Soothely

Privacy notice and your POPIA rights

What we collect, why we collect it, who else sees it and how to make us delete it. Written to be read rather than to be legally impenetrable.

Last updated 30 July 2026.

Who is responsible

Soothely (Pty) Ltd is the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA).

Questions, access requests and complaints go to soothelyza@gmail.com and reach our Information Officer. We answer within one working day and resolve within thirty days.

What we collect

When you order: Name, email, mobile, delivery address

When you pay: Payment reference only, never card details

When you sign up: Email address

When you review: Display name, town, order number, email

When you browse: Page path, time on page, referrer

If you have an account: Email and sign-in method

Why we collect it

To take payment, pack your order and get it delivered. Without this we cannot fulfil the contract.
To email you a receipt and a tracking link, which are service messages about something you bought.
To verify that a review came from a real order before we publish it.
To send marketing email, only where you have ticked a box asking for it, and every one carries a one-click unsubscribe.
To understand which pages people read, using page paths and durations that are not tied to your name or email.

What we never do

We do not sell your personal information to anybody, for any amount, ever.
We do not see or store your card number. Payment happens on PayFast, and we receive only a reference and a result.
We do not add you to a marketing list because you bought something. That requires a separate, deliberate opt-in.
We do not use your data to make automated decisions that have legal consequences for you.

Who else processes it

Each of these is an operator under POPIA and is bound to process your information only on our instruction. Some are hosted outside South Africa, which POPIA permits under section 72 where the receiving country has comparable protection or the operator is contractually bound to it.

PayFast: Payment processing, South Africa

Courier partner: Delivery and tracking, South Africa

Google Firebase: Hosting, database and authentication

Email provider: Order and marketing email delivery

How long we keep it

Order records: 5 years, as tax law requires

Abandoned checkouts: 30 days, then deleted

Marketing subscribers: Until you unsubscribe

Published reviews: Until you ask us to remove them

Live visitor records: Deleted within 15 minutes

Page timing records: 12 months, aggregated

Your rights

Email soothelyza@gmail.com for any of these. We do not charge for a reasonable request and we do not require a form.

Ask what we hold about you, and get a copy of it.
Correct anything that is wrong or out of date.
Ask us to delete it, where we are not legally required to keep it.
Object to processing, and withdraw consent for marketing at any time.
Complain to the Information Regulator of South Africa if we have not resolved something. Their office is at inforegulator.org.za and you do not need to go through us first.

Security

Data is encrypted in transit and at rest. Access to the admin portal requires a named account with two-step sign-in, and every moderation and refund action is written to an audit log.

If a breach affects your personal information we will tell you and the Information Regulator as soon as reasonably possible, as section 22 requires.

Cookies and similar storage

We use browser storage for your cart, your sign-in session and a random per-tab identifier used to count live visitors. We do not run third-party advertising or cross-site tracking cookies.

The visitor identifier is not linked to your name, email or order, and it is discarded when you close the tab.

Children

This is a cosmetic product intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email us and we will delete it.

soothelyza@gmail.com

Privacy notice