PRIVACY POLICY

PRIVACY POLICY

(POPIA-Compliant – South Africa)

Effective Date: 1 April 2026

This Privacy Policy explains how Plants in Thyme (“we”, “us”, “our”) collects, uses, and protects your personal information when you visit or make a purchase on www.plantsinthyme.co.za.

We are committed to protecting your privacy in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

  1. Responsible Party

Plants in Thyme is the Responsible Party (as defined under POPIA) for the processing of your personal information.

Address:
259 Spencer Avenue

Chartwell North Estates

Johannesburg

Email: shelley@plantsinthyme.co.za

2. Personal Information We Collect

2.1 Information You Provide

When you place an order or interact with our Site, we may collect:

  • Full name
  • Billing and shipping address
  • Email address
  • Phone number
  • Payment information
  • Account details (if applicable)
  • Any correspondence you send to us

 

2.2 Information Collected Automatically

When you browse our Site, we may automatically collect:

  • IP address
  • Browser type and version
  • Device type
  • Time zone
  • Pages visited
  • Referring websites
  • Cookies and tracking data

We use cookies, log files, web beacons, tags, and similar technologies.

3. Lawful Basis for Processing (POPIA Compliance)

We process your personal information on one or more of the following lawful grounds:

  • Performance of a contract (to process and deliver your orders)
  • Compliance with legal obligations
  • Legitimate business interests (e.g., fraud prevention, site optimisation)
  • Your consent (for marketing communications, where required)

4. How We Use Your Personal Information

We use your information to:

  • Process payments and fulfil orders
  • Deliver products
  • Provide invoices and confirmations
  • Communicate with you
  • Detect and prevent fraud
  • Improve our website and customer experience
  • Send marketing communications (if you have opted in)

You may opt out of marketing communications at any time.

5. Sharing of Personal Information

We may share your personal information with:

  • Payment processors
  • Courier and delivery service providers
  • IT and hosting providers
  • Analytics providers such as Google Analytics
  • Regulatory or law enforcement authorities where required by law

We ensure that third parties who process data on our behalf are bound by appropriate confidentiality and data protection obligations.

6. International Transfers

Some of our service providers may be located outside South Africa. Where personal information is transferred cross-border, we ensure that:

  • The recipient is subject to a law, binding corporate rules, or agreement that provides adequate protection; or
  • You have consented to the transfer; or
  • The transfer is necessary for the performance of a contract.

7. Data Retention

We retain your personal information:

  • For as long as necessary to fulfil the purposes outlined in this policy;
  • As required by tax, accounting, or other applicable laws;
  • Until you request deletion (unless we are legally required to retain it).

8. Your Rights Under POPIA

As a data subject under POPIA, you have the right to:

  • Access your personal information
  • Request correction or updating of your information
  • Request deletion or destruction (where legally permissible)
  • Object to processing based on legitimate interests
  • Withdraw consent (where processing is based on consent)
  • Lodge a complaint with the Information Regulator

To exercise your rights, email: shelley@plantsinthyme.co.za

We may require proof of identity before processing your request.

9. Information Officer

In terms of POPIA, Plants In Thyme has appointed an Information Officer responsible for compliance with the Act.

Information Officer Contact:
shelley@plantsinthyme.co.za

10. Security Measures

We implement appropriate technical and organisational security safeguards to protect your personal information against:

  • Loss
  • Unauthorised access
  • Misuse
  • Alteration
  • Disclosure

However, no method of transmission over the internet is completely secure.

 

11. Cookies and Tracking

We use cookies to improve your browsing experience and analyse site traffic. You may disable cookies through your browser settings, although this may affect site functionality.

12. Direct Marketing

We will only send direct electronic marketing communications where:

  • You have consented; or
  • You are an existing customer and have not opted out.

You may unsubscribe at any time using the unsubscribe link in our emails.

13. Children’s Information

We do not knowingly collect personal information from individuals under 18 years of age without parental consent.

14. Complaints

If you believe we have not processed your personal information in accordance with POPIA, you may contact us first to resolve the issue.

You may also lodge a complaint with:

Information Regulator
Website: https://www.justice.gov.za/inforeg/
Email: inforeg@justice.gov.za

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on our website.