Privacy Policy

Rare Ritual Labs | Effective date: 1 June 2026 | Compliant with the Protection of Personal Information Act 4 of 2013 (POPIA)

1. Introduction

Rare Ritual Labs ("we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains what information we collect, why we collect it, how we use it, and what rights you have in relation to it.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and take our obligations as a Responsible Party seriously. Please read this policy carefully. By using our website or purchasing from us, you acknowledge that you have read and understood this policy.

2. Who We Are

2.1 Responsible Party

For the purposes of POPIA, the Responsible Party is:

Rare Ritual Labs

Email: shop@rareritual.co.za

Website: www.rareritual.co.za

2.2 Information Officer

Our Information Officer is responsible for ensuring that Rare Ritual Labs complies with POPIA. You may contact our Information Officer directly at shop@rareritual.co.za for any privacy-related queries or to exercise your rights as a data subject.

3. Personal Information We Collect

3.1 Information you provide directly

When you interact with us, you may provide the following categories of personal information:

1. Name and surname
2. Email address
3. Delivery address and billing address
4. Phone number
5. Payment information (processed securely through our payment provider; we do not store card details)
6. Account login credentials if you create an account
7. Communications you send us, including emails and contact form submissions
8. Skincare preferences or concerns you share when using our product recommendation tool

3.2 Information collected automatically

When you visit our website, we may automatically collect certain technical information:

1. IP address and approximate location
2. Browser type and version
3. Pages visited and time spent on each page
4. Referring website or search terms
5. Device type and operating system

This information is collected through cookies and similar tracking technologies. See Section 8 for more detail on how we use cookies.

3.3 Information from third parties

We may receive information about you from third parties such as our payment processor, courier service providers, or if you interact with our social media accounts. We only use this information in accordance with the purposes set out in this policy.

4. Why We Collect Your Information

We collect and process your personal information for the following purposes:

1. To process and fulfil your orders, including payment processing and delivery
2. To communicate with you about your order, including confirmations, shipping updates, and any issues
3. To manage your customer account if you choose to create one
4. To respond to your enquiries and provide customer support
5. To send you marketing communications if you have consented to receive them
6. To improve our products, website, and customer experience
7. To comply with our legal obligations
8. To prevent fraud and protect the security of our business and customers

5. Legal Grounds for Processing

Under POPIA, we rely on the following grounds to process your personal information:

5.1 Performance of a contract

Processing your order and fulfilling delivery requires us to process your personal information. Without it, we cannot complete your purchase.

5.2 Consent

Where we send marketing communications or use non-essential cookies, we do so on the basis of your consent. You may withdraw your consent at any time by contacting us or using the unsubscribe link in our emails.

5.3 Legitimate interests

We may process certain information where we have a legitimate business interest in doing so, such as fraud prevention, improving our services, and maintaining the security of our systems. We always balance our interests against your rights and will not process your information in a way that overrides those rights.

5.4 Legal obligation

Where required by law, we process personal information to comply with our legal obligations, including tax and accounting requirements.

6. Sharing Your Information

We do not sell your personal information. We share your information only where necessary, and only with:

6.1 Service providers

We share personal information with trusted third-party service providers who assist us in running our business, including payment processors, courier and logistics companies, email marketing platforms, and website hosting providers. These parties are required to process your information only in accordance with our instructions and are prohibited from using it for any other purpose.

6.2 Legal and regulatory requirements

We may disclose your information where required by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect our legal rights or the rights of others.

6.3 Business transfers

If Rare Ritual Labs is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you if this occurs and explain your options.

7. How Long We Keep Your Information

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

1. Order and transaction records: 5 years, in accordance with South African tax and accounting obligations
2. Customer account information: for the duration of the account, plus 2 years after the account is closed
3. Marketing preferences and consent records: for as long as you remain on our marketing list, plus 3 years
4. Customer service correspondence: 3 years from the date of the last communication

When your information is no longer required, we will delete or anonymise it securely.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to run the shop, to understand how the site is used, and to measure our advertising.

8.1 What cookies we use

Essential cookies. These are necessary for the website to work and cannot be switched off. They include the cookies that let you add items to your cart, stay signed in, and complete a purchase.

Analytics cookies. These help us understand how visitors move through the site so we can improve it. We use Google Analytics and Google Tag Manager for this.

Advertising cookies. These let us measure whether our advertising is working and show relevant advertising to people who have visited our website. We use the Meta pixel, which covers Facebook and Instagram, and Google Ads.

These cookies are placed when you arrive on the site. For analytics and advertising we rely on legitimate interest under section 11 of POPIA rather than consent, and we tell you about them here and in the notice shown when you first visit. We do not use them to collect information about your health, your finances, or anything else POPIA treats as special personal information.

8.2 Managing cookies

You can control and delete cookies through your browser settings, and every major browser will let you block them entirely. Please note that blocking essential cookies will stop parts of the shop working.

You can also switch off personalised advertising at the source, which applies everywhere and not only on our website. Meta’s controls sit in your Facebook or Instagram account settings under Ads. Google’s are at adssettings.google.com.

If you would prefer that we did not process your information for analytics or advertising at all, you may object at any time using the contact details in section 14, and we will act on it.

9. How We Protect Your Information

We take the security of your personal information seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These include:

1. SSL encryption for all data transmitted through our website
2. Restricted access to personal information within our team
3. Secure storage with our service providers
4. Regular review of our security practices

While we take all reasonable steps to protect your information, no method of transmission or storage is completely secure. If you believe your information has been compromised, please contact us immediately at shop@rareritual.co.za.

10. Your Rights as a Data Subject

Under POPIA, you have the following rights in relation to your personal information:

10.1 Right to access

You have the right to request a copy of the personal information we hold about you. We will respond to your request within a reasonable time and at no charge for the first request in a 12-month period.

10.2 Right to correction

You have the right to request that we correct any inaccurate or incomplete personal information we hold about you.

10.3 Right to deletion

You have the right to request that we delete your personal information in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent and there is no other lawful basis for processing.

10.4 Right to object

You have the right to object to the processing of your personal information where we rely on legitimate interests as our legal ground. You also have the right to object to receiving direct marketing communications at any time.

10.5 Right to lodge a complaint

If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa (see Section 12).

To exercise any of these rights, please contact us at shop@rareritual.co.za. We may need to verify your identity before processing your request.

11. Cross-Border Transfers of Personal Information

Where we transfer your personal information to service providers or partners based outside South Africa, we ensure that adequate safeguards are in place as required by POPIA. This includes ensuring that the recipient country has adequate data protection laws, or implementing contractual protections equivalent to those under POPIA.

12. Children

Our website and products are not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any significant changes by posting the updated policy on our website with a revised effective date. Where required by law, we will seek your consent for material changes.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal information, please contact us:

Email: shop@rareritual.co.za

Website: www.rareritual.co.za

We aim to respond to all privacy-related queries within 5 business days.

15. The Information Regulator

If you are not satisfied with our response, you have the right to contact the Information Regulator of South Africa:

The Information Regulator (South Africa)

Website: www.justice.gov.za/inforeg

Email: inforeg@justice.gov.za

PAIA Helpline: 012 406 4818