Privacy Policy

Introduction and Authority

PAPABI is a health, beauty and wellness retailer which is operated through its subsidiaries (“we” or “us” or “our”). We operate in the Republic of South Africa.

We are the Responsible Party over Personal Information which may relate to you. This Personal Information may include your healthcare information (given the type of retail business that we operate) as well as other information about you as a customer of PAPABI. We process this information to provide services to you.

We understand the importance of this information to you, and we are committed to only Processing Personal Information in a way that is lawful, reasonable, and relevant to our business activities, guided by the industry regulators.

This Privacy Policy sets out how we will treat your Personal Information whether provided by you to us or collected by us through other means in your ordinary use of our services, which includes access to our website [www.papabi.africa].This Privacy Policy describes our approach and practices in respect of your Personal Information and our treatment thereof.

This Privacy Policy must be read together with terms and conditions that appear on our website and any other documents or agreements (for example our terms and conditions) that describe the manner in which we, in specific circumstances, collect or process Personal Information about you. This will enable you to understand the manner in which PAPABI will process your Personal Information. This Privacy Policy supplements such other documents and agreements, however does not supersede them and in the event of a conflict, the terms of the particular document or agreement will prevail.

Personal Information that is Processed by PAPABI
PAPABI may collect, acquire, receive, record, organise, collate, store, update, change, retrieve, read, process, analyse, use and share your Personal Information in the manner as set out in this Privacy Policy. When we perform one or more of these actions, we are “Processing” your Personal Information.

“Personal Information” refers to private information about an identifiable natural or juristic person. Personal Information does not include information that does not identify a person (including in instances where that information has been anonymised), or information available to the public. The Personal Information that we collect about you may differ depending on the services and the goods that you procure from PAPABI.

In the course of engaging with us, you may share:

Identity Information, which includes information concerning your name, username or similar identifier, marital status, title, date of birth, gender, race and legal status, as well as copies of your identity documents, identity number, and registration number;
Contact Information, which includes your billing addresses, delivery addresses, e-mail addresses and telephone numbers;
Information relating to a Child, which includes the Identity Information of a child, being a natural person under the age of 18;
Financial Information, which includes payment card details;
Transaction Information, which includes details about goods and services procured by you and payments received from you;
Technical Information, which includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the website;
Usage Information, which includes information as to your access to and use of the website, products and services;
Loyalty Information, which includes your chosen PAPABI administered loyalty programmes, your participation in the loyalty programme, as well as the benefits which you have accumulated;
Marketing and Communications Information, which includes your preferences in respect of receiving marketing information from us and our third parties, your interaction with PAPABI and your communication preferences;
PAPABI may also process, collect, store and/or use aggregated data, which may include historical or statistical data (“Aggregated Data”) for any purpose. Aggregated Data may be derived from your Personal Information but is not considered Personal Information, as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Information in a manner that has the result that it can directly or indirectly identify you, we will treat the combined data as Personal Information, which will be managed in accordance with this Privacy Policy.

How We Collect Your Personal Information
We collect your Personal Information in three ways, namely:

through direct or active interactions with you;
through automated or passive interactions with you; and
from third parties.

Direct or active collection from you

We may require that you submit certain Personal Information when you are –

procuring goods or services from PAPABI,
participating in the loyalty programmes facilitated by PAPABI;
accessing portions of the website;
contracting with PAPABI;
communicating directly with us, for example via e-mail, telephone calls, feedback forms, site comments or forums.

If you contact us, we reserve the right to retain a record of that correspondence or voice recording, which may include Personal Information.

The Personal Information that we actively collect from you may include any of types of Personal Information listed in paragraph 2 of this Privacy Policy.

Passive collection from your Access Device
We may passively collect your Personal Information from the devices that you use to access and navigate the website or to make use of our online services (each an “Access Device”), by way of various technological applications, for instance, using server logs to collect and maintain log information.

The Personal Information that we passively collect from your Access Device may include your Identity Information, your Contact Information, your Technical Information, your Usage Information, your Marketing and Communications Information, or any other Personal Information which you permit us, from time to time, to passively collect from your Access Device.

Personal Information collected from third parties

PAPABI may receive Personal Information about you from a third party where it is necessary in order to provide the services that you have procured from us, for instance where we receive your Personal Information from your healthcare provider.

PAPABI may also obtain your Contact Information from a third party where we are unable to contact you regarding your loyalty benefits, or other contractually obligated communications that we are obliged to send you.

How We Use Your Personal Information
Any of the information we collect from you may be used in one of the following ways:

To identify you
(your information helps us identify you when you access our site and distinguish you from other people who access our site, and to create a profile for you))

Meet our contractual obligations
(we will you use your personal information to meet any contractual obligations we may have to you or another person)

To personalise your experience
(your information helps us to better respond to your individual needs);

To improve our website
(we continually strive to improve our website offerings based on the information and feedback we receive from you);

To improve customer service
(your information helps us to more effectively respond to your customer service requests and support needs);

To send periodic emails.
(The email address you provide may be used to send you information about products or services you may be interested in, respond to inquiries, and/or other requests or questions, and request feedback on our products or services, remind you to update your personal information, or tell you about competitions and special offers.)

For statistics
(We may use your personal information to compile and use statistical information about you and other users of our site, including information about how and when you access our site, your browser habits, click patterns. We may use these statistics to improve our site)

Comply with the law
(We may collect and use your personal information to comply with a law that requires that we collect and retain personal information, or to comply with any other legal provisions and processes)

Direct marketing
Some of our communications to you may be aimed at promoting ourselves and our services, products or site. We will only send you these if you have bought something from us, shown interest in a service or product or have given us permission to do so. You may opt-out of receiving these communications at any time by clicking “unsubscribe” in the footer of any of these messages. We will only send you direct marketing relating to our own products or services.

PAPABI will restrict its processing of your Personal Information to the original purpose for which it was collected, unless PAPABI reasonably considers that it is necessary to process it for another purpose that is compatible with the original purpose or where PAPABI is required to process that information in compliance with its legal obligations. PAPABI may, where permitted or required to do so by applicable legislation, process your Personal Information without your knowledge or consent, and will do so in accordance with the further provisions of this Privacy Policy.

Security
We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information.

We use a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Database to be only accessed by those authorised with special access rights to our systems, and are required to keep the information confidential.

We also have firewalls and anti-virus software which are updated regularly to ensure that they are in line with international standards.

After a transaction, your private information (credit cards, social security numbers, financials, etc.) will not be stored on our servers.

We review our security annually to make sure that it is always up to date.

Use of Cookies
Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow) that enables the sites or service providers systems to recognise your browser and capture and remember certain information.

We use cookies to understand and save your preferences for future visits and compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We may contract with third-party service providers to assist us in better understanding our site visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business.

If you prefer, you can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies via your browser settings. Like most websites, if you turn your cookies off, some of our services may not function properly. However, you can still place orders over the telephone or by contacting customer service.

We make use of Google AdSense Advertising on our website. Google, as a third party vendor, uses cookies to serve ads on our site. Google’s use of the DART cookie enables it to serve ads to our users based on their visit to your sites and other sites on the Internet. Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy located here.

Sharing of Your Personal Information

We will not intentionally disclose your Personal Information, whether for commercial gain or otherwise, other than with your permission or in the manner as set out in this Privacy Policy.

We may share your Personal Information under the following circumstances:

with our agents, advisers, service providers and suppliers that have agreed to be bound by this Privacy Policy or similar terms, which offer the same level of protection as this Privacy Policy;
with our affinity partners to ensure that you are able to participate in our loyalty programmes;
with our employees, suppliers, service providers and agents to the extent that they require such Personal Information in the provision of services, which include hosting, development and administration, technical support and other support services relating to the website or the operations of PAPABI. We will authorise any Personal Information processing done by a third party on our behalf, amongst other things by entering into written agreements with those third parties governing our relationship with them and containing confidentiality and non-disclosure provisions;
to enable us to enforce or apply any other contract between you and us;
to protect our rights, property or safety or that of our customers, employees, contractors, suppliers, service providers, agents, brokers and any other third party;
to mitigate any actual or reasonably perceived risk to us, our customers, employees, contractors, agents, brokers or any other third party;
with governmental agencies, and other regulatory or self-regulatory bodies, if required to do so by law or there is a reasonable belief that such is necessary for:
compliance with the law or with any legal process;
the protection and defence of the rights, property or safety of PAPABI, or our customers, employees, contractors, suppliers, service providers, agents, brokers or any third party;
the detection, prevention and management of actual or alleged fraud, security breaches, technical issues, or the abuse, misuse or unauthorised use of the website and contraventions of this Privacy Policy; and
the protection of the rights, property or safety of members of the public (if you provide false or deceptive information or misrepresent yourself, we may proactively disclose such information to the appropriate regulatory bodies and/or commercial entities).

Compulsory Personal Information and Consequences of Not Sharing With Us

Where PAPABI is required to process certain Personal Information by law, or in terms of a contract that we have with you, and you fail to provide such Personal Information when requested to do so, PAPABI may be unable to perform in terms of the contract we have in place or provide the services that you have requested.

PAPABI may be required to terminate the contract and/or relationship, upon notification to you, which termination will be done in accordance with the terms of the contract and all applicable legislation, should you fail to provide such Personal Information.

Retention of Your Personal Information

We may retain and Process some, or all, of your Personal Information if and for as long as:

we are required or permitted by law, regulation or a contract with you to do so;
it is for lawful purposes that are related to the performance of our functions and activities;
we reasonably require it for evidentiary purposes; or
you agree to us retaining it for a specified further period.

