Privacy Policy

Information You Provide

Email Address (Required)

• Collected when you subscribe to our newsletter
• Used only to send wellness activities
• Stored securely in our database

Feedback (Optional)

• Satisfaction ratings (1-5 stars)
• Activity preferences
• Testimonials (only with your explicit permission)
• Collected after 4 weeks of subscription

Information Automatically Collected

Email Engagement Data

• Whether you opened our emails (tracking pixel)
• Which activity links you clicked
• Used to improve content and measure engagement
• Not sold or shared with third parties

Technical Information

• IP address (for security and rate limiting)
• Browser type (for accessibility improvements)
• Device type (mobile vs desktop)

Primary Use: Newsletter Delivery

• Send wellness activities 3 times per week (Monday, Wednesday, Friday)
• Send important service announcements (rare)
• Send feedback surveys after 4 weeks (optional)

Analytics Use

• Understand which activities are most popular
• Improve content quality
• Measure newsletter effectiveness

Legal Compliance

We may use your information to:

• Comply with South African law (POPIA, CPA)
• Respond to legal requests from authorities
• Protect our rights and prevent abuse

Under POPIA, we process your personal information based on:

Consent (Primary Basis)

• You explicitly consent when you subscribe
• You can withdraw consent by unsubscribing anytime
• Unsubscribe link in every email

Legitimate Interest

• Improving service quality
• Preventing fraud and abuse
• Analytics for content optimization

Technical Safeguards

• HTTPS encryption for all data transmission
• Passwords hashed with BCrypt (not stored in plain text)
• Database access restricted to authorized personnel only
• Regular security updates

Access Controls

• Only essential team members can access subscriber data
• Admin accounts require strong passwords
• All access is logged and monitored

Data Retention

• Active subscribers: Data retained while subscribed
• Unsubscribed users: Data anonymized after 30 days
• Legal requirement: Some data retained for 5 years (POPIA compliance)

Limited Sharing with Service Providers

Brevo (Email Delivery)

• Location: European Union (GDPR compliant)
• Purpose: Send newsletters via their infrastructure
• Data shared: Email address, email content
• Privacy Policy: brevo.com/legal/privacypolicy

Microsoft SQL Server (Database)

• Location: South Africa (bb8.webetc.co.za)
• Purpose: Store subscriber data
• Data shared: All collected information
• Security: Encrypted with access controls

These providers are contractually obligated to protect your data and use it only for our stated purposes.

Legal Disclosures

We may disclose your information if:

• Required by South African law
• Responding to valid legal process (court order, subpoena)
• Protecting our rights or preventing fraud
• With your explicit consent

As a South African Resident, You Have the Right To:

Access

Request a copy of your personal information

• Email privacy@gentlewellness.co.za
• We will respond within 30 days (free of charge)

Rectification

Correct inaccurate information

• Update your email address by unsubscribing and resubscribing
• Or contact privacy@gentlewellness.co.za

Deletion

Request deletion of your information

• Unsubscribe via link in any email (automatic deletion within 30 days)
• Or email privacy@gentlewellness.co.za for immediate deletion

Objection

Object to processing

• Unsubscribe at any time
• No questions asked, no penalties

Data Portability

Receive your data in a portable format

• Request via privacy@gentlewellness.co.za
• We will provide JSON or CSV file within 30 days

Lodge a Complaint

If you believe we violated POPIA

You Are Always in Control

What Happens When You Unsubscribe

1. You are immediately removed from mailing list
2. No more newsletters sent
3. Your email is anonymized within 30 days
4. Engagement data is retained in aggregate (anonymized) for analytics

You will receive one confirmation email after unsubscribing. No further emails after that.

Gentle Wellness is designed for adults aged 60 and older. We do not knowingly collect information from anyone under 18 years of age.

If we discover we have inadvertently collected information from a minor, we will delete it immediately.

How Long We Keep Your Information

While You're Subscribed

• Email address and engagement data retained indefinitely
• Used to send newsletters and improve service

After You Unsubscribe

• Email address anonymized within 30 days
• Aggregate analytics data (anonymized) retained for 5 years
• Legal records retained as required by law (up to 5 years)

Inactive Accounts

If you don't open emails for 12 consecutive months, we may:

• Send a re-engagement email
• If no response within 30 days, automatically unsubscribe you
• This protects your privacy and maintains our email sender reputation

Data Location: All data stored in South Africa

We do not transfer your personal information outside South Africa except:

• Brevo email servers (EU - GDPR compliant, adequate protection)
• With your explicit consent
• In accordance with POPIA Chapter 9 (Transborder Information Flows)

Cookies We Use

Essential Cookies

• Session management for admin interface
• CSRF protection tokens
• No tracking cookies on public pages

Analytics

• We use server-side analytics (no Google Analytics)
• Email tracking pixel (1x1 transparent image)
• Used only to measure open rates

Your Control

• You can disable cookies in your browser
• This may affect admin functionality
• Newsletter delivery works without cookies

We may update this Privacy Policy occasionally. If we make material changes:

Last Updated Date: Always shown at the top of this policy

We will respond within:

• 7 days for general inquiries
• 30 days for POPIA rights requests (access, deletion, etc.)

Information Regulator (POPIA Complaints)

If you believe we have violated POPIA: