Privacy Policy

Last updated: 25 February 2025

This Privacy Policy explains how Lighthouse Wellbeing (“we”, “us”, “our”) collects, uses and discloses your personal information when you visit or purchase from lighthousewellbeingcpt.com (the “Site”) or otherwise interact with our services (the “Services”). By using the Services you agree to the practices described below. If you disagree, please stop using the Services.

1 Changes to this Policy

We may revise this Policy from time to time to reflect legal, technological or business changes. When we do, we will post the new version here, update the “Last updated” date, and take any additional steps required by law.

2 How we collect personal information

Information you provide directly

Name, billing and shipping address, phone number and other contact details
Account credentials such as username, password and security questions
Order-related information (products purchased, payment confirmation)
Messages you send via our “Contact Us” form, WhatsApp or live chat

Information collected automatically (Usage Data)

IP address, browser type, device identifiers
Pages visited, time spent, referring URLs
Cookie and pixel data collected through first- and third-party tracking tools

Information received from third parties

WooCommerce and core WordPress services that power our store
Payment processor Yoco, which supplies secure card-transaction details
Courier integrations (PUDO and The Courier Guy) for delivery and tracking
Analytics and advertising partners (e.g., Google Analytics, Meta Pixel)
Our POPI-compliance tool (“PoPI App”), which logs cookie-consent choices

3 How we use your information

Order fulfilment and account management – to process payments, ship orders, arrange returns and manage your account.
Customer support and service improvements – to respond to enquiries, troubleshoot issues and enhance the Site.
Marketing and personalised offers – to send emails, texts or on-site messages (only if you have consented; you can opt out anytime).
Security and fraud prevention – to detect and prevent unauthorised or illegal activity.
Regulatory compliance – to meet obligations under POPIA, GDPR, tax law and other regulations.

Our legal bases for processing include contract performance, legitimate interests, consent and compliance with legal obligations.

4 Cookies and similar technologies

We use cookies and related tools to

remember your preferences and cart contents,
analyse site traffic and performance,
manage the cookie-consent banner via our PoPI App, and
personalise marketing on and off the Site.

Most browsers let you block or delete cookies, but this may affect site functionality. For details on WooCommerce cookies see the WooCommerce documentation.

5 How we share information

We only share personal information when necessary:

Service providers – hosting (Hostinger), WooCommerce extensions, Yoco, PUDO, The Courier Guy, email/SMS platforms, analytics vendors
Business and marketing partners – only if you have opted in to receive promotional communications
Legal and regulatory bodies – to comply with the law or protect rights
Corporate transactions – if we undergo a merger, acquisition or asset sale

We do not sell your personal information.

6 Data retention and security

We keep information only as long as needed to

maintain your account and fulfil orders,
comply with legal duties, or
resolve disputes and enforce agreements.

We use industry-standard safeguards such as SSL encryption and restricted access. No online system is 100 % secure, so please keep your password confidential and notify us via the [Contact Us] link if you suspect unauthorised access.

7 Your privacy rights

Depending on your jurisdiction, you may have the right to:

access or know what data we hold;
correct inaccurate data;
delete your data (subject to legal retention requirements);
restrict or object to certain processing;
receive a portable copy of your data;
withdraw consent for marketing at any time.

To exercise any of these rights, use the [Contact Us] link. We will verify your identity and respond within the legal timeframe. You may appoint an authorised agent to act on your behalf.

8 Children

Our Services are not directed to children under 18. We do not knowingly process children’s data. If you believe we have collected such information, please notify us via [Contact Us] so we can delete it.

9 International transfers

We are based in South Africa but may process or store data on servers in other countries. When we transfer data internationally, we rely on recognised safeguards such as Standard Contractual Clauses or equivalent mechanisms.

10 Contact

For questions, requests or complaints about this Policy or our data practices, please reach out via our Contact Us page. We aim to reply within two business days.