Privacy
Privacy Policy
This policy explains how Hearth & Co handles your personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
Last updated: 8 November 2026
We collect only the personal information we need to run the store, deliver orders, give support, manage accounts, and meet our legal duties. We do not sell personal information.
Who is responsible
Hearth & Co (Pty) Ltd (registration number 2026/543457/07) is the responsible party for personal information processed through this website.
We have an Information Officer registered with the Information Regulator (certificate #2026-061839). Privacy questions and requests can be sent to hello@hearthco.co.za.
What we collect and why
| Information | Why we use it | Do you have to give it? |
|---|---|---|
| Order and delivery details: name, email, phone number, delivery address, what you ordered | To take your order, arrange delivery, give updates, and handle returns and refunds | Yes, to place an order. Without them we cannot deliver |
| Account details: name, email, password (stored scrambled, never readable), saved addresses, order history | To run your account and speed up checkout | No. You can order as a guest |
| Payment status and reference. Yoco handles your card details | To confirm payment and handle refunds | Yes, to pay for an order |
| Messages, return requests and photos you send us | To answer you and assess returns and faults | No, only if you contact us or ask for a return |
| Marketing preference | To send offers and product updates, only if you choose this | No. It is off unless you turn it on |
| Technical information such as IP address and browser type, and the cookies described in our Cookie Policy | To keep the site working and secure, and to prevent fraud | Collected automatically when you use the site |
| Site usage information, only if you accept analytics cookies: pages and products viewed, items added to cart, checkout started, purchase value, Google cookie identifiers, IP address and browser details | To understand how the site is used, so we can improve it | No. You can decline and still shop |
| Advertising information, only if you accept advertising cookies: pages and products viewed, items added to cart, purchase value, Meta cookie identifiers, IP address and browser details | To measure our ads and show you relevant ones | No. You can decline and still shop |
We use this information to carry out your order, to meet legal duties such as tax, accounting and consumer law, to protect the store from fraud and misuse, where you have agreed, to send marketing, and, where you have accepted analytics and advertising cookies, to understand how the site is used and to measure and improve our advertising.
Who we share it with
We share personal information only where needed to run the store:
- Yoco, our payment provider, receives the order amount and our payment reference so it can take payment. You enter your card details directly on Yoco's payment page; we never see them.
- Google, through Google Analytics, receives the site usage information listed above, only if you accept analytics cookies. We do not send Google your name, email, phone number, delivery address or order number.
- Meta, which runs Facebook and Instagram, receives the advertising information listed above, only if you accept advertising cookies. We do not send Meta your name, email, phone number or delivery address.
- Our supplier, Syntech Distribution (Pty) Ltd, and the couriers it uses receive your name, delivery address, phone number, email and the items ordered, so they can deliver to you.
- Xneelo, which hosts our website, database and email.
- Our professional advisers, and government or other authorities, where the law requires it.
Where a provider handles information for us, we share only what it needs to do its job. Apart from Google Analytics and Meta's advertising tools, which only run if you accept them, we do not use analytics or error-monitoring services that collect personal information. If we start, we will update this policy first.
Where your information is kept
Our website, database and email are hosted in South Africa. If you accept analytics and advertising cookies, Google processes the site usage information and Meta processes the advertising information, both listed above, outside South Africa under their own terms, and by accepting you agree to this. Otherwise we do not send personal information outside South Africa ourselves. Yoco and your bank handle payments under their own policies and may process information differently. If we ever use another provider outside South Africa, we will update this policy first and make sure the information stays protected as POPIA requires.
Marketing
Marketing is opt-in only. We never tick the marketing box for you. We do not currently send marketing emails. If we do, every message will say who it is from and have a way to opt out, and you can switch it off any time in your account or by emailing us. We will not send marketing to people who have not agreed to it.
Advertising cookies are separate from marketing emails, and are also opt-in. If you accept them, Meta can measure our ads and show you relevant ones on its platforms. Declining does not affect shopping.
How long we keep it
| Information | How long |
|---|---|
| Order, payment, invoice, refund and return records | 7 years from the order date, as tax and company law require |
| Account details | While your account is open, and for up to 3 years after you close it in case of disputes. You can ask us to delete it sooner, but the order records above must stay |
| Messages, return requests and photos | While the query or claim is open, and for 1 year after it closes |
| Marketing preference | Until you withdraw it. After that we keep only a note that you opted out, so we do not contact you again |
| Site usage information | We do not store it ourselves. Google keeps it for 14 months. The cookies on your device last up to 2 years, or until you withdraw your choice |
| Advertising information | We do not store it ourselves. Meta keeps what it receives under its own terms. The cookies on your device last up to 90 days, or until you withdraw your choice |
| Technical and security logs | 12 months |
After these periods, we delete or anonymise the information.
Your rights
You may ask us to:
- Tell you what personal information we hold about you.
- Correct information that is wrong or out of date.
- Delete information we no longer need. You can request account deletion in your account profile, and we will tell you what we may have to keep, such as order records.
- Stop processing your information, where the law allows.
- Withdraw a consent you gave, such as for marketing. You can withdraw your analytics and advertising cookie choice at any time under Cookie settings in the footer.
Email hello@hearthco.co.za. We aim to reply within 30 days. The Information Regulator publishes forms for objections and for correction or deletion requests on its POPIA page. You do not have to use them to ask us, and we will help you if you are unsure.
If you are unhappy with how we handle your information, you can complain to the Information Regulator at POPIAComplaints@inforegulator.org.za or through its complaints page. We would appreciate the chance to put it right first.
Security
We use reasonable technical and organisational measures to protect personal information. The site uses an encrypted connection, passwords are stored scrambled, and access is limited to what is needed. No online system is completely risk-free. If a security breach is likely to harm you, we will tell you and the Information Regulator, as the law requires.
Children
Our website is for adults. We do not knowingly collect information about children. If you think a child has given us personal information, email us and we will delete it.
Access to records
Our manual under the Promotion of Access to Information Act is on the PAIA Manual page.
Changes to this policy
We may update this policy. The version on this page applies from the date shown at the top.