address and order history for your convenience.
Your email address and, where you provide it, your name. Subscription is voluntary and you may unsubscribe at any time.
Your name, email address, phone number, and the content of your message.
Technical information including your IP address, browser type, device type, pages visited, time on site, and referring URL. This is collected automatically through cookies and analytics tools. See Section 6 on Cookies for more detail.
We do not collect any special personal information as defined by POPIA — such as information relating to your health, race, religion, political views, trade union membership, biometric data, or criminal record — unless you voluntarily provide it and give us explicit consent to process it.
How we use your personal information
We process your personal information only for specific, lawful purposes. Under POPIA, we must have a valid legal basis for each type of processing we carry out.
Legal basis: Performance of a contract. We use your name, contact details, and delivery address to process and dispatch your order, communicate your tracking information, and handle any queries about your purchase.
Legal basis: Performance of a contract. Your payment details are passed securely to our payment service provider. We do not store or have access to your full card number.
Legal basis: Consent. If you subscribe to our newsletter or opt in to marketing at checkout, we will send you information about new products, promotions, and brand updates. You can withdraw this consent at any time by clicking the unsubscribe link in any email or contacting us directly. We will not send you unsolicited marketing communications.
Legal basis: Legitimate interest. We use anonymised analytics data to understand how visitors use our website so that we can improve the experience. This does not involve identifying individual users.
Legal basis: Legitimate interest / contract. We use your contact details to respond to messages you send us through our contact form, email, or phone.
Legal basis: Legal obligation. We may be required to retain certain records for tax, accounting, or regulatory purposes. We may also disclose your information to law enforcement or regulators where required by a court order or applicable law.
Who we share your information with
We do not sell, rent, or trade your personal information to any third party for marketing or commercial purposes. We share your information only where necessary, and only with parties who are obligated to handle it securely and lawfully.
Your name, delivery address, and contact number are shared with our courier service providers in order to deliver your order. These providers are bound by their own data protection obligations.
Payment information is processed by our payment gateway provider. This processing is subject to their own privacy and security standards, which comply with Payment Card Industry (PCI DSS) requirements.
We use Omnisend as our email marketing platform. Your email address and name are stored on Omnisend's servers for the purpose of sending you marketing communications you have consented to receive. Omnisend processes this data in accordance with their privacy policy and applicable data protection law.
Our online store is powered by Shopify. Your order and account information is stored on Shopify's secure servers. Shopify is GDPR and POPIA-aligned. You can read Shopify's privacy policy at shopify.com/legal/privacy.
We use Google Analytics to collect anonymised browsing data. This data does not identify individual users and is used solely to understand how our website is used so we can improve it.
We may disclose your personal information where required by law, court order, or formal request from a law enforcement authority. We will only do so to the extent required and will notify you where we are legally permitted to do so.
Where any of our service providers process your data outside South Africa, we ensure that adequate protections are in place as required by Section 72 of POPIA.
How long we keep your information
We keep your personal information only for as long as is necessary for the purposes described in this policy, or as required by law.
Order records are retained for five years for accounting and tax purposes, as required by South African tax law.
Account information is retained for as long as your account remains active. If you request deletion of your account, we will remove your personal information within 30 days, subject to any legal retention requirements.
Marketing subscription data is retained until you unsubscribe or request removal. After unsubscribing, your email address is retained on a suppression list to ensure we do not contact you again.
Browsing and analytics data is retained by Google Analytics for a maximum of 26 months and is anonymised.
Cookies
A cookie is a small text file stored on your device when you visit a website. Cookies allow us to recognise your browser and remember information about your visit.
We use the following types of cookies on our website:
These are essential for the website to function. They include cookies that keep items in your shopping cart, maintain your session when you are logged in, and enable secure checkout. You cannot disable these without affecting site functionality.
We use Google Analytics to understand how visitors use our site. These cookies collect anonymised data about pages visited, time on site, and how you arrived. You may opt out via your browser settings or the Google Analytics opt-out tool.
These cookies may be set by our email marketing platform or social media integrations to help us understand campaign performance and show you relevant content. These are only set with your consent.
Under POPIA, you have the right to refuse non-essential cookies. You can manage your cookie preferences through your browser settings at any time. Note that disabling certain cookies may affect how some features of our website function.
Your rights under POPIA
As a data subject under the Protection of Personal Information Act, you have the following rights. You may exercise any of these rights by contacting us at sales@teaoflife.co.za. We will respond within a reasonable time and at no charge unless your request is manifestly unfounded or excessive.
If you are not satisfied with how we handle your personal information or your rights request, you have the right to lodge a complaint with the Information Regulator:
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za
Phone: 010 023 5207
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
How we protect your information
We take the security of your personal information seriously. We have implemented reasonable technical and organisational measures to protect your information against unauthorised access, loss, destruction, or disclosure.
These measures include SSL encryption on all pages of our website, access controls limiting which team members can view customer data, secure hosting through Shopify's infrastructure, and regular review of our data handling practices.
Payment information is handled exclusively by our payment service provider and is never stored on our servers.
While we take commercially reasonable steps to protect your information, no method of electronic transmission or storage is completely secure. In the event of a data breach that poses a risk to your rights, we will notify you and the South African Information Regulator as required by Section 22 of POPIA, without unreasonable delay.
Children's personal information
Our website and products are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at sales@teaoflife.co.za and we will take steps to delete that information promptly. POPIA provides additional protections for the personal information of children, and we take these obligations seriously.
Links to third-party websites
Our website may contain links to third-party websites, including our social media profiles on Instagram and Facebook. Clicking these links will take you to a separate website with its own privacy policy. We are not responsible for the content, privacy practices, or data handling of any third-party website. We encourage you to read the privacy policy of any site you visit.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or by placing a prominent notice on our website.
We encourage you to review this policy periodically. Your continued use of our website after any changes constitutes your acknowledgment of the updated policy.
Questions and requests
If you have any questions about this Privacy Policy, wish to exercise any of your rights, or want to make a complaint about how we have handled your personal information, please contact our Information Officer:
We aim to respond to all privacy-related requests within 30 days as required by POPIA.
