POPIA Privacy Notice

POPIA Privacy Notice — Gevyse Organics

Last updated: 12 November 2026

This South African privacy notice supplements our existing Privacy Policy. Gevyse Organics operates in South Africa and recognises its responsibilities under the Protection of Personal Information Act 4 of 2013 (POPIA, also called the POPI Act). Where a mandatory protection under South African law applies, this notice does not restrict it. You can also read the general Privacy Policy for information about Shopify and other data processing activities.

1. Responsible party and privacy contact

For personal information processed by Gevyse Organics in operating this website and fulfilling customer orders, Gevyse Organics is the responsible party. Privacy enquiries and rights requests can be sent to info@gevyse.com with the subject POPIA Privacy Enquiry. Contact us for details about the person designated to handle your request.

2. Personal information we may process

Depending on how you interact with the store, we may process your name, email address, telephone number, delivery and billing details, order history, purchase and payment confirmation details, customer-service correspondence, and device or website-usage information. Payment processing and other functions may be handled by Shopify or external service providers. Please do not submit unnecessary sensitive personal information in routine enquiries.

3. Purposes and lawful grounds

We use information to answer enquiries, process payments and orders, arrange deliveries, communicate about purchases, handle after-sales support and complaints, maintain business records, prevent fraud, operate and improve the website, and conduct lawful marketing. Processing must be relevant and not excessive for the stated purposes. Depending on the processing activity, a lawful basis under POPIA may be consent, performance of a contract, a legal obligation, or a legitimate interest permitted by law. We will not repurpose information incompatibly with the original purpose without an appropriate lawful basis.

4. POPIA's eight conditions

We recognise POPIA's eight conditions for lawful processing: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and data subject participation. These conditions inform how we handle personal information and assess our service-provider arrangements.

5. Marketing and communications

We send promotional emails, SMS or WhatsApp messages only where permitted under POPIA. Electronic direct marketing generally requires consent, subject to the narrow lawful exception for existing customers and similar products or services. Where that exception applies, an opportunity to object must be provided when details are collected and in each marketing message. You can opt out of promotional communications free of charge by following the message instructions or emailing info@gevyse.com. Necessary order and service communications may continue.

6. Sharing and international transfers

Relevant information may be shared with Shopify, payment service providers, delivery partners, technology and customer-support providers, and professional advisers to provide the services described here or meet legal obligations. Some service providers may store or process information outside South Africa. When POPIA section 72 governs an international transfer, a permitted basis must apply, such as adequate protection through applicable law or binding safeguards, consent or another basis recognised by POPIA.

7. Security, retention and incidents

We must take appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage, unauthorised access and unlawful processing. No online system can guarantee absolute security. Where POPIA requires it following a security compromise, notifications will be made to the Information Regulator and affected individuals as soon as reasonably possible, subject to lawful exceptions. We retain personal information only for as long as needed for the original purpose or as required or permitted by applicable law, then delete, destroy or de-identify it where appropriate.

8. Your rights under POPIA

Subject to applicable requirements and exceptions, you may ask whether we hold personal information about you, request access, seek correction of inaccurate, incomplete or outdated information, request deletion or destruction where legally applicable, object to certain processing, and withdraw consent where consent was the basis for processing. You may also object to direct marketing. Please email info@gevyse.com with enough information to identify the request. We may need to verify your identity before responding.

9. Children and special information

Our online store is not directed at children, and we do not intentionally request children's personal information or special personal information for ordinary purchases. Any processing of such information must meet POPIA's additional restrictions and exceptions.

10. Complaints and the Information Regulator

If you have concerns about the handling of personal information, please email info@gevyse.com. You may also lodge a POPIA complaint with the South African Information Regulator at POPIAComplaints@inforegulator.org.za. See Information Regulator — Complaints.

11. Changes

We may revise this notice when our practices or the applicable legal requirements change. The date above indicates the most recent update.