1. Who we are
Health Brands SA (Pty) Ltd (“we”, “us”) is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for personal information collected through https://molecules.co.za.
- Supplier (legal entity): Health Brands SA (Pty) Ltd
- Brand: Molecules (a brand of Health Brands SA (Pty) Ltd)
- Registration number: 2017/056995/07
- VAT number: 4720291865
- Director: Tshepo Mokitimi
- Physical address and address for service of legal documents: 293 Summit Road, Knoppieslaagte, Centurion, 0157, Gauteng
- Email: info@healthbrands.co.za · Telephone/WhatsApp: +27 66 248 6595
- Website: https://molecules.co.za
Information Officer: Tshepo Mokitimi, 293 Summit Road, Knoppieslaagte, Centurion, 0157, Gauteng. Email info@healthbrands.co.za (subject “POPIA”). Telephone +27 66 248 6595.
2. What we collect
- Orders: name, email, mobile number, company name and VAT number (optional), delivery address and order notes.
- Business accounts: company name, registration and VAT numbers, contact person, phone, billing address and a password (stored only as a one-way hash).
- Quotes and enquiries: name, company, contact details, requirements and any logo or artwork files you upload.
- Payments: card and bank details are entered on Paystack's secure pages and are never seen or stored by us. Paystack tells us whether a payment succeeded and gives us a transaction reference. For manual EFT we record the amount and date the payment reflects.
- Technical: your cart and quote list are stored in your own browser (local storage). A sign-in cookie is set only if you log in to a business account. We do not use advertising or tracking cookies.
3. Why we use it (purpose and lawful basis)
- To process, deliver and support your order, issue tax invoices and handle returns: necessary to perform our contract with you (POPIA s11(1)(b)).
- To prepare quotes and answer enquiries you send us: at your request (s11(1)(b)) and with your consent (s11(1)(a)).
- To meet legal duties such as tax and accounting record keeping (s11(1)(c)).
- To prevent fraud and keep the site secure: our legitimate interest (s11(1)(f)).
- We do not send direct marketing without your prior opt-in consent (s69). Every marketing message includes a way to opt out.
4. Who we share it with (operators)
- Paystack (payment processing for card and instant EFT payments).
- Our supplier partners and couriers (including our group courier, Hazchem On The Go), only what is needed to fulfil and deliver your order.
- Hosting: our website, order database and artwork files are hosted on servers in South Africa.
- Email delivery: Twilio SendGrid, which processes email addresses and message content in the United States.
- Professional advisers and authorities where the law requires it (for example SARS).
Each operator is bound by a written agreement to process the information only on our instructions and to keep it secure (POPIA s20 and s21).
5. Transfers outside South Africa
Order confirmation emails are sent through SendGrid in the United States. We rely on POPIA s72(1)(b) and (c): the transfer is necessary to perform our contract with you, and SendGrid is bound by contractual terms that provide an adequate level of protection.
6. How long we keep it
Order and invoice records: five years after the transaction (Tax Administration Act and Companies Act). Quotes and enquiries that do not lead to an order: 12 months. Artwork files: 12 months after the last order that used them. Business accounts: until you close the account, then as for orders. After that we delete or de-identify the information.
7. Security
Encrypted connections (HTTPS), no card data held by us, a database that is not reachable from the public internet API, private file storage, access limited to staff who need it, and secrets held in a password vault.
8. Your rights
You may ask what personal information we hold about you, ask us to correct or delete it, object to processing, and withdraw consent at any time, by emailing info@healthbrands.co.za. We respond within 30 days. You may complain to the Information Regulator (South Africa): https://inforegulator.org.za, complaints.IR@inforegulator.org.za.
9. Children
This site is for businesses and adults. We do not knowingly collect information about children.
10. Changes
We will post any change to this notice here with a new effective date.