Privacy Policy

PRIVACY POLICY

BioHarmony Group (Pty) Ltd

Effective date: 25 June 2026 | Website: www.bioharmony-group.co.za

BioHarmony Group (Pty) Ltd (“BioHarmony”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit www.bioharmony-group.co.za (the “Site”), make a purchase, or otherwise interact with us, in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

If you are accessing the Site from outside South Africa, certain references to international data transfers and rights under the EU General Data Protection Regulation (“GDPR”) may also apply to you, as set out below.

Please read this Policy carefully. By using the Site, you consent to the practices described here.

1. Who We Are

BioHarmony Group (Pty) Ltd is a South African company, registration number 2024/210778/07, with its registered address at:

Unit 176, Block 18, Amsterdam Drive, Amsterdam Complex, Olivedale, Gauteng, 2158, South Africa.

We are the “responsible party” (as defined under POPIA) for the personal information described in this Policy.

BioHarmony is a distributor of health, wellness, and biohacking products (including supplements and related goods). We do not provide medical advice, diagnosis, or treatment, and the Site does not collect health, medical, or biometric information about you as part of normal browsing, account creation, or checkout.

2. Information We Collect

We collect the following categories of personal information:

2.1 Information you give us directly

Account and order information: name, surname, email address, phone number, delivery address, and billing address, collected when you create an account, place an order, or contact us.
Payment information: we do not store your card details. Payments are processed securely by Paystack, our third-party payment processor. Paystack collects and processes your payment card and billing information directly, subject to Paystack’s own privacy policy.
Communications: any information you provide when you email us, message us on social media, or submit a contact/enquiry form, including the content of your message.
Marketing opt-ins: your name and email address (and, where provided, phone number) when you subscribe to our newsletter, opt in to marketing communications, or otherwise consent to receive updates from us.

2.2 Information collected automatically

Usage data: pages visited, time spent on the Site, referring URLs, browser type, device type, and approximate location (derived from IP address), collected via Google Analytics.
Advertising data: interactions with our adverts and Site, collected via the Meta Pixel (Facebook/Instagram), used to measure ad performance and build advertising audiences. See Section 6 (Cookies and Tracking Technologies) for more detail.
Cookies: small data files stored on your device, as described in Section 6.

2.3 Information from third parties

Courier and delivery partners: we share your name, delivery address, and phone number with our delivery partner, primarily The Courier Guy (though this may vary depending on your location and order), strictly to fulfil your order.
Platform and service providers: our website host, WooCommerce (our e-commerce platform), and email service providers Resend and Kit (formerly ConvertKit), which process personal information on our behalf to operate the Site and send transactional and marketing emails.

What we don’t collect: BioHarmony is a distributor, not a healthcare provider. Our checkout, account, and contact forms do not ask about your health conditions, symptoms, or medical history, and we do not knowingly collect this information through the Site. If you choose to voluntarily disclose health-related information to us — for example, in a customer email or product review — we will treat it as confidential and will only use it to respond to you or, with your separate consent, as a testimonial.

3. How We Use Your Information

We use your personal information for the following purposes:

To process, fulfil, and deliver your orders, including sharing necessary details with our courier and payment partners.
To create and manage your account.
To communicate with you about your orders, account, or enquiries.
To send marketing communications, newsletters, and promotional offers, where you have opted in or where otherwise permitted by law. You may unsubscribe at any time (see Section 8).
To run and measure the performance of our advertising campaigns on Meta (Facebook/Instagram).
To analyse Site usage and improve our products, content, and user experience.
To detect, prevent, and address fraud, security, or technical issues.
To comply with our legal and regulatory obligations, including tax and consumer protection laws.

4. Legal Basis for Processing

Under POPIA, we process your personal information on one or more of the following grounds:

Consent: for marketing communications and non-essential cookies/tracking.
Performance of a contract: to process and deliver your order and provide the products you have purchased.
Legitimate interest: to operate, secure, and improve the Site, and to run advertising campaigns, balanced against your privacy rights.
Legal obligation: to comply with tax, consumer protection, and other applicable laws.

