Privacy & POPIA Notice
ShopList SA is operated by sholistsa (“we”, “us” and “our”). Website: shoplistsa.co.za. Contact: support@shoplistsa.co.za.
1. What we collect
Depending on how you use ShopList SA, we process account details such as name and email address; household membership and invitations; shopping lists, list items, recipes, favourites and shopping history; product/barcode associations; subscription and payment-reference information; policy acceptance records; and technical/security information such as IP address, browser/user-agent information and application logs.
When you contact support, leave a review or suggest a feature, we store your name, email, message, any review rating, submission reference and time, plus a hash of your IP address to limit abuse. Authorised administrators can read these submissions, and we send a notification to our support mailbox. Reviews remain private and are not automatically published.
2. Why we process it
We process personal information to create and secure accounts, provide personal and household features, synchronise shared lists, send requested invitations and account emails, administer subscriptions, reconcile payments, provide support, prevent abuse, diagnose faults, maintain audit records and meet legal obligations.
3. Payment information
Card payments are handled by Payfast. ShopList SA does not store your full card number, CVV or card expiry date. We retain transaction references, payment status, amounts and related records needed for subscription administration, reconciliation and support.
4. Sharing
We share information only where needed to operate the service, for example with hosting/infrastructure providers, email delivery providers and Payfast for payments, or where disclosure is required by law. Information you place in a shared household is available to authorised members of that household.
5. Security
We use reasonable technical and organisational safeguards appropriate to the service, including password hashing, authenticated APIs and access controls. No internet service can guarantee absolute security, so users should use strong unique passwords and protect their devices.
6. Retention
We retain information for as long as needed to provide the service, maintain legitimate operational and security records, meet accounting/payment obligations and comply with law. Retention periods may differ by record type. Data no longer required should be deleted or de-identified where appropriate.
7. Your rights
Subject to POPIA and other applicable law, you may request access to personal information we hold about you, request correction or deletion where applicable, object to certain processing, withdraw consent where processing relies on consent, and raise a complaint. Identity verification may be required before acting on a request.
8. Children
ShopList SA is not intended to knowingly collect children's personal information without the authorisation or other lawful basis required by South African law. Household owners should not invite children or enter children's information unless they are legally entitled to do so.
9. International processing
Some technology providers may process or store information outside South Africa. Where cross-border processing occurs, ShopList SA will take reasonable steps required by applicable law to ensure appropriate protection.
10. Contact and complaints
Privacy queries can be sent to support@shoplistsa.co.za. You also have the right to approach South Africa's Information Regulator. The final production notice must include the remaining Information Officer details.
11. Changes
We may update this notice as the service changes. Material changes will be identified by a new version/effective date and, where required, users will be asked to acknowledge or accept the updated notice.