Privacy Policy
This policy explains what personal information Lowerland collects when you use this website or buy from us, why we are allowed to hold it, who else processes it on our behalf, how long we keep it, and what you can require us to do with it. It is written to the Protection of Personal Information Act, 4 of 2013 (“POPIA”). We sell only within South Africa, so POPIA is the law that governs how we treat your information.
1. Who is responsible for your information
The responsible party is Lowerland (Pty) Ltd, Lowerland Farm, R386, Prieska, Northern Cape, South Africa.
Information Officer: Alette de Beer
Email: alette@lowerland.co.za
Post: Posbus 292, Prieska, 8940
2. The information we collect
Information you give us
- Order information — your name, email address, telephone number, delivery address, billing address, and the contents and value of your order.
- Account information — if you create an account: your username, password (stored encrypted, never in readable form), saved addresses and order history.
- Age verification information — if you buy wine: your date of birth, the outcome of the check, and a record that you confirmed your age at checkout. See section 4.
- Payment information — handled by our payment provider, not by us. We receive confirmation that a payment succeeded and the last portion of the card number or reference. We never see or store your full card details.
- Correspondence — messages you send us by email, telephone or through a form on the site, and our replies.
- Back-in-stock requests — the email address you give us so that we can tell you when a product returns.
- Reviews — anything you choose to publish on a product page, and the name it appears under.
Information collected automatically
- Technical information — your IP address, browser and device type, and the pages you view. Our security software records IP addresses of failed login attempts and suspicious requests.
- Cookies — small files that keep your basket working and, if you allow them, measure how the site is used. Listed in full in our Cookie Policy.
We do not ask for, and do not want, information about your health, race, religion, political views, or trade union membership.
3. Why we process it, and on what lawful basis
Section 11 of POPIA requires a lawful basis for every purpose. Ours are:
| Purpose | Information used | Lawful basis (s.11) |
|---|---|---|
| Taking, packing and delivering your order; handling cancellations, claims and refunds | Order, account, contact and address information | Necessary to perform our contract with you — s.11(1)(b) |
| Taking payment and preventing payment fraud | Order and payment confirmation information | Contract — s.11(1)(b); and our legitimate interest — s.11(1)(f) |
| Verifying that you are 18 or older before selling wine | Date of birth, verification record, hashed IP address | Compliance with a legal obligation — s.11(1)(c) |
| Issuing tax invoices and keeping accounting records | Order, contact and billing information | Compliance with a legal obligation — s.11(1)(c) |
| Answering your questions and handling complaints | Correspondence and order information | Contract — s.11(1)(b); legitimate interest — s.11(1)(f) |
| Keeping the website and your account secure | IP address, login and security event logs | Legitimate interest — s.11(1)(f) |
| Measuring how the site is used so we can improve it | Cookie and usage information | Legitimate interest — s.11(1)(f), with an opt-out |
| Telling you a product is back in stock | The email address you gave for that purpose | Your consent — s.11(1)(a), which you may withdraw at any time |
Where we rely on legitimate interest, you may object. Where we rely on your consent, you may withdraw it. Section 12 below explains how.
4. Age verification information
Because we sell wine, the law requires us to establish that a buyer is 18 or older, and to be able to demonstrate that we did so. When you verify your age we record your date of birth, the age derived from it, whether the check passed or failed, the method used, and the date and time. Your IP address is stored in hashed form, meaning it is converted into a value that cannot be read back as an address.
Your verification is also stored in a signed cookie on your device, and against your account if you are logged in, so that you are not asked repeatedly. You can clear it yourself from your account, and you can ask us to delete the record — though where we are obliged to retain proof of a verified alcohol sale, we will tell you so and keep only what the obligation requires. See our Alcohol Policy.
5. Who else processes your information
Section 21 of POPIA calls these operators. They process your information on our instruction, for the purposes below and no others. We do not sell, rent or trade your personal information to anyone.
- Payfast — processes your payment. Your card details go to Payfast directly and never reach us.
- Our courier partners — receive your name, delivery address, telephone number and parcel details so that they can deliver your order and, where it contains wine, verify the age of the person receiving it.
- Xero — our accounting system. Order and invoice information, including your name and billing details, is synchronised to it so that we can issue tax invoices and keep the accounting records the law requires.
- Google — provides our website measurement and our product listings. Measurement information is used to understand how the site is used. We have disabled advertising personalisation and we do not use Google’s remarketing features.
