Privacy Policy

This policy explains what personal information we collect when you use this website or buy from us, why we hold it, who else sees it, and what you can require us to do about it. It is written to comply with South Africa’s Protection of Personal Information Act, 2013 (POPIA).

Last updated 18 August 2026.

Who is responsible for your information

Natural Elixir is a brand of The Elixir Company (Pty) Ltd, a private company registered in South Africa. In POPIA terms we are the responsible party for the personal information described here.

What we collect, and why

We collect only what we need to sell you a bottle and get it to you. There is no profiling, no selling of data, and no sharing with advertisers.

1. When you place an orderYour name, email address, telephone number, delivery address and billing address. We need these to process the order, deliver it, issue a tax invoice and handle any return. Keeping them is also a legal requirement under tax law.
2. When you payCard and banking details are entered on PayFast’s systems, not ours. We never see or store your card number. We receive only confirmation that a payment succeeded or failed, and a reference.
3. When you create an accountYour email address, a password stored in encrypted form, and your saved addresses and order history, so you do not have to type them again.
4. When you contact usWhatever you put in the message, plus your name and email address, so that we can reply and keep a record of what was agreed.
5. When you simply visitStandard technical information: IP address, browser and device type, pages viewed and how you arrived. This is used in aggregate to understand what the site needs to do better.
6. If you subscribe to anythingYour email address, and only with your consent. Every message we send carries an unsubscribe link that works.

We do not knowingly collect information from children under 18, and this site is not directed at them. We also do not ask for, and do not want, information about your health. If you tell us something about your health in a message to us, we use it only to answer that message.

The legal basis for holding it

POPIA requires us to have a lawful reason for every piece of information we process. Ours are: performance of a contract when you buy something and we have to deliver it; compliance with a legal obligation where tax and company law require us to keep records; your consent for marketing, which you can withdraw at any time; and our legitimate interests in keeping the site secure and working, which never override your rights.

Who else sees your information

Only the parties we need to involve to complete your order and run the site. Each is bound to use it for that purpose alone.

1. PayFastOur payment provider. They process the transaction and hold the card details we never see.
2. Couriers and delivery partnersYour name, address and telephone number, so that somebody can find your door.
3. Our hosting and website providersWho store the site and its database on our behalf.
4. Google AnalyticsAggregated usage statistics about how the site is used. See the cookies section below.
5. Our accountants and auditorsTransaction records, as required to prepare and audit the financial statements.

We do not sell, rent or trade your personal information to anybody, for any purpose. We will disclose information if a court or a law requires it, and not otherwise.

Information sent outside South Africa

Some of the services above, analytics and email in particular, store information on servers outside South Africa. POPIA permits this where the receiving country or the provider offers comparable protection, and we rely on the contractual protections those providers give. If you would rather your information was not processed this way, the practical consequence is that we cannot complete an online order, and you are welcome to buy from one of our stockists instead.

Cookies and analytics

Cookies are small files a website stores in your browser. This site uses them in three ways.

1. Strictly necessaryKeeping your basket, keeping you logged in, and completing checkout securely. The site cannot function without these.
2. PreferencesRemembering choices you have made so you are not asked again.
3. AnalyticsGoogle Analytics, which tells us in aggregate which pages people read and where they leave. We use it to decide what to fix, not to identify you.

You can block or delete cookies in your browser settings. Blocking the strictly necessary ones will stop the basket and checkout from working.

How long we keep it

Order and tax records are kept for five years from the end of the financial year they fall in, because South African tax and company law requires it. Account details are kept while your account is open, and deleted on request. Marketing consent is kept until you withdraw it. Enquiries are kept only as long as they are useful for answering you and resolving anything that follows.

How we protect it

The site runs over an encrypted connection, payment details are handled entirely by PayFast rather than by us, administrative access is restricted and password protected, and passwords are stored in encrypted form. No system is perfectly secure, and we do not pretend otherwise. If personal information is ever compromised, POPIA requires us to notify both the Information Regulator and you, and we will.

Your rights under POPIA

These are yours to exercise, they cost you nothing, and asking will never affect how we treat you as a customer.

1. To be told what we holdAsk, and we will tell you what personal information we have about you and where it came from.
2. To have it corrected or deletedIf it is wrong, misleading or no longer needed, we will fix or remove it, except where the law requires us to keep a record.
3. To object to how it is usedIncluding any use for direct marketing, which you can stop at any time.
4. To withdraw consentWhere we relied on your consent, you may take it back, and that does not undo what was lawful beforehand.
5. To complainTo us first, so we can put it right, and to the Information Regulator whether or not you come to us.

Write to brett@naturalelixir.co.za and mark it for the attention of the Information Officer. We will respond within a reasonable period and no later than 30 days.

The Information Regulator

If we do not resolve your complaint you are entitled to take it to the regulator directly.

Changes to this policy

We update this page when what we do changes. The date at the top tells you when it last happened, and a material change will be announced on the site rather than made quietly.