At Home Grown By B, we are committed to protecting your privacy and personal information in accordance with the Protection of Personal Information Act, 2013 (“POPIA”). This Privacy Policy explains how we collect, use, store, process, disclose, and protect your personal information when you visit our website, purchase our products, interact with us, or use our services.
1. Collection of Personal Information
We may collect and process the following personal information:
- Full name and surname;
- Email address;
- Telephone number;
- Delivery and billing addresses;
- Payment information (processed through secure third-party payment providers);
- Order and purchase history;
- Customer support enquiries and correspondence;
- Marketing preferences;
- IP address and website usage data collected through cookies and analytics tools.
We collect personal information only where it is reasonably necessary for our business operations and the provision of products and services.
2. Purpose of Processing
We may process your personal information for the following purposes:
- Processing and fulfilling orders;
- Delivering products;
- Processing payments;
- Managing customer accounts;
- Responding to enquiries and customer support requests;
- Improving our website, products, and services;
- Conducting internal administration;
- Sending marketing communications (where permitted by law);
- Detecting fraud and security threats;
- Complying with legal and regulatory obligations.
3. Direct Marketing
Where you have consented or where otherwise permitted by law, we may send you:
- Promotional offers;
- Product updates;
- Newsletters; and
- Marketing communications.
You may unsubscribe at any time by clicking the unsubscribe link in our communications or by contacting us directly.
4. Sharing of Personal Information
We do not sell or rent your personal information. We may disclose personal information to:
- Payment service providers;
- Courier and logistics providers;
- Website and cloud hosting providers;
- IT service providers;
- Professional advisers;
- Auditors;
- Law enforcement agencies;
- Regulatory authorities where required by law.
All third parties processing personal information on our behalf are required to implement appropriate security and confidentiality measures.
5. Security Safeguards
We take reasonable technical and organizational measures to protect personal information from:
- Unauthorised access;
- Unlawful processing;
- Accidental loss;
- Destruction;
- Disclosure;
- Alteration; and
- Misuse.
Such measures may include:
- Secure Socket Layer (SSL) encryption;
- Restricted access controls;
- Password protection;
- Secure payment gateways;
- Regular monitoring of website security.
However, no method of electronic transmission, internet communication, cloud storage, website infrastructure, or data storage system is completely secure or immune from cyberattacks, malicious software, criminal activity, system vulnerabilities, or unauthorised access.
6. Cybersecurity and Data Breach Disclaimer
While the Company takes reasonable and appropriate measures to safeguard personal information in compliance with POPIA, the Customer acknowledges and accepts that:
- The transmission of information over the internet is never completely secure;
- Cybercrime, hacking, ransomware attacks, phishing attacks, malware, data theft, and unauthorised access may occur despite reasonable security measures;
- Third-party systems and infrastructure used by the Company may also be vulnerable to security incidents beyond the Company’s reasonable control.
Accordingly, the Company does not warrant or guarantee that its website, servers, databases, communication systems, or third-party service providers will be free from:
- Hacking attempts;
- Security breaches;
- Viruses;
- Malicious code;
- Cyberattacks; or
- Unauthorised access by third parties.
To the fullest extent permitted by applicable law, the Company shall not be liable for any loss, damage, expense, claim, or harm arising from:
- Criminal or unlawful cyber activity by third parties;
- Hacking or data breaches occurring despite the implementation of reasonable safeguards;
- Internet service failures;
- Telecommunications failures;
- Unauthorised interception of communications;
- Events beyond the Company’s reasonable control.
Nothing in this Privacy and Data Protection Policy excludes or limits liability where such limitation or exclusion is prohibited under POPIA, the Consumer Protection Act, or any other applicable law.
7. Data Breach Notification
Should the Company have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will:
- Investigate the security incident;
- Take reasonable steps to mitigate any potential harm;
- Notify affected individuals where required by law;
- Notify the Information Regulator where required by POPIA; and
- Provide information regarding appropriate protective measures where reasonably possible.
8. Retention of Personal Information
We retain personal information only for as long as necessary to:
- Fulfil the purpose for which it was collected;
- Complete transactions;
- Comply with legal, accounting, and regulatory obligations;
- Resolve disputes; and
- Enforce our agreements.
Personal information that is no longer required will be securely deleted, destroyed, or anonymised.
9. Your Rights Under POPIA
You have the right to:
- Request access to your personal information;
- Request correction of inaccurate or incomplete information;
- Request deletion of information where applicable;
- Object to certain processing activities;
- Withdraw consent where processing is based on consent;
- Lodge a complaint with the Information Regulator.
10. Cookies
Our website may use cookies and similar technologies to:
- Enhance user experience;
- Improve website functionality;
- Monitor website performance;
- Analyze traffic and user interactions.
You may disable cookies through your browser settings, although some website functions may be affected.
11. Third-Party Websites
Our website may contain links to third-party websites or platforms.
We are not responsible for:
- The privacy practices;
- Security measures; or
- Content
of any third-party websites. Users access such websites at their own risk.
12. Children’s Information
Our website and products are not intended for persons under the age of 18 without appropriate parental or guardian consent. We do not knowingly collect personal information from minors in violation of applicable law.
13. Changes to this Policy
We reserve the right to amend this Privacy Policy from time to time. Any changes will become effective upon publication on our website.
Customer Acknowledgement
By using our website, creating an account, purchasing our products, or providing personal information to us, you acknowledge that:
- You have read and understood this Privacy Policy;
- You consent to the processing of your personal information as described herein;
- You understand that no electronic system can be guaranteed completely secure;
- You accept the inherent risks associated with online transactions and electronic communications; and
- You acknowledge that the Company’s liability for data breaches and cyber incidents shall be limited to the fullest extent permitted by South African law.