Privacy Policy
Element Labs (Pty) Ltd, trading as AuraNova · Last updated 12 July 2026
This Privacy Policy explains how Element Labs (Pty) Ltd (registration number 2026/419578/07), trading as AuraNova (“AuraNova”, “we”, “us”, “our”), collects, uses, shares, and protects your personal information when you visit our website, create an account, place an order, subscribe to our communications, or otherwise interact with us (together, the “Services”).
We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (“POPIA”) of South Africa.
If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.
Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood how we collect, use, and disclose your information as described here.
1. Personal Information We Collect
When we use the term “personal information”, we mean information that identifies you or can reasonably be linked to you. It does not include information that has been anonymised or de-identified so that it can no longer be linked to you.
Depending on how you interact with the Services, we may collect and process:
- Contact details — your name, billing address, delivery address, phone number, and email address.
- Order and transaction information — the products you view, add to your cart or wishlist, purchase, return, exchange, or cancel; order history; subscription details; and delivery status.
- Payment information — the form of payment, transaction reference, payment confirmation, and the last four digits of your card. We do not store full card numbers or CVV codes on our systems. Card payments are processed directly by our payment provider ([PAYMENT PROVIDER, e.g. Peach Payments]) on their secure infrastructure. For cash-on-delivery orders, we collect only the amount due and confirmation of payment from our courier.
- Account information — your username, password (stored in encrypted form), preferences, and settings.
- Communications with us — the content of messages you send us by email, phone, WhatsApp, live chat, or contact form, including recordings or notes of customer service calls where permitted by law.
- Marketing preferences — your subscription status and how you interact with our emails and SMS messages.
- Device and technical information — your IP address, browser type, device type, operating system, and other unique identifiers.
- Usage information — how and when you navigate and interact with our website, including pages viewed and links clicked.
Health-related information
Our products are health supplements. If you voluntarily share information about your health, diet, or wellness goals with us (for example, in a product quiz, a review, or a customer service enquiry), we treat this as special personal information under POPIA. We only process it with your consent, only for the purpose for which you provided it, and we do not use it for advertising.
Children
The Services are not intended for children. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.
2. Where We Get Your Personal Information
- Directly from you — when you create an account, place an order, subscribe, complete a form, or contact us.
- Automatically from your device — through cookies and similar technologies when you use our website (see section 6).
- From our service providers — for example, our payment provider confirms that a payment succeeded, and our courier confirms that a delivery was completed.
- From advertising and analytics partners — where you have consented to this.
3. How We Use Your Personal Information
We process your personal information for the following purposes and on the following legal grounds under POPIA:
| Purpose | Legal ground |
|---|---|
| To create and manage your account, process and deliver your orders, manage subscriptions, handle returns, refunds, and exchanges | Performance of a contract with you |
| To provide customer support and respond to your enquiries | Performance of a contract / our legitimate interests |
| To send marketing and promotional communications by email or SMS about our products and offers | Your consent (you may withdraw it at any time) |
| To personalise the Services, remember your preferences, and recommend relevant products | Your consent / our legitimate interests |
| To detect, investigate, and prevent fraud, abuse, and security incidents, and to protect our customers and our business | Our legitimate interests / compliance with law |
| To analyse and improve our website, products, and services | Our legitimate interests |
| To comply with legal, tax, accounting, and regulatory obligations, including those under the Consumer Protection Act and applicable health-product regulations | Compliance with a legal obligation |
| To establish, exercise, or defend legal claims | Our legitimate interests / protection of a legitimate interest |
We do not sell your personal information.
4. How We Share Your Personal Information
We share your personal information only where necessary, and only with parties who are bound to protect it. These include:
- Payment providers — to process card payments and refunds securely. [e.g. Peach Payments]
- Courier and logistics providers — to deliver your order and, for cash-on-delivery orders, to collect payment. They receive your name, delivery address, phone number, and order details. Bob Go (The Courier Guy).