To determine the appropriate retention period for Personal Information, PAPABI will consider, among other things, the retention obligations imposed on PAPABI by legalisation and regulation, the nature and sensitivity of the Personal Information, the potential risks or harm that may result from its unauthorised use or disclosure, the purposes for which we process it and whether those purposes may be achieved through other means. PAPABI will always comply with applicable legal, regulatory, tax, accounting or other requirements as they pertain to the retention of Personal Information.

Storage and Transfer of Your Personal Information
We store your Personal Information on our infrastructure or those of our service providers.

We reserve the right to transfer to and/or store your Personal Information on infrastructure in a jurisdiction other than where it was collected, or outside of South Africa.

If the location to which Personal Information is transferred and/or is stored does not have substantially similar data protection laws to those of South Africa, we will take reasonably practicable steps, including the imposition of appropriate contractual terms to ensure that your Personal Information is adequately protected in that jurisdiction.

Maintenance of Your Personal Information
In accordance with applicable legislation and PAPABI’s policies, we will take all necessary steps to ensure that the persons responsible for the maintenance of your Personal Information do so in a manner that ensures that it is accurate, complete, not misleading and is up to date.

PAPABI is committed to continuous educational initiatives aimed at all personnel on the treatment of Personal Information and more intensive training for those employees who deal directly with your Personal Information.

It is your responsibility to advise PAPABI or the persons responsible for the maintenance of your Personal Information should any of your Personal Information be incorrect, incomplete, misleading or out of date, by notifying us at the contact details set out below. You may also update your Personal Information by accessing your “My Account” page on the PAPABI website and editing your details yourself.

PAPABI may use a third-party data source to update your contact information in situations where we are unable to contact you about loyalty benefits that have accrued to you.

Your Rights
Data protection laws confer certain rights on you in respect of your Personal Information, which include the right to:

Request access to your Personal Information (commonly known as a “data subject access request”), thereby enabling you to receive a copy of the Personal Information retained about you.

Request the correction of your Personal Information in order to ensure that any incomplete or inaccurate Personal Information is corrected.

Request erasure of your Personal Information where there is no lawful basis for the retention or continued processing of it.

Object to the processing of your Personal Information for a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

Request restriction of processing of your Personal Information. This enables you to ask PAPABI to suspend the processing of your Personal Information in limited circumstances, which may differ by jurisdiction.

Withdraw consent previously given in respect of the processing of your Personal Information at any time which withdrawal of consent will not affect the lawfulness of any processing carried out prior to your notice of withdrawal. Withdrawal of consent may limit the ability of PAPABI or a third party to provide certain products or services to you, but will not affect the continued processing of your Personal Information in instances in which your consent is not required.

Children
We do not collect any information from anyone under 18 years of age. Our website, products and services are all directed to people who are at least 18 years old or older.

Direct Marketing
Your participation in the loyalty programmes run by PAPABI is enhanced by marketing material generated by us and sent to you. You would have agreed to receive marketing material when you signed up to the loyalty programme.

You may opt out of receiving marketing communication from us at any time by contacting us at the contact details set out below and requesting that we desist from providing any direct marketing communication to you.

If you have chosen to opt out, we may send you written confirmation of receipt of your opt out request (which may be in electronic form), and will thereafter not send any further direct marketing communication to you.

There are certain service-related communications which we will still send to you in order to comply with our obligations to you. These will include communications to advise you of your loyalty rewards earned, or in respect of a transaction with you.

Third Party Sites
Occasionally, at our discretion, we may include or offer third party products or services on our website. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

Terms and Conditions
Please also visit our Terms and Conditions section establishing the use, disclaimers, and limitations of liability governing the use of our website at www.papabi.africa/terms.

Changes To Our Privacy Policy

If we decide to change our privacy policy, we will post those changes on this page.

This policy was last modified on 01 July 2024.

Governing Law

This Privacy Policy is governed by South African law. Where, by operation of law, the data privacy legislation of another jurisdiction applies to the processing of your Personal Information, then that legislation will be followed to the extent that it differs from South African law.

If any provision of this Privacy Policy is determined to be illegal, void or unenforceable due to applicable law or by order of a court of a competent jurisdiction, it shall be deemed to be deleted and the continuation in full force and effect of the remainder of the provisions will not be prejudiced.

Queries and Contact Details
Should you feel that your rights in respect of your Personal Information have been infringed, or if you would like to request further information on this privacy policy, please address your concerns to wecare@papabi.africa.

For general enquiries regarding our loyalty programmes, including the receipt of marketing materials from PAPABI, you may contact us telephonically via our Customer Service Centre on +27 73 057 3818. You may also email your query to wecare@papabi.africa.