This policy explains what personal information we collect when you use
sarlieskinn.com, why we collect it, who we share it with, and what rights you have
over it under the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who we are
Sarlie Skinn is the responsible party for the personal information
described in this policy.
- Registration number: 2024/044883/07
- Contact: via our contact page
- Information Officer: N. Sarlie, contactable through our contact page
2. Information we collect
We collect only what we need to run the store and answer your questions.
- Identity and contact details — name, surname, email address, telephone number, delivery and billing address.
- Order information — products purchased, order value, order history, delivery status.
- Payment information — handled by our payment provider. We receive confirmation of payment and the last four digits of your card; we never see or store your full card number or CVV.
- Account information — username and an encrypted password, if you create an account.
- Correspondence — messages you send through our contact form, by email or on social media, including the subject and content of your enquiry.
- Marketing preferences — whether you have subscribed to our newsletter, and whether you have opted out.
- Technical information — IP address, browser type, device type, pages visited and referring site, collected through cookies and similar technologies.
Health information. Please do not send us details of medical conditions,
diagnoses or medication unless it is necessary for your enquiry. Health information is
"special personal information" under POPIA and is subject to stricter rules. Where you
do give it to us voluntarily, we use it only to answer your question and delete it once
the enquiry is resolved.
3. How we collect it
- Directly from you — when you place an order, create an account, complete the contact form or subscribe to our newsletter.
- Automatically — through cookies and website analytics when you browse.
- From third parties — our payment provider and courier confirm transaction and delivery information back to us.
4. Why we process it, and on what basis
POPIA requires a lawful justification for every use. Ours are:
- To fulfil your order — process payment, deliver goods, send order confirmations and handle returns. Basis: performance of our contract with you.
- To provide customer support — respond to enquiries and complaints. Basis: contract, and our legitimate interest in supporting customers.
- To meet legal obligations — keep tax, accounting and consumer-protection records. Basis: compliance with law.
- To send marketing — newsletters and product news. Basis: your consent, or the limited direct-marketing allowance in section 69 of POPIA for existing customers.
- To improve the website — understand which pages are used and detect faults. Basis: our legitimate interest in operating a functioning store.
- To prevent fraud — verify orders and protect against fraudulent transactions. Basis: legitimate interest and legal obligation.
We do not sell your personal information, and we do not use it for automated decision-making
that produces legal consequences for you.
5. Who we share it with
We share personal information only with operators who process it on our behalf, under
contract, and only as far as they need it:
- Our payment provider — to take payment securely.
- Our courier partner — to deliver your order.
- Our website host — which stores the site and its database.
- Our email and marketing platform — to send order confirmations and newsletters.
- Our website analytics provider — to measure how the site is used.
- Professional advisers — accountants and attorneys, where necessary.
We may also disclose information where the law requires it, or to establish, exercise or
defend a legal claim.
6. Cross-border transfers
Some of our service providers store data outside South Africa. Where that happens, we
transfer your information only if the recipient is subject to laws or binding agreements
that provide an adequate level of protection, as required by section 72 of POPIA.
7. How long we keep it
- Order and transaction records — five years, as required by South African tax legislation.
- Account information — while your account is active, and for 12 months after you close it.
- Contact form enquiries — 12 months after the enquiry is resolved.
- Marketing lists — until you unsubscribe.
- Website analytics — 26 months.
We delete or de-identify personal information once we no longer need it.
8. How we protect it
We use appropriate technical and organisational measures to safeguard your information,
including encrypted connections (HTTPS), access controls, hashed passwords and a payment
provider that is PCI-DSS compliant.
No system is completely secure. If a breach occurs that creates a risk to your personal
information, we will notify you and the Information Regulator as required by section 22
of POPIA.
9. Your rights
Under POPIA you have the right to:
- be told what personal information we hold about you, and request a copy of it;
- ask us to correct information that is inaccurate, misleading or out of date;
- ask us to delete information we no longer have grounds to keep;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting processing already carried out;
- opt out of direct marketing at any time; and
- complain to the Information Regulator.
To exercise any of these, contact us through our
contact page. We may ask you to verify your identity
first. We will respond within a reasonable period, and in any event within the timeframes
POPIA requires. Access requests are made using the prescribed PAIA form and may attract a
prescribed fee.
10. Cookies
We use cookies to:
- Keep the store working — remember your cart and keep you logged in. These are essential and cannot be switched off.
- Understand usage — anonymous analytics about which pages are visited.
- Support marketing — measure the performance of campaigns, where you have consented.
You can block or delete cookies in your browser settings. Blocking essential cookies will
stop parts of the store from working, including checkout.
11. Children
This website is not directed at children under 18, and we do not knowingly collect their
personal information. If you believe a child has given us information, contact us through
our contact page and we will delete it.
12. Complaints
Please raise any concern with us first through our
contact page — we would rather fix
it directly. You also have the right to complain to:
The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
inforegulator.org.za
13. Changes to this policy
We may update this policy from time to time. The current version is always the one
published on this page, with the date shown at the top. Material changes will be
communicated to you where the law requires it.
14. Contact us
Sarlie Skinn
Reach us any time through our
contact page.