- Hosting and cloud infrastructure providers — to run our website, databases, and backups. [e.g. AWS / Supabase / VPS provider]
- Email and SMS marketing platforms — to send you communications you have subscribed to. [e.g. Klaviyo]
- Analytics and advertising partners — to understand how our website is used and, where you have consented, to show you relevant advertising. [e.g. Google Analytics, Meta]
- Professional advisers — our accountants, auditors, and lawyers, where necessary.
- Authorities and regulators — where we are legally required to disclose information, or to protect our rights, our customers, or the public.
- A buyer or successor — in connection with a merger, acquisition, restructuring, or sale of our business.
Each of our operators (processors) is required, by written agreement, to process your personal information only on our instructions and to maintain appropriate security safeguards, as required by section 21 of POPIA.
5. International Transfers
Some of our service providers are located outside South Africa. Where we transfer your personal information across borders, we do so in accordance with section 72 of POPIA — meaning that the recipient is subject to a law, binding corporate rules, or a binding agreement that provides a level of protection substantially similar to POPIA, or you have consented to the transfer, or the transfer is necessary to perform our contract with you.
6. Cookies and Similar Technologies
We use cookies and similar technologies to operate our website, remember your cart and preferences, understand how the site is used, and — where you consent — to measure and target advertising.
- Strictly necessary cookies keep the site working (for example, keeping you logged in and keeping items in your cart). These cannot be switched off.
- Analytics cookies help us understand how visitors use the site.
- Marketing cookies allow us and our partners to show you relevant advertising.
You can accept or decline non-essential cookies through our cookie banner, and you can change your choice at any time via [COOKIE SETTINGS LINK]. You can also block or delete cookies through your browser settings, though some parts of the site may then not work properly.
7. Security and Retention
We apply appropriate technical and organisational measures to protect your personal information, including encryption in transit (HTTPS), encrypted password storage, access controls, and regular backups. However, no system is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive or confidential information through unsecured channels.
We keep your personal information only for as long as we need it:
- Account and order data — for as long as your account is active, and thereafter for the period required by South African tax and company law (currently five years from the end of the relevant financial year).
- Marketing data — until you unsubscribe or withdraw your consent, after which we retain a minimal record of your opt-out so that we do not contact you again.
- Customer service records — [RETENTION PERIOD, e.g. 3 years] after the enquiry is closed.
If we suffer a security compromise affecting your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.
8. Your Rights
Under POPIA you have the right to:
- Access — request confirmation of whether we hold personal information about you, and request a copy of it.
- Correction — request that we correct or update inaccurate, misleading, or outdated information.
- Deletion — request that we delete personal information we are no longer entitled to keep.
- Object — object, on reasonable grounds, to our processing of your personal information.
- Withdraw consent — withdraw consent at any time where our processing is based on consent, including for marketing. This does not affect processing carried out before you withdrew consent.
- Opt out of direct marketing — unsubscribe from any marketing email using the link in the message, reply STOP to any marketing SMS, or contact us directly. We may still send you transactional messages about your orders and account.
- Complain — lodge a complaint with the Information Regulator (see below).
To exercise any of these rights, contact us using the details in section 10. We may need to verify your identity before acting on your request. Certain requests may be submitted on the Regulator’s prescribed forms, and we will respond within the periods required by law.
We will never discriminate against you for exercising your rights.
9. Third-Party Websites
Our website may contain links to sites we do not operate. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing them with your personal information.
10. Contact Us and Information Officer
If you have any questions about this Privacy Policy, wish to exercise your rights, or wish to make a complaint, please contact:
Element Labs (Pty) Ltd t/a AuraNova
57 Heerengracht Street, Cape Town, 8001, South Africa
Email: elementlabs.2026@gmail.com
Phone: +27 68 960 8364
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):
The Information Regulator (South Africa)
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za
Online complaints portal: eservices.inforegulator.org.za
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. We will post the updated policy on this page and change the “Last updated” date above. Where the changes are significant, we will notify you directly.