Privacy Policy

Living Water Labs (Pty) Ltd ("we", "us", "the Company") is the responsible party for the personal information described in this policy, as defined by the Protection of Personal Information Act 4 of 2013 ("POPIA"). We operate the online store at livingwaterlabs.co.za, supplying research compounds strictly for research purposes only. Questions about this policy or your personal information can be directed to our Information Officer at support@livingwaterlabs.co.za.

We collect only the information needed to process orders and run the store:

• Identity and contact details — name, email address and phone number.
• Delivery details — the physical or courier address you provide for dispatch.
• Order and payment records — items ordered, order totals, your order reference and the EFT payment reference (we do not collect or store card or banking login details; payment is by direct EFT bank transfer).
• Communications — messages you send us by email, WhatsApp or the contact form.
• Marketing preferences — your email address if you subscribe to our newsletter or restock alerts, and your consent status.
• Technical and usage data — pages viewed, time on page, device type, browser, country, how you reached us (search engine, link or campaign tag) and cart contents, recorded under a randomly generated visitor reference. We reduce this data deliberately: your IP address is shortened and then one-way hashed rather than stored, referring websites are kept as the site name only, and we do not record your city. See "Cookies and Analytics" below.

We process your personal information for the following purposes, each with a lawful basis under POPIA:

• Fulfilling your order (performance of our contract with you) — processing payment references, arranging courier delivery and sending transactional emails such as order and dispatch confirmations.
• Customer support and record-keeping (legitimate interest and legal obligation) — responding to queries and keeping the sales and tax records the law requires.
• Direct marketing (consent) — sending newsletters, restock alerts and promotions only where you have opted in. You can withdraw consent at any time (see "Your Rights").
• Security and improvement (legitimate interest) — protecting the store against fraud and abuse, and measuring how the store is used so we can improve it. This first-party measurement is our own: the data stays in our systems and is never sold, shared or used to build a profile of you for anyone else. You can object to it — see "Your Rights".
• Advertising and third-party analytics (consent) — sharing activity with Meta and Google to measure advertising, ONLY where you have accepted through the cookie banner. Decline and nothing is sent to them.

We do not sell your personal information. We share it only with the operators (service providers) that help us run the store, and only as far as each needs to perform its function:

• Our courier partner, to deliver your order (name, address, phone number).
• Our email service provider, to send transactional and (where you have opted in) marketing email.
• Our hosting and database providers, to operate the website and store order data securely.

Each operator is bound to process your information only on our instructions and to keep it secure. We may also disclose information where required by law or to protect our legal rights.

Some of our operators (for example our email, hosting and database providers) process data on servers outside South Africa. Where personal information is transferred beyond our borders, we take reasonable steps to ensure the recipient is subject to laws, binding agreements or rules that provide a level of protection substantially similar to POPIA.

We keep personal information only for as long as necessary for the purpose it was collected, or for as long as the law requires. Order, tax and accounting records are retained for the statutory retention period. Marketing contact details are kept until you unsubscribe or ask us to delete them, after which we retain a minimal suppression record only to ensure we honour your opt-out.

We apply appropriate technical and organisational safeguards to protect personal information against loss, unauthorised access and misuse — including encrypted connections (HTTPS), access controls on our systems, and restricting staff and operator access to a need-to-know basis. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the Information Regulator of any breach that poses a real risk, as POPIA requires.

We use cookies and similar technologies for three things, and we separate them honestly:

• Essential — keeping the store working, for example remembering your cart and your signed-in session. These cannot be switched off.
• Our own analytics — a randomly generated visitor reference that lets us see which pages are read, where visitors leave, and which carts are abandoned. We rely on legitimate interest for this rather than consent, because it is first-party only, it is reduced as described above, and it is what tells us whether the store works. It is not used for advertising and is never shared. You may object at any time and we will stop and delete your data.
• Advertising and third-party analytics — Meta and Google. These fire only if you accept through the banner on your first visit, and declining stops them completely.

You can also block or delete cookies in your browser at any time. Neither declining nor blocking will stop you from browsing or ordering. We keep page-level records for 90 days, visit and event records for 180 days, abandoned-cart records for 60 days, and then delete them automatically.

Under POPIA you have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct or update information that is inaccurate or incomplete;
• ask us to delete or destroy information we no longer have a lawful basis to keep;
• object to processing based on legitimate interest, on reasonable grounds — this includes our own analytics: email us and we will stop recording your visits and delete what we hold;
• withdraw consent to direct marketing at any time — every marketing email carries a one-click unsubscribe link, or you can email us.

To exercise any of these rights, contact our Information Officer at support@livingwaterlabs.co.za. We may need to verify your identity before acting on a request.

If you believe we have not handled your personal information lawfully, please contact us first so we can put it right. You also have the right to complain to the Information Regulator of South Africa:Information Regulator (South Africa) — email enquiries@inforegulator.org.za (complaints: POPIAComplaints@inforegulator.org.za), website inforegulator.org.za.

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always available on this page, with the "last updated" date shown above. Material changes will be highlighted where appropriate.