What we do with your details.

01Who we are

Aloe Yami Products (Pty) Ltd (“Aloe Yami”, “we”, “us”) is a company registered in South Africa, Centurion, Gauteng. We sell Aloe Yami Balm in bulk to people who resell it.

For the purposes of POPIA we are the responsible party for the personal information described here. Our Information Officer is the director of Aloe Yami Products (Pty) Ltd, who can be reached at info@aloeyamiproducts.com or on WhatsApp at 072 221 5735, weekdays 8:00–17:00.

02What personal information we collect

We only collect what we need to fill an order and run a reseller account.

When you place an order

• Your name and surname
• Your email address
• Your phone number (this is the number we WhatsApp about the order)
• Your delivery address — street, town or suburb, postal code and province — for the courier
• The few sentences you write about why you want to sell and a bit about yourself
• Where you heard about us, if you tell us
• The packs you ordered, the amount, the date, and the order reference

When you create a portal account

• A password you choose. We never store the password itself — only a one-way hashed version of it, which cannot be turned back into your password.
• Your sales counter taps and reorder activity inside the portal

When you pay

Payment is taken by Payfast (Pty) Ltd on their own secure pages. Your card number, CVV and banking login are entered on Payfast and never touch this website. Payfast tells us only whether the payment succeeded, the amount, and a payment reference.

Automatically, when you visit

• Standard server and security logs from our hosting provider — IP address, browser type, pages requested, timestamps — kept briefly to keep the site running and to spot abuse.
• A small number of items stored in your own browser (see Cookies and local storage).

We do not collect any special personal information (such as health, race, religion or biometric data), and we ask you not to send it to us.

03How we collect it

• Directly from you — when you fill in the order form, create a portal password, message us, or email us.
• From Payfast — the payment result and reference after you pay.
• Automatically — server logs and the items your browser stores locally.

04Why we use it, and our lawful basis

To take and fulfil your order

Pricing it, taking payment, booking the courier, sending your receipt, and messaging you about delivery. Basis: performance of our agreement with you.

To run your reseller (portal) account

Signing you in, showing your orders, letting you log sales and reorder. Basis: performance of our agreement with you.

To support you

Answering WhatsApp and email questions, and sorting out damaged or missing stock. Basis: performance of our agreement, and our legitimate interest in good service.

To keep records the law requires

Keeping invoices and transaction records for tax and company-law purposes. Basis: compliance with a legal obligation.

To keep the site secure and working

Server logs, rate-limiting repeated sign-in and password-reset attempts, and fraud checks. Basis: our legitimate interest in a safe service.

To send you news about selling Aloe Yami

Only where you have agreed, or where you are already a customer and it relates to what you bought. You can opt out at any time. Basis: consent, or our legitimate interest in existing-customer marketing, as allowed by POPIA.

05Who we share it with

We do not sell your personal information, and we do not share it for anyone else’s marketing. We share it only with the operators who help us run the shop, and only for that purpose:

Payfast (Pty) Ltd

Payment processing. They receive your name, email, phone and the order amount so they can take the payment and show you a receipt.

Our courier partner

If you choose delivery, the courier receives your name, address and phone number so they can deliver the pack.

Our hosting and email providers

The website, the order records and the reseller accounts are hosted on Netlify. Receipts and account emails are sent through our email provider. These operators process the data on our instructions only.

Advisers and authorities

Our accountant or lawyer where needed, and SARS, a court, or the Information Regulator where the law requires it.

Each operator is bound to protect the information and to use it only for the service they provide to us.

06Where it is stored, and cross-border transfer

Order records and reseller accounts are stored by our hosting provider, Netlify, whose servers may be located outside South Africa. Payfast and our email provider may likewise process limited data outside the country. Where personal information leaves South Africa, we rely on the recipient being subject to laws or binding rules that give protection comparable to POPIA, or on the transfer being necessary to perform our agreement with you.

07How long we keep it

• Order and invoice records — kept for at least five years from the end of the tax year they relate to, because tax and company law require it.
• Your portal account — kept while the account is active. If you ask us to close it, we delete the account and its login, keeping only what the invoice-record rule above requires.
• Support messages — kept up to 24 months, then deleted.
• Server and security logs — kept for a short period (typically 30 to 90 days) unless needed for an investigation.

When a retention period ends we delete the information or de-identify it so it can no longer be linked to you.

08How we protect it

• The whole site is served over HTTPS.
• Passwords are stored only as a salted one-way hash, never in readable form.
• Repeated sign-in and password-reset attempts are rate-limited.
• Access to order data is limited to the people who run Aloe Yami and is protected by a separate staff login.
• Card and banking details are handled entirely by Payfast and are never received or stored by us.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

09Cookies and local storage

We keep this light. We do not use advertising or tracking cookies.

Your basket

The packs you add are stored in your browser’s local storage so your order survives a page reload. It never leaves your device until you submit the form.

Sign-in session

When you sign in to the portal (or staff sign in to the dashboard) we set a session cookie so you stay signed in. It is removed when you sign out.

Security

Short-lived records used to rate-limit repeated login and reset attempts.

You can clear these at any time in your browser settings. Clearing them signs you out and empties the basket.

10Marketing messages

If we send updates about selling Aloe Yami, every message will say who it is from and will carry a way to stop them. You can also reply “STOP” on WhatsApp or email info@aloeyamiproducts.com and we will take you off the list. Opting out of marketing does not stop the messages we have to send about an order you placed.

11Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you, and get a copy;
• ask us to correct or complete information that is wrong or out of date;
• ask us to delete information we no longer have a lawful reason to keep;
• object, on reasonable grounds, to us processing your information;
• withdraw consent where we relied on consent (this does not affect processing done before you withdrew it);
• complain to the Information Regulator.

To exercise any of these, email info@aloeyamiproducts.com from the address on your order, or WhatsApp us. We will respond within a reasonable time and may need to confirm your identity first. There is normally no charge; the official POPIA access-request form (Form 2) is available from the Information Regulator’s website.

12Children

The shop is meant for adults running their own resale. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, tell us and we will delete it.

13Changes to this policy

If we change how we handle personal information we will update this page and change the “Last updated” date. If the change is significant we will make a clearer effort to tell you, for example a notice on the site or a message to account holders.

14Complaints

Please raise anything with us first — we would rather fix it directly. You also have the right to complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints email: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za