Privacy Policy

Personal Information We Collect or Process

"Personal information" means information that identifies you or can reasonably be linked to you. Depending on how you interact with us, we may collect or process the following categories of personal information:

• Contact details such as your name, email address, telephone number, billing address, and delivery address.
• Order and transaction information such as products ordered, order value, delivery details, payment status, returns, refunds, and your purchase history.
• Payment-related information required to complete a transaction. Payment card or banking details may be collected and processed directly by our payment service providers depending on the payment method used.
• Account information, preferences, and settings where account functionality is available.
• Communications you send to us, including customer service enquiries, feedback, complaints, and other correspondence.
• Technical information such as your IP address, browser type, device information, operating system, and information about how you interact with our website.
• Marketing preferences and information relating to your consent or objection to receiving promotional communications.

How We Collect Personal Information

We may collect personal information:

• Directly from you when you place an order, complete a form, contact us, subscribe to communications, or otherwise provide information to us.
• Automatically when you use our website, including through cookies and similar technologies.
• From service providers that help us operate our website, process payments, fulfil orders, provide courier services, communicate with customers, analyse website performance, or prevent fraud.
• From other lawful sources where permitted by applicable law.

How We Use Your Personal Information

We may process personal information for purposes including:

• Processing and fulfilling orders. To process purchases and payments, confirm orders, arrange delivery, manage returns or refunds, and communicate with you about your order.
• Operating and improving our website. To provide website functionality, remember relevant preferences, monitor performance, diagnose problems, and improve the customer experience.
• Customer service. To respond to enquiries, requests, complaints, and other communications.
• Security and fraud prevention. To protect our website, customers, systems, transactions, and business from fraud, misuse, unauthorised activity, and other security risks.
• Marketing. Where permitted by law, to send information about Hylora Skin products, launches, promotions, and related content. You may object to or unsubscribe from direct marketing at any time.
• Business administration. To maintain appropriate financial, transactional, operational, and customer records.
• Legal and regulatory compliance. To comply with applicable laws, lawful requests, regulatory obligations, dispute processes, and the enforcement or defence of our legal rights.

Cookies and Similar Technologies

Our website may use cookies and similar technologies that are necessary for website functionality, security, analytics, performance, remembering preferences, and, where applicable, marketing. You can control cookies through your browser settings and any cookie controls made available on the website. Disabling certain cookies may affect website functionality.

How We Share Personal Information

We do not sell your personal information. We may share personal information where reasonably necessary for legitimate business purposes or where required or permitted by law, including with:

• Website hosting, infrastructure, cloud, and technology service providers.
• Payment gateways, banks, and payment processing providers involved in completing your transaction.
• Courier and fulfilment service providers that require delivery information to deliver your order.
• Professional advisers and service providers such as accountants, auditors, legal advisers, support providers, and fraud-prevention or security providers where appropriate.
• Marketing and analytics providers where their services are used and the processing is permitted by law.
• Regulators, courts, law-enforcement authorities, or other parties where disclosure is required or permitted by applicable law.
• A purchaser, successor, or relevant adviser in connection with a proposed or completed sale, restructuring, merger, or transfer of all or part of our business, subject to appropriate confidentiality and legal requirements.

Service providers that process personal information on our behalf are expected to process it only for the relevant service and to apply appropriate safeguards.

Third-Party Websites and Services

Our website may contain links to websites, payment services, social media platforms, or other services operated by third parties. Those third parties operate under their own privacy policies and terms. Hylora Skin is not responsible for the privacy, security, or content of third-party services that we do not control.

Children's Personal Information

Our website and products are not directed at children and we do not knowingly collect personal information from children without an appropriate lawful basis or the required consent. If you believe a child has provided personal information to us inappropriately, please contact us so that we can assess and address the matter.

Security of Your Personal Information

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration, destruction, or disclosure. No website, transmission method, or storage system can be guaranteed to be completely secure.

If a security compromise involving personal information occurs, we will take appropriate steps and provide notifications to the Information Regulator and affected persons where required by applicable law.

Retention of Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to maintain appropriate business and transaction records, to comply with legal or regulatory obligations, to resolve disputes, or to establish, exercise, or defend legal rights. Information that is no longer required will be deleted, destroyed, or de-identified where appropriate and subject to applicable law.

Direct Marketing

We may send marketing communications where we have an appropriate lawful basis to do so. Where consent is required, we will request it in accordance with applicable law. You may unsubscribe using the link or instructions included in a marketing communication or contact us directly to object to further direct marketing. Transactional and service communications relating to an order or customer relationship are not treated as marketing communications.

Your Rights Under POPIA

Subject to POPIA and any applicable limitations, you may have the right to:

• Access. Ask whether we hold personal information about you and request access to that information.
• Correction. Ask us to correct or update personal information that is inaccurate, incomplete, misleading, or out of date.
• Deletion or destruction. Request deletion or destruction of personal information where the legal requirements for doing so are met.
• Object to processing. Object, on reasonable grounds and where permitted by law, to certain processing of your personal information.
• Object to direct marketing. Ask us to stop using your personal information for direct marketing.
• Complain. Lodge a complaint with the Information Regulator if you believe your personal information has been processed unlawfully.

We may need to verify your identity before acting on a request. Certain rights may be limited where we are required or permitted by law to retain or continue processing information.

International Transfers

Some of the technology or service providers we use may process or store personal information outside South Africa. Where personal information is transferred outside South Africa, we will take reasonable steps to ensure the transfer is permitted under POPIA and that an appropriate level of protection applies, including where the recipient is subject to suitable legal, contractual, or other safeguards, where you have consented to the transfer, or where another lawful basis for the transfer applies.

Complaints

If you have a concern about how we process your personal information, please contact us first so that we can investigate and respond. You also have the right to lodge a complaint with the Information Regulator of South Africa. More information is available at inforegulator.org.za.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, business practices, legal requirements, or regulatory guidance. The updated version will be published on this website and the "Last updated" date will be amended accordingly.

Contact

If you have questions about this Privacy Policy, our privacy practices, or wish to exercise a privacy right, please email us at sales@hylora.skin or contact us at 8 Hantamberg, Blue Mountain Boulevard, George, WC, 6529, South Africa.