5. Sharing Your Information

We do not sell your personal information. We share information only with the following categories of third parties, and only as necessary for the purposes described in this Policy:

Payment processing: Paystack, to process your payment securely.
Delivery: The Courier Guy and, where applicable, other courier partners, to deliver your order.
E-commerce and hosting: our WooCommerce/WordPress hosting and platform providers, who store and process Site and order data on our behalf.
Email and marketing: Resend and Kit, to send transactional and marketing emails.
Analytics and advertising: Google (Google Analytics) and Meta (Meta Pixel), to measure Site performance and advertising effectiveness.
Legal and regulatory authorities: where required by law, court order, or to protect our legal rights.
Business transfers: in connection with a merger, acquisition, or sale of all or part of our business, subject to equivalent confidentiality protections.

Some of these providers (such as Google and Meta) may process information outside South Africa. Where this occurs, we take reasonable steps to ensure your information is protected by contractual or other safeguards consistent with POPIA’s requirements for cross-border transfers.

6. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to operate effectively and to support analytics and advertising:

Essential cookies: required for the Site (including checkout) to function, such as shopping cart and session cookies.
Analytics cookies (Google Analytics): help us understand how visitors use the Site, including pages viewed and time spent, so we can improve it.
Advertising cookies (Meta Pixel): track actions taken on the Site (such as page views, add-to-cart, and purchases) so we can measure ad performance, build custom audiences, and show you more relevant adverts on Facebook and Instagram.

You can control or disable cookies through your browser settings. Disabling cookies may affect the functionality of the Site, including checkout. Where required by law, we will request your consent before placing non-essential cookies on your device.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including:

Order and account information: for the duration of your relationship with us and thereafter as required by tax and consumer protection laws (generally up to 5 years).
Marketing information: until you unsubscribe or withdraw consent.
Analytics and advertising data: in accordance with the retention periods set by Google Analytics and Meta respectively.

When information is no longer needed, we will securely delete or anonymise it.

8. Your Rights

Subject to POPIA, you have the right to:

Be notified that we hold personal information about you.
Request access to the personal information we hold about you.
Request correction or updating of inaccurate, incomplete, or outdated information.
Request deletion or destruction of personal information that we are no longer authorised to hold.
Object to the processing of your personal information, including for direct marketing purposes.
Withdraw consent at any time, where processing is based on consent (this will not affect processing carried out before withdrawal).
Lodge a complaint with the Information Regulator (South Africa) if you believe your rights under POPIA have been infringed.

To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before actioning your request.

If you wish to unsubscribe from marketing emails, you can use the unsubscribe link included in every marketing email, or contact us directly.

9. Data Security

We implement reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, alteration, or disclosure, including secure payment processing through Paystack (which does not expose your card details to us) and access controls on our systems. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children’s Privacy

Our Site and products are intended for adults. We do not knowingly collect personal information from children without the consent of a parent or guardian, as required under POPIA. If you believe we have inadvertently collected information from a child, please contact us so we can remove it.

11. International Visitors (GDPR Notice)

If you are located in the European Union or United Kingdom, you may have additional rights under the GDPR, including the right to data portability and the right to lodge a complaint with your local data protection authority. The legal bases for processing described in Section 4 apply equally under the GDPR’s equivalent grounds (consent, contract, legitimate interest, and legal obligation).

12. Contact Us

If you have questions about this Privacy Policy, or wish to exercise any of your rights, please contact us:

Company: BioHarmony Group (Pty) Ltd (Reg. No. 2024/210778/07)
Email: [email protected]
Phone: 068 622 0615
Address: Unit 176, Block 18, Amsterdam Drive, Amsterdam Complex, Olivedale, Gauteng, 2158, South Africa

You may also lodge a complaint with South Africa’s Information Regulator:

Website: inforegulator.org.za
Email: [email protected]

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The “Effective date” at the top of this Policy indicates when it was last revised. We encourage you to review this Policy periodically. Continued use of the Site after changes take effect constitutes acceptance of the revised Policy.