Privacy policy

This notice explains what personal information Hair Chef collects, why we collect it, who we share it with and what you can ask us to do with it. It is written to meet section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA).

What we collect, and why

We collect only what an order actually needs. Supplying it is voluntary, but we cannot deliver an order without it.

• Your name, email address and phone number — to confirm the order, send you the payment reference, and reach you if something goes wrong on the day.
• Your delivery address, and any gate code or instruction you add — to bring the parcel to you. We ask for the instruction because a closed complex is the most common reason a delivery fails.
• What you bought and what you paid — this is a financial record and we are required to keep it.
• Your review, if you leave one — published under the name you give us.
• Technical information — a session cookie that remembers your basket, and your IP address, which we use only to rate-limit forms so they cannot be used to guess other people’s order numbers.

Marketing is separate, and always optional

We only email you hair tips and offers if you tick the box asking us to. That box is never ticked for you, it is never required to complete a purchase, and you can change your mind at any time by replying to any message or contacting us directly. Declining has no effect on your order.

Who we share it with

We do not sell your information, and we do not share it for anyone else’s marketing. We share the minimum necessary with:

• PayFast, our payment provider, when you pay by card or instant EFT. Your card details are entered on their systems and never reach ours — we only ever see whether a payment succeeded.
• Our courier, when an order is sent nationally: the name, address and phone number needed for the waybill.
• Our email provider, to deliver order confirmations.

Some of these providers store information on servers outside South Africa. We only use providers who are subject to laws or binding agreements that protect your information to a standard comparable to POPIA.

How long we keep it

Orders, invoices and payment records are kept for as long as tax and company law require us to keep them. Everything else — your account details, saved addresses, marketing preferences and reviews — is kept only while you want an account with us.

If you ask us to erase your information, we remove your name, contact details and addresses. We do not delete the order records themselves, because we are not permitted to: we anonymise them instead, so what remains is a sale with no person attached to it.

Your rights

Under POPIA you may, at any time and free of charge:

• ask what personal information we hold about you, and ask for a copy;
• ask us to correct anything that is wrong;
• ask us to delete information we no longer need, subject to the retention rules above;
• object to us using your information for marketing, or withdraw a consent you previously gave;
• complain to the Information Regulator.

Ask us using the contact details below and we will respond within a reasonable time. We may need to confirm who you are first, so that we are not handing your information to somebody else.

Keeping it safe

The site is served over an encrypted connection, passwords are stored hashed and never in a form we can read, and the admin side of the shop is limited to accounts that need it. No system is perfect; if information is ever compromised in a way that could harm you, we will tell you and the Information Regulator.

Children

The shop is not intended for children under 18, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will remove it.

Changes to this notice

If what we do with your information changes, we change this page and update the date at the top of it.