Privacy Policy

ViralCart ZA (operating as "ViralCart (Pty) Ltd") is a South African online retail business registered in Johannesburg. We are the responsible party under POPIA for the personal information we collect through our website at https://theviralcart.shop.

Our Information Officer (required by Section 17 of POPIA) can be contacted at support@theviralcart.shop for any privacy-related queries, access requests, or complaints.

We collect the following categories of personal information:

Information you provide directly:

• Contact details: Full name, email address, phone number
• Delivery address: Street address, city, province, postal code
• Order details: Products ordered, quantities, payment method
• Discount/referral codes: Codes used at checkout
• Newsletter signups: Email address for marketing communications
• Reviews: Name, rating, and review content you submit

Information collected automatically:

• Technical data: IP address, browser type, device type, operating system
• Usage data: Pages visited, products viewed, time on site, referring URL
• Cookies: See Section 6 below for details

Information from payment processing:

• Transaction reference from PayFast (we do NOT see or store your card details)
• Payment status (paid, failed, refunded)

We process your personal information for the following purposes:

• To fulfil your orders: Process payments, dispatch Products, arrange delivery
• To communicate with you: Order confirmations, dispatch notifications, delivery updates via SMS/WhatsApp/email
• To provide customer support: Respond to queries, process returns, resolve disputes
• For marketing (with consent): Newsletter emails, SMS/WhatsApp broadcasts about new product drops and promotions
• To run our referral program: Track referral code usage, credit rewards to referrers
• To prevent fraud: Verify identity, detect suspicious orders, block abusive users
• To improve our business: Analyze sales trends, optimize product selection, improve the website
• For legal compliance: Maintain records for SARS (VAT), respond to law enforcement requests if legally required

We will never sell your personal information to third parties. We will never use your data for purposes other than those listed above without obtaining your explicit consent first.

Under POPIA, we may only process your personal information if we have a lawful basis. Our lawful bases for processing your personal information are:

• Consent — when you provide information voluntarily at checkout, sign up for our newsletter, or submit a review
• Contract — to fulfil our obligations to you when you place an order (Section 18 of ECT Act)
• Legal obligation — to comply with SARS, FIC Act, and Consumer Protection Act requirements
• Legitimate interests — to prevent fraud, improve our services, and operate our business legally

You may withdraw your consent for marketing communications at any time by clicking "unsubscribe" in any email or replying "STOP" to any SMS.

We share your personal information only with the third parties necessary to operate our business and fulfil your orders:

Service providers (we share data with these to operate the store):

• PayFast (Pty) Ltd — payment gateway. We share your order ID, name, email, phone, and total amount. PayFast processes your card/EFT payment and does NOT share your card details with us.
• Our suppliers — Product name, quantity, and your delivery address (so they can ship directly to you). Suppliers are based in Johannesburg, Cape Town, Durban, Pretoria, and Gqeberha.
• The Courier Guy / Aramex / PostNet — Your name, phone, and delivery address so the courier can deliver your parcel
• Clickatell (SMS) — Your phone number + the dispatch notification message (sent from a ViralCart ZA sender ID)
• WhatsApp Cloud API (Meta) — Your phone number + the dispatch notification message (sent from our WhatsApp Business number)
• Hosting provider (Vercel) — Server logs, IP addresses, technical data

Legal disclosures:

• We may disclose information if required by law, court order, or competent authority (e.g. SAPS, SARS, FIC)
• In the event of a merger, acquisition, or sale of our business, customer data may be transferred to the new owner

Important: All third-party service providers listed above are bound by their own POPIA compliance obligations and contractual confidentiality. They may only use your data for the specific purpose we shared it for.

We use cookies and similar technologies on our Site for the following purposes:

• Essential cookies: Shopping cart contents, checkout progress, session state. Without these, the store does not function.
• Preference cookies: Remember your product filters, dark/light mode, etc.
• Analytics cookies (if enabled): Anonymous usage statistics (page views, click patterns) to improve the site

We do not use advertising cookies, retargeting pixels (Facebook Pixel, Google Ads), or third-party tracking for advertising purposes. We do not profile you for targeted ads.

You can disable cookies in your browser settings. Note that disabling essential cookies will prevent you from adding items to your cart or checking out.

We take reasonable technical and organizational measures to protect your personal information against unauthorized access, loss, or damage:

• HTTPS encryption — All data transmitted between your browser and our site is encrypted with TLS 1.3
• Secure payment processing — Card data is handled by PayFast (PCI-DSS compliant). We never see or store your card details.
• Database access controls — Production database is access-controlled and password-protected
• API authentication — All admin/API routes require authentication
• Bank account masking — Bank account numbers are masked when displayed in the Owner Dashboard (only last 4 digits visible)
• PayFast passphrase — ITN webhook signatures are verified to prevent tampering

However, no system is 100% secure. In the event of a data breach affecting your personal information, we will notify you and the Information Regulator (as required by Section 22 of POPIA) within a reasonable timeframe.

We retain your personal information only as long as necessary for the purposes set out in this policy:

• Order records: 5 years (as required by SARS for VAT purposes)
• Customer account data: Until you request deletion or 2 years after your last order
• Marketing subscribers: Until you unsubscribe or 2 years of no engagement
• Reviews: Indefinitely (or until you request removal)
• Server logs: 90 days for security/abuse analysis
• Cookies: As per the cookie table above

After the retention period expires, we will either delete your personal information or anonymize it so it can no longer be linked to you.

As a data subject under POPIA, you have the following rights:

• Right of access — Request a copy of all personal information we hold about you
• Right to correction — Request that we correct inaccurate personal information
• Right to deletion — Request that we delete your personal information (subject to legal retention requirements)
• Right to object — Object to processing for marketing or legitimate interest purposes
• Right to withdraw consent — Withdraw consent for marketing at any time
• Right to complain — Lodge a complaint with the Information Regulator

To exercise any of these rights, email us at support@theviralcart.shop with "POPIA Request" in the subject line. We will respond within 30 days as required by POPIA.

Our Site is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a minor, please contact us immediately at support@theviralcart.shop and we will delete it.

Parents may purchase Products for their children, but the order must be placed by an adult who can legally enter into a contract under South African law.

Your personal information is primarily stored and processed in South Africa. However, some of our service providers may process data internationally:

• WhatsApp Cloud API (Meta) — processes data in the USA and Ireland (Meta's global infrastructure)
• Vercel — hosting infrastructure is global (your data may be processed in USA, EU, or Singapore)

Where data is transferred outside South Africa, we ensure the recipient provides an adequate level of protection as required by Section 72 of POPIA (either through the recipient's own privacy laws, contractual safeguards, or binding corporate rules).

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. The "Last updated" date at the top of this page indicates when the policy was last revised.

For material changes (e.g. new purposes for processing, new third-party sharing), we will notify you by email or SMS at least 30 days before the changes take effect, giving you the opportunity to object.

For any privacy-related queries, POPIA access requests, or complaints, please contact our Information Officer:

We will respond to all POPIA requests within 30 days as required by Section 23 of POPIA.

If you are not satisfied with our response, you have the right to complain to the Information Regulator of South Africa: