Velvet Skin Beauty uses your personal information to take your order, deliver it and answer your emails. We do not sell or rent it to anyone.

Who is responsible for your information

Velvet Skin Beauty, the online shop at velvetskinbeauty.co.za, is the responsible party under the Protection of Personal Information Act (POPIA) for the personal information described on this page. Our information officer deals with requests and complaints about personal information. Email info@velvetskinbeauty.co.za.

What we collect

  • When you order: your name, email address, phone number, billing and delivery addresses, the products you order and any note you add at checkout.
  • When you pay: the amount, date and reference that appear on our bank statement. For a refund, the bank account details you send us. We take EFT only, so the site never asks for card details and we store none.
  • If you open an account: your name, email address, password and saved addresses. The password is stored as a one-way hash, so nobody at the shop can read it.
  • When you email us or use the contact form: your name, email address and what you write. The contact form also keeps a coded form of your IP address for 15 minutes, to stop one connection sending many messages. If the form shows an error, it keeps what you typed for 10 minutes so that it can fill the form in again.
  • When you post a product review or a blog comment: the name and email address you enter, what you write, your IP address and your browser type. Your name and review are shown on the site. Your email address is not.
  • With every order, WooCommerce (the shop software) records your IP address, your browser and device type, where your visit came from (for example a search engine, another website or a typed address), the page you arrived on and how many pages you viewed.
  • On every visit, our hosting company’s server logs record your IP address and the pages you request.

We do not ask for health information. If you tell us about a skin reaction or a medical condition in an email, we use it only to deal with that email.

Why we use it

  • To process your order, match your EFT payment to it and send it by courier.
  • To send order emails: the confirmation, payment and dispatch updates and the tracking number.
  • To answer your emails and handle returns, refunds and faulty products.
  • To keep the records that tax and consumer law require.
  • To keep the site secure and block spam and fraud.
  • To see which pages and links lead to orders, from the visit details recorded with each order.

We send no newsletters or marketing emails. If we start, we will ask for your consent first, and every marketing email will have an unsubscribe link.

Our lawful grounds under POPIA

Section 11 of POPIA sets out when personal information may be processed. We rely on these grounds:

  • Contract: we need your details to sell and deliver the products you order and to handle returns.
  • Legal obligation: tax and consumer law require us to keep order and payment records.
  • Legitimate interest: server logs and spam checks keep the site secure, and the visit details recorded with orders show us which pages and links lead to orders. You can object to this use.
  • Consent: reviews and comments you choose to publish, and any marketing we start later. You can withdraw consent at any time.

Who we share it with

  • The courier: your name, delivery address, phone number and email address, so it can deliver the parcel and contact you about it.
  • Banks: your bank and ours process your EFT payment and any refund. If we add card payments later, we will name the card payment provider here before we switch them on.
  • Our hosting company: Domains.co.za, a South African company, hosts the website, its database and our email. The site sends its emails through the same host.
  • Our web developers: they can see orders and accounts in the site’s admin while they maintain the site.
  • Gravatar: when a review or comment is shown, the page asks Gravatar for the writer’s profile picture, using a coded form (hash) of the writer’s email address. Gravatar is run by Automattic in the United States.
  • Authorities such as SARS, the police or a court, when the law requires us to hand information over.

How long we keep it

  • Orders and payment records, including the delivery details and visit details recorded with them: at least 5 years, the period South African tax law requires for financial records.
  • Your account: until you ask us to close it. The orders in it are kept for the 5 years above.
  • Emails and contact form messages: 2 years after the last message. Emails about an order are kept with that order’s records.
  • Reviews and comments: while they are on the site. Email us to have yours removed.
  • Copies of the emails the site sends, such as order confirmations: 14 days in the site’s email log.

Cookies

Cookies are small files a website stores in your browser. This site uses only the cookies that WordPress and WooCommerce set to run the shop. It sets no advertising cookies and uses no analytics service such as Google Analytics. If we add either, we will list the cookies here before we switch them on.

  • woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_: remember what is in your basket. The session cookie lasts about 2 days. The other two end when you close the browser.
  • woocommerce_recently_viewed: remembers the products you looked at, for the recently viewed list. It ends when you close the browser.
  • store_notice: remembers that you closed the notice at the top of the page.
  • sbjs_ cookies: WooCommerce’s order attribution. They record where your visit came from and how many pages you viewed, so that an order shows how the buyer found the shop. They are read only by this site.
  • wordpress_logged_in_, wordpress_sec_ and wordpress_test_cookie: keep you signed in to your account and check that your browser accepts cookies. Sign-in ends when you close the browser or after 2 days, or lasts 14 days if you tick “Remember me”.
  • comment_author_: if you ask the site to save your name and email address when you post a review or comment, these cookies remember them for about a year.

Your wishlist is saved in your browser’s local storage on that device only. We do not keep a copy.

You can block or delete cookies in your browser settings. Without them, the basket and sign-in do not work.

How we protect it

The site uses HTTPS, so what you type is encrypted on its way to us. Only the people who run the shop and its web developers can sign in to the admin. If someone gains access to your personal information without authority, we tell you and the Information Regulator, as section 22 of POPIA requires.

Your rights under POPIA

  • Ask whether we hold personal information about you, and for a copy of it.
  • Ask us to correct information that is wrong or out of date.
  • Ask us to delete information we no longer have a lawful reason to keep.
  • Object to a use based on our legitimate interest, and to direct marketing at any time.
  • Withdraw consent you gave, for example for a published review.
  • Complain to the Information Regulator.

To make a request, email info@velvetskinbeauty.co.za from the email address on your order or account, so that we can confirm it is you. We reply within 1 working day and complete the request within 30 days. If the law requires us to keep a record you ask us to delete, such as an order, we tell you which record and why.

The Information Regulator

You can complain to us, or directly to the Information Regulator:

Changes to this policy

When we change how we use personal information, we update this page. The date at the top shows when it last changed.

Questions about this policy: email info@velvetskinbeauty.co.za. We reply within 1 working day.

Nothing in this policy reduces your rights under POPIA.