Soothely
Privacy notice and your POPIA rights
What we collect, why we collect it, who else sees it and how to make us delete it. Written to be read rather than to be legally impenetrable.
Last updated 30 July 2026.
Who is responsible
Soothely (Pty) Ltd is the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA).
Questions, access requests and complaints go to soothelyza@gmail.com and reach our Information Officer. We answer within one working day and resolve within thirty days.
What we collect
When you order: Name, email, mobile, delivery address
When you pay: Payment reference only, never card details
When you sign up: Email address
When you review: Display name, town, order number, email
When you browse: Page path, time on page, referrer
If you have an account: Email and sign-in method
Why we collect it
- To take payment, pack your order and get it delivered. Without this we cannot fulfil the contract.
- To email you a receipt and a tracking link, which are service messages about something you bought.
- To verify that a review came from a real order before we publish it.
- To email you a reminder if you start a checkout and do not finish it. The box for this sits in the payment step and is ticked by default, so if you would rather not have it, untick it before you pay.
- To send marketing email, where you have asked for it, and every one carries a one-click unsubscribe.
- To understand which pages people read, using page paths and durations that are not tied to your name or email.
What we never do
- We do not sell your personal information to anybody, for any amount, ever.
- We do not see or store your card number. Payment happens on PayFast, and we receive only a reference and a result.
- We do not add you to the newsletter because you bought something. Signing up for that is a separate action you take yourself. The unfinished-checkout reminder described above is the one message that is on by default, it can be turned off on the checkout page before you pay, and it stops for good the moment you unsubscribe.
- We do not use your data to make automated decisions that have legal consequences for you.
Who else processes it
Each of these is an operator under POPIA and is bound to process your information only on our instruction. Some are hosted outside South Africa, which POPIA permits under section 72 where the receiving country has comparable protection or the operator is contractually bound to it.
PayFast: Payment processing, South Africa
Courier partner: Delivery and tracking, South Africa
Google Firebase: Hosting, database and authentication
Email provider: Order and marketing email delivery
How long we keep it
Order records: 5 years, as tax law requires
Abandoned checkouts: 30 days, then deleted
Marketing subscribers: Until you unsubscribe
Published reviews: Until you ask us to remove them
Live visitor records: Deleted within 15 minutes
Page timing records: 12 months, aggregated
Your rights
Email soothelyza@gmail.com for any of these. We do not charge for a reasonable request and we do not require a form.
- Ask what we hold about you, and get a copy of it.
- Correct anything that is wrong or out of date.
- Ask us to delete it, where we are not legally required to keep it.
- Object to processing, and withdraw consent for marketing at any time.
- Complain to the Information Regulator of South Africa if we have not resolved something. Their office is at inforegulator.org.za and you do not need to go through us first.
Security
Data is encrypted in transit and at rest. Access to the admin portal requires a named account with two-step sign-in, and every moderation and refund action is written to an audit log.
If a breach affects your personal information we will tell you and the Information Regulator as soon as reasonably possible, as section 22 requires.
Cookies and similar storage
We use browser storage for your cart, your sign-in session, a random per-tab identifier used to count live visitors, and a second random identifier kept in your browser so we can tell a returning visit from a first one. Neither is linked to your name, email or order.
We also run the Meta Pixel, which is third-party advertising and cross-site tracking. It loads on every page as soon as the page does, without asking you first and without a cookie banner. It tells Meta which pages you looked at on this site, when you added something to your basket, when you started a checkout and the value of any order you completed, and Meta may match that to a Facebook or Instagram account. We use it to measure advertising.
Being straight about what that means: we have chosen not to ask for your consent before it loads, so if you would rather not be tracked this way, the choice has to be made in your browser or with an extension that blocks it, not on this site. You can also ask us what we hold and to delete it, using the contact details above.
Children
This is a cosmetic product intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email us and we will delete it.
soothelyza@gmail.com
Privacy notice