Privacy policy

Last updated: 10 August 2026

1. Who is responsible for your information?

Seruvia is the responsible party for personal information where we determine why and how it is processed. Shopify and certain other providers may also act as responsible parties for processing they independently control, as explained in their own privacy notices.

2. Personal information we may collect

The information collected depends on how you interact with Seruvia. We apply POPIA’s minimality principle and aim to collect only information that is adequate, relevant and reasonably necessary for a lawful purpose.

• Identity and contact information: your name, email address, telephone number, billing address, delivery address and recipient details.
• Order and transaction information: products viewed, selected or purchased; cart activity; order value; discounts; delivery status; returns, refunds, exchanges and purchase history.
• Limited payment information: payment method, transaction reference, amount, status, confirmation and limited billing details. Seruvia does not ordinarily receive or store your complete card number, security code or online-banking credentials.
• Account information: account identifier, login-related data held through Shopify, preferences, saved addresses and account activity. Passwords are handled through Shopify’s systems and are not available to Seruvia in readable form.
• Communications: emails, telephone enquiries, customer-support messages, social-media communications, WhatsApp messages where used, feedback and other information you choose to send us.
• Returns and support evidence: photographs, videos, product information and delivery-packaging evidence submitted to resolve a complaint, return, warranty or courier claim.
• Reviews and public content: a name or chosen display name, rating, review, photograph, video or testimonial that you submit or authorise us to publish.
• Marketing information: subscription status, consent record, campaign engagement, promotion participation and communication preferences.
• Technical and usage information: IP address, browser, device type, operating system, identifiers, approximate location, referring page, pages viewed, interactions, dates and times, cookie data and similar online activity.
• Security information: login attempts, fraud indicators, account or transaction risk signals and records reasonably required to protect customers, Seruvia and the website.

Please do not send identity documents, banking credentials, detailed medical information or other sensitive information unless we specifically request the minimum information reasonably needed for a lawful purpose. You may redact information that is not relevant.

3. Where personal information comes from

We may collect personal information:

• Directly from you when you browse, create an account, subscribe, order, contact us, request support or submit content.
• Automatically through Shopify, cookies, pixels, server logs and similar technologies when you use the website.
• From service providers such as Shopify, payment providers, couriers, email providers, fraud-prevention tools and analytics or advertising partners.
• From social and advertising platforms when you interact with Seruvia’s pages, advertisements or permitted integrations.
• From another person where they lawfully provide your information, for example when purchasing a gift for you or naming you as the delivery recipient.
• From lawful public or commercial sources where permitted and reasonably necessary for fraud prevention, verification, legal compliance or the protection of rights.

If you provide another person’s information, you confirm that you are authorised to do so and that you have informed them how Seruvia will use it where required.

4. Why we process personal information

5. Lawful grounds for processing

Depending on the circumstances, Seruvia processes personal information because:

• You have given valid consent;
• Processing is necessary to perform a contract with you or take requested steps before entering into one;
• Processing complies with a legal obligation imposed on Seruvia;
• Processing protects a legitimate interest of the person concerned;
• Processing is necessary for Seruvia’s legitimate interests or those of a third party, where those interests are not overridden by the person’s privacy rights; or
• Another justification permitted by POPIA or applicable law applies.

Seruvia’s legitimate interests may include fulfilling and improving our services, keeping accurate records, protecting the website and customers, preventing fraud and responsibly growing the business. We will consider necessity, proportionality and the reasonably expected impact before relying on this ground.

6. Information you must provide

Most browsing information and marketing choices are voluntary. Certain details—including a name, contact information, delivery address and payment confirmation—are required to conclude and fulfil an order. If required information is not provided or is materially inaccurate, Seruvia may be unable to process payment, deliver the order, provide support, verify a request or comply with law.

Where information is required by law or contract, we will explain this where reasonably practicable. We will not require information that is excessive for the stated purpose.

7. Payments

Payments may be processed by Shopify-supported services and payment providers such as PayFast and Zapper. These providers collect and process payment information under their own security standards, legal obligations and privacy notices.

Seruvia ordinarily receives only the information needed to confirm and reconcile a transaction, such as the payment status, amount, payment method, reference and limited billing details. We do not ask customers to send card-security codes, online-banking passwords or one-time PINs by email, telephone, social media or WhatsApp.

Protect yourself: Seruvia will never ask you to disclose an OTP, card PIN or online-banking password. Report any suspicious payment request to info@seruvia.co.za.

8. Cookies and similar technologies

Seruvia and approved providers may use cookies, pixels, tags, software development tools and similar technologies. Depending on your settings, these may include:

• Strictly necessary technologies for checkout, security, fraud prevention, cart functions, account access and core website operation.
• Preference technologies that remember selections and improve convenience.
• Performance and analytics technologies that help us understand website use and improve performance.
• Advertising technologies that measure campaigns, limit repeated advertising or support relevant advertising through services such as Meta or TikTok, where enabled.

