1. Who is responsible for processing?
The responsible party for personal information is the entity behind JointGain. Official company details, including registered address and contact information, can be found on the Contact page.
Do you have questions about privacy or would you like to submit a request based on your rights under POPIA? You can contact us via the email address on the contact page.
2. What personal information do we process?
We only process information that is necessary for our services, legal obligations and website security.
- Identity and contact details: name, address, postal code, city, province, country, email address and telephone number.
- Order and transaction data: ordered products, order number, invoice details, delivery and return status.
- Customer service data: content of enquiries, complaints, emails and communication history.
- Technical data: IP address, browser type, device details, timestamps and security logs.
- Cookie and usage data: information about website usage, where permitted or based on consent.
We do not process special personal information (such as medical records) unless you actively provide it in communications. If that occurs, we treat such information strictly confidentially and only for the purpose for which you provided it.
3. For what purposes do we process personal information?
- Processing, confirming and delivering orders.
- Handling payments, returns, refunds and customer service requests.
- Record-keeping and compliance with tax and accounting obligations.
- Securing systems and preventing fraud, abuse and unauthorised access.
- Improving the website and services through statistical or analytical insights.
- Sending service messages about your order or account-related updates.
4. On what grounds do we base processing?
We process personal information only on a valid lawful ground under POPIA:
- Performance of a contract — for example for order processing and delivery.
- Legal obligation — for example tax record-keeping requirements.
- Legitimate interest — such as security, fraud prevention and service improvement.
- Consent — for example for non-essential cookies or marketing communication.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not have retrospective effect.
5. How long do we retain personal information?
We do not retain information longer than necessary for the purpose of processing, unless a statutory retention period applies.
- Order and invoice data: in accordance with South African tax retention requirements (generally 5 years).
- Customer service communications: as long as necessary for resolution and reasonable aftercare.
- Technical security logs: as briefly as possible, unless longer retention is needed for incident investigation.
- Marketing consent: until withdrawal of consent or periodic review.
6. With whom do we share personal information?
We share personal information only where necessary for the delivery of our services or as required by law.
- Logistics partners for delivery of orders.
- Payment and financial service providers for transaction processing.
- IT and hosting providers for website management, security and data storage.
- Administrative or compliance partners for statutory and operational obligations.
We enter into operator agreements with processors where required. Operators may only process information according to our instructions.
7. Transfer outside South Africa
If personal information is processed outside South Africa, we do so only with appropriate safeguards, such as an adequate level of protection or contractual provisions that meet the requirements of POPIA, where applicable.
8. Your rights under POPIA
As a data subject you have, among others, the following rights:
- Right to access your personal information.
- Right to correction of inaccurate information.
- Right to deletion of personal information within legal limits.
- Right to object to processing based on legitimate interest.
- Right to withdraw consent (where processing is based on consent).
- Right to lodge a complaint with the Information Regulator.
Requests can be submitted via the contact details on the contact page. We may ask for additional verification to confirm your identity before processing a request.
9. Cookies and similar technologies
Our website may use functional, analytical and (where applied) marketing cookies. Functional cookies are necessary for the correct operation of the site. We only place non-essential cookies on the basis of valid consent, where legally required.
You can adjust cookie settings via your browser settings and, where available, via the cookie banner on the website.
10. Security of personal information
We implement appropriate technical and organisational measures to protect personal information against loss, unlawful processing, unauthorised access, alteration or disclosure. Examples include access controls, secure connections and logging.
11. Children's information
Our website and products are not specifically directed at children. We do not knowingly process personal information of minors without a valid lawful ground and, where required, parental or guardian consent.
12. Complaints and the Information Regulator
If you believe we are processing your personal information incorrectly, you may first contact us directly. You also have the right to lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).
13. Changes to this privacy policy
We may update this policy when legislation, processes or systems change. The most current version will be published on this page with an updated date.
Last updated: 15 June 2026