Who we are
This policy applies to Mama's Flat Stomach Tea (operated by HB Distributors, an independent distributor based in South Africa). We're the “responsible party” under the Protection of Personal Information Act, 2013 (POPIA).
If you have any questions about this policy or how we handle your data, contact us at support@hbdistributors.co.za.
What we collect
We collect:
- Order details — your name, email address, WhatsApp number, chosen Pargo Pickup Point, and the items you've ordered.
- Payment details — we do not receive or store your card number. Payment is processed by Payfast, our payment gateway. We only see a Payfast reference and the payment status (success / failure / pending).
- Order history — a record of what you've ordered with us, so we can look it up if you contact us later.
- Distributor referral, if applicable — if you arrived via a distributor's referral link, we record that so they get credit for your purchase.
- Communications — emails, WhatsApp messages, and any support tickets you send us.
We do not collect government identifiers (ID number, tax number), banking details, biometric data, or special personal information beyond what you've voluntarily shared in a message to us.
Why we collect it
We use your information to:
- Process and deliver your orders.
- Send you transactional emails — order confirmations, payment receipts, shipping notifications, refund confirmations.
- Reply to customer support questions you send us via email or WhatsApp.
- Keep order history for tax and accounting purposes (SARS requires retention).
- If applicable, credit the right distributor for your purchase.
We do not send marketing emails by default. You won't be added to a mailing list just by ordering.
Who we share it with
We share the minimum required with these third parties:
- Payfast — for payment processing. Your name, email, phone number, and order amount go to Payfast so they can collect payment. Payfast has its own privacy policy at payfast.io/privacy-policy.
- Pargo — for parcel delivery to your chosen Pickup Point. Your name, pickup point selection, and contact details go to Pargo so they can route and notify you.
- Resend — our transactional email provider. Your email address and the email content (order confirmation, shipping notification, etc.) pass through their servers for delivery.
- Supabase — our database host. Your data sits on their infrastructure in their hosted-region data centre.
- Vercel — our website host. Anonymised traffic logs (IP address, browser, page visited) are processed by Vercel for site operation.
We do not sell, rent, or trade your personal information. We don't share it with marketing networks, ad platforms, or data brokers.
How long we keep it
- Order records: 5 years after the order date (SARS tax retention requirement).
- Customer profile: as long as you remain a customer, plus 5 years for tax purposes.
- Email content: stored in Resend for up to 30 days, then deleted by them per their retention policy.
- Support conversations: kept as long as they remain useful for resolving disputes, typically up to 3 years.
Your rights under POPIA
As a data subject in South Africa, you have the right to:
- Access — ask us what personal information we hold about you.
- Correction — ask us to correct inaccurate information.
- Deletion — ask us to delete your information, subject to legal retention obligations (e.g. tax records).
- Objection — object to specific uses of your information.
- Complaint — lodge a complaint with the Information Regulator (inforegulator.org.za) if you believe we've mishandled your data.
To exercise any of these rights, email support@hbdistributors.co.za with your request and order number (if applicable). We respond within 30 days.
Cookies
We use a small number of essential cookies — none for advertising or cross-site tracking:
- Session cookie — keeps you signed in if you have an admin or distributor account.
- Referral cookie (mt_ref) — remembers which distributor referred you, so they get credit if you place an order.
We don't use Google Analytics, Facebook Pixel, or any ad-tech tracking pixels.
Children
Our products are intended for adults (18+). We don't knowingly collect information from children under 18. If you believe a child has provided us information, contact us and we'll delete it.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be flagged at checkout or via an email to recent customers.
Contact
Privacy questions or data requests:
Postal address: [Registered address — set in /admin/settings → Legal].