Where consent is required, non-essential technologies will be used according to the choices available through Seruvia’s cookie banner or privacy controls. You may also restrict cookies in your browser, although blocking necessary cookies can prevent checkout, account or cart features from working correctly.

Advertising partners may receive online identifiers and interaction data and may independently process that information under their own privacy notices. Seruvia does not sell personal information for money. Certain advertising disclosures may nevertheless be described as “sharing” or “targeted advertising” under some foreign privacy laws.

9. Direct marketing and communication choices

Seruvia may send marketing by email, SMS or another electronic channel only where permitted by POPIA and other applicable law. This may be based on valid consent or, for an existing customer, where Seruvia obtained the contact details in the context of a sale, markets its own similar products or services, and gave the customer a reasonable opportunity to object when the details were collected and with every marketing communication.

• Consent will not be inferred from silence, inactivity or a pre-ticked box where affirmative consent is required.
• Every electronic marketing message will identify the sender and provide a practical way to unsubscribe or request that marketing stop.
• You may object to direct marketing or withdraw marketing consent at any time without charge.
• Once you unsubscribe, we may retain limited suppression information so that we can honour your preference.

Opting out of marketing does not stop essential communications about an order, payment, delivery, return, security issue or customer-service request. Abandoned-cart or checkout reminders will be sent only where lawfully permitted and according to your communication choices.

10. When personal information may be shared

Seruvia does not disclose personal information indiscriminately. We may share the minimum reasonably necessary information with:

• Shopify, which hosts and supports the store, checkout, account and related ecommerce functions.
• Payment providers, including PayFast and Zapper, to authorise, process, reconcile or refund transactions and reduce payment fraud.
• Delivery and fulfilment providers, including Aramex and other courier partners, to collect, route, deliver, trace or return parcels.
• Communication and support providers, including Zoho and communications platforms chosen by the customer, to send and receive messages or provide assistance.
• Analytics, security and advertising providers, including Shopify and, where enabled, Meta or TikTok, to operate, secure, measure and responsibly promote the store.
• Professional advisers such as accountants, auditors, insurers or legal advisers where reasonably necessary and subject to confidentiality obligations.
• Authorities or other parties where disclosure is required by law, a valid court order or lawful government request, or is reasonably necessary to prevent harm, investigate unlawful conduct or establish, exercise or defend legal rights.
• A genuine successor or transaction party in a proposed sale, restructure, merger or transfer of the business, subject to appropriate confidentiality and data-protection safeguards.
• Any person you direct or authorise, such as a gift recipient, nominated representative or selected social platform.

Where a provider acts as Seruvia’s operator under POPIA, we take reasonable steps to require confidentiality and appropriate security through applicable contractual arrangements. Providers may only process information within the role and instructions lawfully applicable to them.

11. Seruvia’s relationship with Shopify

The store is powered by Shopify. Shopify collects and processes personal information to host the store, provide checkout and related services, prevent fraud, maintain security and improve its services. Information submitted through the store is transmitted to Shopify and relevant providers, which may be located outside South Africa.

If Shopify Network Intelligence or another enhanced Shopify service is enabled, Shopify may use information about interactions with Seruvia, Shopify and other merchants to provide enhanced services, analytics, security or personalised experiences. For processing that Shopify independently determines and controls, Shopify is responsible for its own compliance and rights requests.

Learn more in the Shopify Consumer Privacy Policy or use the Shopify Privacy Portal for requests relating to Shopify-controlled processing.

12. International transfers

Some providers—including Shopify, Zoho, payment, cloud, security, analytics, social-media or advertising providers—may store or process personal information outside South Africa.

Seruvia will make cross-border transfers only where permitted by section 72 of POPIA or other applicable law. Depending on the circumstances, safeguards may include an adequate foreign legal framework, binding corporate rules, a binding agreement that provides substantially similar protection, consent, contractual necessity or another legally recognised basis.

Foreign authorities may have lawful access to information under the laws that apply in the destination country. Seruvia selects reputable providers and limits the information shared to what is reasonably required for the relevant service.

13. Information security and data incidents

Seruvia uses appropriate, reasonable technical and organisational safeguards designed to protect the integrity and confidentiality of personal information, taking account of the information, reasonably foreseeable risks, available technology and implementation cost. Measures may include controlled access, account security, reputable service providers, secure payment handling, system updates, backups and staff or operator confidentiality.

No online or storage system can be guaranteed completely secure. Customers are responsible for using a strong, unique password and for protecting account credentials and devices. Please notify us promptly if you suspect unauthorised account or order activity.

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Seruvia will investigate and notify the Information Regulator and affected persons as soon as reasonably possible where POPIA requires, subject to lawful delay and the circumstances of the incident.

