Privacy notice

Responsible party

Vantax (Pty) Ltd is the responsible party for Herbal Holland Rewards and this website. Franchisee stores process your information when they serve you and are bound by agreements with us. Our Information Officer can be reached at hello@herbalholland.com.

What we collect and why

We sell to members only, so we need enough to know who you are and that you're an adult: your mobile number (to sign you in and send order updates), first name, optional email (for invoices), date of birth or a secure fingerprint of your SA ID number (to confirm you're 18+; we keep only the last four digits in readable form), your purchases and points, your home store, and the version of the membership terms you accepted and when. For registered patients, we keep the SAHPRA authorisation number, prescriber, scope, validity and monthly quantity, never your diagnosis. We process this to provide your membership (our agreement with you), to meet legal obligations such as tax, medicine and recall records, and, only with your consent, for marketing.

Marketing

We only send marketing on the channels you opt into, only in permitted hours, with an opt-out in every message. Every consent change is recorded. You can change your choices any time in Rewards settings or by replying STOP.

Franchise enquiries

If you enquire about owning a Herbal Holland store on herbalholland.com, we use your name, contact details, where you'd like to open, your experience, the capital band you chose and your message only to reply and take your enquiry forward, with your consent. Only our head-office team sees it. We keep your connection's address only as a scrambled code, to stop repeated submissions. If we don't go ahead, we delete the enquiry a year after we last worked on it, or sooner if you ask.

Cookies and your browser

We don't use advertising or tracking cookies, and we don't run analytics. The cookies we set are the ones the shop needs to work: your answer to the 18+ question (kept for a year, or only until you close your browser if you said you're under 18), your sign-in (30 days), your bag (30 days), the store you chose (a year), a promo or gift voucher code you entered (7 days), and your mobile number while you sign in (20 minutes). Trade customers' sign-in has a cookie of its own. Cloudflare, which protects this website from attacks, may also set a short-lived security cookie.

Your browser also keeps a few things on your device that never reach us: your recent searches while you're signed in, and whether you've dismissed the prompt to add the Rewards app to your home screen. If you switch on app notifications, we keep the address your browser's push service gives us for that device until you switch them off.

Where your information is kept

The platform runs on our own server in South Africa. Files uploaded to it (photos you send with a review, a return or a support request, stores' bank deposit slips and trade customers' licence documents) and our encrypted nightly backups are stored with Cloudflare R2 in the European Union, so some of your information is kept outside South Africa (POPIA section 72). Text messages go out through SMSPortal and emails through our email delivery provider. App notifications pass through your browser's push service (for example Google's or Apple's).

Sharing and storage

We share information with the store that fulfils your order, our payment and messaging providers, and couriers for delivery (only what each needs). We don't sell personal information. Information is stored securely and kept only as long as needed for the purposes above and our legal obligations (for example, tax records).

Your rights

You may ask to see, correct or delete your information, object to processing, and complain to the Information Regulator (inforegulator.org.za). Email our Information Officer to make a request.