- WPMU DEV — hosts this website and provides its security, performance and backup services. Everything stored on the site is stored on their infrastructure.
- Automattic / WooCommerce — provides the shop software and some of its extensions, including the age verification and invoicing tools.
- Our technical service provider — maintains and develops this website for us under a services agreement, and has administrative access to the site, including to order records, in the course of doing so.
We may also disclose your information where the law requires it — for example to SARS, to a regulator, or under a court order — and where it is necessary to establish or defend a legal claim.
6. Where your information is stored
This website and its database are hosted in South Africa. Your order records, your account and your age verification records are stored here, in the country.
Two of our operators process information outside South Africa. Section 72 of POPIA permits this where the recipient is bound by rules or a contract providing an adequate level of protection, or where the transfer is necessary to perform our contract with you.
- Xero — accounting records are synchronised to Xero’s infrastructure outside South Africa, under Xero’s data protection commitments.
- Google — website measurement and product listing information is processed on Google’s infrastructure outside South Africa, under Google’s data protection commitments.
- Payfast processes payments in South Africa.
7. How long we keep it
| What | How long | Why |
|---|---|---|
| Order records, invoices and accounting entries | 5 years from the end of the tax year to which they relate | Required by the Tax Administration Act, 28 of 2011 |
| Age verification records for wine orders | For as long as we are required to be able to demonstrate a lawful alcohol sale | Liquor licence and National Liquor Act obligations |
| Your account | Until you ask us to close it, then deleted except for records we must retain above | Your choice |
| Correspondence | 3 years from the last exchange | Handling later queries and claims |
| Security and access logs | Up to 12 months | Detecting and investigating misuse |
| Back-in-stock requests | Until the notification is sent or you unsubscribe | The purpose ends |
| Website measurement information | Up to 14 months in aggregate form | Year-on-year comparison |
When a retention period ends we delete the information or remove anything that identifies you.
8. How we protect it
Section 19 of POPIA requires us to secure the integrity and confidentiality of your information. We use an encrypted connection across the whole site, keep the software up to date, run security software that blocks and logs suspicious activity, restrict administrative access to the people who need it, and store backups securely. Passwords are stored in encrypted form and card details never reach our systems.
No system is perfectly secure. If your personal information is accessed by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and you, and we will do so as soon as reasonably possible after establishing what has happened.
9. Marketing — what we do and do not do
We send you email about your order: confirmation, payment, dispatch and delivery. That is part of performing the contract, not marketing.
We do not run email or SMS marketing campaigns, and we do not conduct behavioural remarketing or retargeting. We do not build advertising profiles of visitors, we do not follow you across the internet with adverts, and we do not sell or share your information for anyone else’s marketing. Section 69 of POPIA restricts unsolicited electronic marketing; because we send none, the question does not arise. If we ever introduce a newsletter, it will be by a positive opt-in that is not ticked for you, and we will update this policy before it starts.
10. Cookies
Which cookies this site sets, what each is for, and how to switch the optional ones off, is set out in our Cookie Policy. Cookies that are necessary to run the basket, the checkout and your login cannot be switched off without breaking the shop.
11. Children
This shop is not intended for children, and orders may only be placed by a person aged 18 or older. We do not knowingly collect the personal information of a child. Section 34 of POPIA prohibits processing the information of a child without the consent of a competent person. If you believe a child has given us information, contact our Information Officer and we will delete it.
12. Your rights and how to use them
Under sections 23 to 25 of POPIA you may ask us to:
- Confirm whether we hold personal information about you, and give you a copy of it.
- Correct information that is inaccurate, misleading or out of date.
- Delete information we are no longer entitled to keep.
- Object, on reasonable grounds, to processing we base on legitimate interest — including website measurement.
- Withdraw consent you previously gave, such as for a back-in-stock notification.
Send your request to our Information Officer at alette@lowerland.co.za, or use our data request page. Include the email address or order number you used so that we can find your records. We do not charge for this, and we will respond within a reasonable period. We may ask you to confirm who you are before we release information, so that we do not hand your records to someone else.
Where we must refuse part of a request — usually because a tax or liquor record has to be retained — we will tell you which part, and why.
13. Complaints
Please raise any concern with our Information Officer first. If you are not satisfied, you may complain to the Information Regulator (South Africa), which supervises compliance with POPIA. Its current contact details and complaint forms are published on its website at inforegulator.org.za.
14. Changes to this policy
We update this policy when what we do changes. The version published on this page is the current one. Where a change materially affects how we use your information, we will say so on the site before it takes effect.