14. How long information is kept

Seruvia retains personal information only for as long as reasonably necessary or authorised for the purpose for which it was collected, including to:

• Provide an account, fulfil orders and maintain customer-service continuity;
• Meet tax, accounting, consumer-protection, warranty and other legal recordkeeping duties;
• Resolve disputes, process chargebacks and establish, exercise or defend legal claims;
• Prevent fraud, enforce agreements and maintain security; or
• Meet a longer retention period to which the person has validly consented.

When Seruvia is no longer authorised to retain identifiable information, it will be deleted, destroyed, de-identified or securely placed beyond ordinary use as soon as reasonably practicable, subject to backup cycles and legal restrictions. Suppression records may be retained to honour marketing objections.

15. Special personal information

Seruvia does not intentionally request or routinely process special personal information such as detailed health, biometric, religious or criminal information. Because our products relate to oral care, beauty and self-care, a customer may voluntarily mention a sensitivity, reaction or health concern when requesting support.

Please provide only what is necessary. If special personal information is received, Seruvia will restrict its use to the lawful purpose for which it is reasonably required, apply additional care and process it only where POPIA permits.

16. Children’s personal information

Seruvia’s website and checkout are intended for use by adults aged 18 or older. This does not mean that every Seruvia product is unsuitable for younger people; it means that an adult or competent person must manage online purchases and provide any legally required consent.

We do not knowingly collect a child’s personal information without the prior consent of a competent person or another legal authorisation under POPIA. If you believe a child has submitted personal information improperly, please contact the Information Officer so that we can investigate and take appropriate action.

17. Your privacy rights

Subject to POPIA, PAIA and other applicable law, a person may have the right to:

• Ask whether Seruvia holds personal information about them, free of charge;
• Request access to a record or description of personal information and information about recipients or categories of recipients;
• Request correction or deletion of information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained;
• Request destruction or deletion where Seruvia is no longer authorised to retain the information;
• Object, on reasonable grounds, to processing based on certain lawful grounds;
• Object at any time to processing for direct marketing;
• Withdraw consent where processing is based on consent, without affecting processing already lawfully completed;
• Request restriction in circumstances recognised by POPIA;
• Not be subjected to certain solely automated decisions that produce legal or substantial effects, except where lawfully permitted; and
• Lodge a complaint with the Information Regulator or pursue another remedy available in law.

Rights are not absolute. Access may be subject to adequate identity verification, the procedures and lawful grounds for refusal in PAIA, protection of another person’s rights, legal privilege, recordkeeping duties and any prescribed fee. Seruvia will explain a lawful refusal or limitation where required.

18. Making a privacy request

Send privacy requests to info@seruvia.co.za with the subject line Privacy Request. Please explain what you are requesting and provide enough information to locate the relevant records.

To protect customers against fraudulent access, Seruvia may request proportionate proof of identity or authority. Do not send a complete identity document unless specifically requested; we may ask for unnecessary details to be redacted. An authorised representative must provide reasonable proof of authority.

Seruvia will respond within a reasonable time and any period prescribed by law. We will not penalise or discriminate against a person for exercising a lawful privacy right.

19. Automated tools and fraud screening

Shopify, payment providers and security services may use automated tools to identify unusual activity, protect transactions, prevent fraud or personalise services. A risk flag may result in a request for verification, a temporary hold or human review.

Seruvia does not intend to make a decision based solely on automated processing that has a legal or similarly significant effect on a person unless the decision and appropriate safeguards are permitted by POPIA or another applicable law. You may contact us to ask about a material decision affecting your order.

20. Reviews, social media and third-party links

Information posted in a public review, comment, competition entry or social-media space may be visible and copied by others. Please avoid publishing personal contact, payment, health or identification information in a public area.

Seruvia will not present a customer’s private message, image or video as a public testimonial without appropriate permission. Published customer content may be moderated or removed where it is unlawful, misleading, abusive, fraudulent, infringes rights or contains unnecessary personal information.

The website may link to third-party websites, apps or social platforms. Their operators independently control their privacy and security practices. A link does not mean Seruvia controls or guarantees that external service. Please review the third party’s privacy notice before providing information.

21. Complaints

Please first contact Seruvia’s Information Officer so that we have an opportunity to investigate and resolve your concern in good faith:

If the matter remains unresolved, you may lodge a complaint with the Information Regulator (South Africa).

22. Changes to this policy

Seruvia may update this Privacy Policy when our practices, providers, website, products or legal obligations change. The updated version will be published on this website with a revised “Last updated” date. We will provide additional notice or request fresh consent where applicable law requires it.

A policy change will not retrospectively make an unlawful use lawful or remove a privacy right that has already arisen.

Official references: Protection of Personal Information Act 4 of 2013, Electronic Communications and Transactions Act 25 of 2002 and the Information Regulator (South Africa).