Privacy & Cookies

Last updated: 17 September 2026

Who is responsible for your information

INFUSION DIFFUSION is responsible for personal information processed in operating our online store. This statement explains our handling of that information under South Africa's Protection of Personal Information Act, 2013 (POPIA). Our privacy contact is Dione Smith. Use “Privacy enquiry” in your email subject line when contacting us about your information.

INFUSION DIFFUSION
3 Brommaert Place, Constantia, South Africa
Contact: Dione Smith
Email: dione.smith@infusiondiffusion.co.za
Telephone: +27 82 446 6623
Website: www.infusiondiffusion.co.za

Information we collect

• Contact, billing and delivery details you provide, including your name, email address, telephone number and addresses.
• Order details, purchased items, payment status and transaction references, delivery information and returns or refund records.
• Account and sign-in information, customer preferences and correspondence you send to us.
• Technical information such as IP address, browser and device information, service logs, cart/session identifiers and cookie information generated when you use the store or checkout.

We receive information directly from you and from providers involved in payments, checkout, account services and delivery. Our custom storefront does not store full payment-card credentials or your account password. Please do not email passwords or payment-card details.

Why we use it and on what basis

We use the information needed to take and fulfil orders, process payments and refunds, deliver products, provide accounts and support, and communicate about purchases. This processing supports entering into and performing our contract with you. We also process information to meet legal obligations, keep appropriate business records, prevent fraud and protect the security of our services, relying on the applicable legal obligations or legitimate interests recognised by POPIA.

Where consent is required, including for optional tracking or electronic marketing, we seek it separately. Using the website or agreeing to our terms does not by itself give consent to all processing. We do not use your information for a materially different incompatible purpose without an appropriate lawful basis and notice.

Information needed for payment, delivery or a requested account is necessary to provide that service; if you choose not to provide it, we may be unable to complete the request. Optional information and consent choices do not affect your statutory rights.

Service providers and recipients

• Shopify provides our commerce platform, checkout, customer accounts and order management.
• PayFast processes payments and related transaction information.
• Vercel hosts the public storefront and processes technical connection and hosting information.
• Sanity supplies website content and live content updates, which involve technical connection information.
• Upstash provides server-side storage for encrypted account authentication/session information.
• Our delivery and email providers receive the information needed to deliver orders and handle communications.

We share information needed for these services, legal obligations and the protection of lawful rights. Providers may also have their own legal responsibilities and privacy terms.

Shopify services

Shopify processes information to operate, secure and improve its services. Shopify Network Intelligence is enabled for our store. Shopify may use information about interactions with our store together with interactions with other merchants to provide those services, including personalisation and advertising features. Shopify is responsible for processing for its own purposes and provides its own privacy choices. Read Shopify's consumer privacy policy and visit Shopify's privacy portal for details and available rights. Our statement does not replace Shopify's notices.

Cookies and similar technologies

Cookies are small pieces of information stored by your browser. Necessary cookies support the cart, secure sign-in, checkout and fraud prevention. Shopify-hosted services also use analytics and marketing cookies. Optional tracking requires appropriate consent where applicable; a privacy notice alone is not a consent choice.

• Cart: infusion_cart remembers the shopping cart for up to 14 days.
• Sign-in: __Host-infusion-customer-login secures a sign-in attempt for up to 10 minutes; __Host-infusion-customer maintains an account session for up to seven days.
• Shopify/Shop operation: _shopify_essential and _shop_app_essential support their services; observed lifetimes can be up to one year.
• Shopify analytics and marketing: _shopify_s typically lasts 30 minutes; _shopify_y, _shopify_analytics and _shopify_marketing may last around one year.

Cookie names and lifetimes can change and may be renewed by activity. See Shopify's cookie information for current details. At Shopify checkout, use Accept or Decline on the cookie banner, or Manage preferences to choose optional categories. To change or withdraw a saved choice, open Cookies in the checkout footer and update your preferences; Decline all switches off optional categories. Necessary cookies remain enabled. Our storefront and Shopify checkout may use different domains, so choices should not be assumed to carry between them.

You can also delete or block cookies through your browser. Blocking necessary cookies can prevent the cart, account or checkout from working. Deleting cookies does not itself delete order or account records. Contact Dione Smith if you cannot locate a privacy control or wish to withdraw consent.

Electronic marketing

We will only send direct electronic marketing where POPIA permits it, including with appropriate consent or under the applicable existing-customer rules. You can object or unsubscribe without charge through the available unsubscribe mechanism or by contacting us. Necessary order and service messages may still be sent.

Processing outside South Africa

Some providers process information outside South Africa. Our website application servers and account-session storage are configured in the United States; Shopify and Sanity operate internationally. Cross-border transfers must meet POPIA's requirements, including appropriate protection through applicable law, binding agreements or another lawful ground. Contact us for information about the arrangements applicable to your information.

Retention and security

We keep personal information for as long as reasonably needed for the purpose for which it was collected, legal recordkeeping duties, resolving disputes and enforcing agreements. Order, payment, accounting and support records can be retained longer than a website session. When information is no longer lawfully needed, it should be deleted, destroyed or de-identified in accordance with applicable requirements.

We use reasonable technical and organisational safeguards, including encrypted connections, restricted access and encrypted account-session data. No system can guarantee absolute security. Where a security compromise requires notification under POPIA, we will notify the Information Regulator and affected people as required.

Your rights and requests

Subject to POPIA's requirements and lawful exceptions, you may request confirmation of whether we hold your personal information, access to it, correction of inaccurate information, and deletion or destruction of information we are no longer entitled to retain. You may object to certain processing, withdraw consent for future consent-based processing, and object to direct marketing. Withdrawal does not invalidate processing already lawfully carried out.

Send requests to Dione Smith using the contact details above. We may reasonably verify your identity before disclosing or changing information. We will explain any legal reason why a request cannot be fully met and any applicable procedure or prescribed fee before proceeding.

Children

Our store is intended for adult purchasers. A person under 18 should use purchase services only with the consent and assistance of a parent or legal guardian. We do not knowingly seek children's personal information for marketing. Contact us if a child has provided information without the necessary authorisation so we can address it under POPIA.

Complaints and updates

You may contact us with a privacy concern. You may also complain directly to South Africa's Information Regulator; current complaint procedures and contact details are available on its website. We may update this statement when our services or obligations change. The date above identifies the current version, and material changes will be brought to your attention where required.