Privacy Policy

This Privacy Policy explains how Element Labs (Pty) Ltd (registration number 2026/419578/07), trading as AuraNova (“AuraNova”, “we”, “us”, “our”), collects, uses, shares, and protects your personal information when you visit our website, reserve a pre-order, place an order, subscribe to our communications, or otherwise interact with us (together, the “Services”).

We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (“POPIA”) of South Africa.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood how we collect, use, and disclose your information as described here.

1. Personal Information We Collect

When we use the term “personal information”, we mean information that identifies you or can reasonably be linked to you. It does not include information that has been anonymised or de-identified so that it can no longer be linked to you.

Depending on how you interact with the Services, we may collect and process:

• Contact details — your name, billing address, delivery address, phone number, and email address.
• Pre-order reservations — your WhatsApp number, your email address (only if you choose to give it), the pack you reserved and its price, the date of your reservation, and the advert or link that brought you to our page (for example, campaign tags and the Facebook click identifier added to the link).
• Order and transaction information — the products you view, add to your cart or wishlist, purchase, return, exchange, or cancel; order history; subscription details; and delivery status.
• Payment information — the form of payment, transaction reference, payment confirmation, and the last four digits of your card. We do not store full card numbers or CVV codes on our systems. Card payments are processed directly by our payment provider, Paystack, on their secure infrastructure.
• Account information — your username, password (stored in encrypted form), preferences, and settings.
• Communications with us — the content of messages you send us by email, phone, WhatsApp, live chat, or contact form, including recordings or notes of customer service calls where permitted by law.
• Marketing preferences — your subscription status and how you interact with our emails and WhatsApp messages.
• Device and technical information — your IP address, browser type, device type, operating system, and other unique identifiers.
• Usage information — how and when you navigate and interact with our website, including pages viewed and links clicked.

Health-related information

Our products are health supplements. If you voluntarily share information about your health, diet, or wellness goals with us (for example, in a product quiz, a review, or a customer service enquiry), we treat this as special personal information under POPIA. We only process it with your consent, only for the purpose for which you provided it, and we do not use it for advertising.

Children

The Services are not intended for children. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

2. Where We Get Your Personal Information

• Directly from you — when you reserve a pre-order, place an order, subscribe, complete a form, or contact us.
• Automatically from your device — through cookies and similar technologies when you use our website (see section 6).
• From our service providers — for example, our payment provider confirms that a payment succeeded, and our courier confirms that a delivery was completed.
• From advertising partners — where you have consented to this.

3. How We Use Your Personal Information

We process your personal information for the following purposes and on the following legal grounds under POPIA:

We do not sell your personal information.

4. How We Share Your Personal Information

We share your personal information only where necessary, and only with parties who are bound to protect it. These include:

• Payment providers — Paystack, to process payments and refunds securely once orders open. Paystack receives the details needed to take your payment, such as your name, email address, phone number, and the amount due.
• Courier and logistics providers — to deliver your order. They receive your name, delivery address, phone number, and order details. We book deliveries through Bob Go, which passes these details to the courier company that carries your parcel.
• Hosting and cloud infrastructure providers — Vercel, which hosts our website, and Google (Google Workspace), where we store pre-order reservations in Google Sheets.
• Messaging services — WhatsApp (part of Meta Platforms), which carries our messages to you about your reservation and order, including your payment link.
• Email marketing platforms — to send you communications you have subscribed to. [e.g. Klaviyo]
• Advertising partners — Meta Platforms (Facebook and Instagram). We use the Meta pixel on our pages to measure how our adverts perform and to show relevant adverts on Facebook and Instagram. Through the pixel, Meta receives information such as the pages you visit on our site, your browser and device details, your IP address, and — when you reserve — a record that a reservation was made and the value of the pack you chose.
• Professional advisers — our accountants, auditors, and lawyers, where necessary.
• Authorities and regulators — where we are legally required to disclose information, or to protect our rights, our customers, or the public.
• A buyer or successor — in connection with a merger, acquisition, restructuring, or sale of our business.

Each of our operators (processors) is required, by written agreement, to process your personal information only on our instructions and to maintain appropriate security safeguards, as required by section 21 of POPIA.

5. International Transfers

Some of our service providers (for example, Meta, Google, and Vercel) are located outside South Africa. Where we transfer your personal information across borders, we do so in accordance with section 72 of POPIA — meaning that the recipient is subject to a law, binding corporate rules, or a binding agreement that provides a level of protection substantially similar to POPIA, or you have consented to the transfer, or the transfer is necessary to perform our contract with you.

6. Cookies and Similar Technologies

We use cookies and similar technologies to operate our website, remember your cart and preferences, understand how the site is used, and — where you consent — to measure and target advertising.

• Strictly necessary cookies keep the site working (for example, keeping you logged in and keeping items in your cart). These cannot be switched off.
• Advertising and measurement cookies — the Meta pixel sets cookies that let Meta measure how our Facebook and Instagram adverts perform and show you relevant advertising. We do not use Google Analytics.

You can accept or decline non-essential cookies through our cookie banner, and you can change your choice at any time via [COOKIE SETTINGS LINK]. You can also block or delete cookies through your browser settings, though some parts of the site may then not work properly.

7. Security and Retention

We apply appropriate technical and organisational measures to protect your personal information, including encryption in transit (HTTPS), encrypted password storage, access controls, and regular backups. However, no system is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive or confidential information through unsecured channels.

We keep your personal information only for as long as we need it:

• Order data — for the period required by South African tax and company law (currently five years from the end of the relevant financial year).
• Marketing data — until you unsubscribe or withdraw your consent, after which we retain a minimal record of your opt-out so that we do not contact you again.
• Customer service records — [RETENTION PERIOD, e.g. 3 years] after the enquiry is closed.

If we suffer a security compromise affecting your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

8. Your Rights

Under POPIA you have the right to:

• Access — request confirmation of whether we hold personal information about you, and request a copy of it.
• Correction — request that we correct or update inaccurate, misleading, or outdated information.
• Deletion — request that we delete personal information we are no longer entitled to keep.
• Object — object, on reasonable grounds, to our processing of your personal information.
• Withdraw consent — withdraw consent at any time where our processing is based on consent, including for marketing. This does not affect processing carried out before you withdrew consent.
• Opt out of direct marketing — unsubscribe from any marketing email using the link in the message, reply STOP to any of our WhatsApp messages or ask us to stop messaging you, or contact us directly. We may still send you transactional messages about your orders and account.
• Complain — lodge a complaint with the Information Regulator (see below).

To exercise any of these rights, contact us using the details in section 10. We may need to verify your identity before acting on your request. Certain requests may be submitted on the Regulator’s prescribed forms, and we will respond within the periods required by law.

We will never discriminate against you for exercising your rights.

9. Third-Party Websites

Our website may contain links to sites we do not operate. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing them with your personal information.

10. Contact Us and Information Officer

If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to make a complaint, please contact:

Element Labs (Pty) Ltd t/a AuraNova
57 Heerengracht Street, Cape Town, 8001, South Africa
Email: support@aura-nova.co.za
Phone: +27 83 607 6103

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):

The Information Regulator (South Africa)
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za
Online complaints portal: eservices.inforegulator.org.za

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. We will post the updated policy on this page and change the “Last updated” date above. Where the changes are significant, we will notify you directly.