Privacy policy
Effective date: 12 November 2026
1. Responsible party
1.1 Varona (Pty) Ltd, registration number 2026/088657/07, trading as Hareloom, of 8 Central Lane, Riverglen, Midrand, Gauteng, 2191 ("Hareloom") is the responsible party for the personal information processed through hareloom.co.za, as that term is defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").
1.2 This Policy forms part of the Terms and Conditions of Sale.
2. Information Officer
2.1 The Information Officer may be contacted at hello@hareloom.co.za or at the address in clause 1.1.
3. Personal information processed
3.1 Hareloom processes the following categories of personal information:
| Category | Purpose | Mandatory or voluntary |
| Name | Identification of the Order and addressing of the consignment | Mandatory for a purchase |
| Delivery address | Delivery of the Goods | Mandatory for a purchase |
| Email address | Order confirmation, despatch notification, correspondence and, where consent is given, direct marketing | Mandatory for a purchase; voluntary for marketing |
| Telephone number | Contact by the carrier in respect of delivery | Mandatory for a purchase |
| Order and transaction records | Performance of the agreement and compliance with tax and company law | Mandatory for a purchase |
| Correspondence | Responding to enquiries | Voluntary |
| Technical data: IP address, browser, device, pages visited | Operation and security of the Website, and analytics where consent is given | Collected automatically; non-essential processing subject to consent |
3.2 Payment card data is not received, processed or stored by Hareloom. It is transmitted directly to the payment provider over an encrypted connection.
3.3 Where information marked mandatory is not supplied, Hareloom is unable to accept or fulfil an Order.
3.4 Hareloom does not process special personal information as defined in section 26 of POPIA.
4. Source
Personal information is collected directly from the data subject; automatically from the data subject's device on use of the Website; and from Hareloom's operators in the course of performing their functions.
5. Purpose and lawful basis
| Purpose | Basis under POPIA s11 |
| Acceptance, fulfilment and delivery of Orders, and related communication | s11(1)(b) — necessary for the performance of a contract |
| Responding to enquiries and complaints | s11(1)(b) or s11(1)(f) — legitimate interest |
| Accounting, tax and statutory record-keeping | s11(1)(c) — compliance with a legal obligation |
| Security of the Website and prevention of fraud | s11(1)(f) — legitimate interest |
| Direct marketing | s11(1)(a) — consent. See clause 6 |
| Non-essential cookies and analytics | s11(1)(a) — consent. See clause 7 |
Personal information is not processed for any purpose other than those set out above, and is not sold.
6. Direct marketing
6.1 Electronic direct marketing is conducted only in accordance with section 69 of POPIA.
6.2 Marketing communications are sent to a person who is not a customer only where that person has given consent in the prescribed manner and form.
6.3 Marketing of Hareloom's own similar goods may be sent to an existing customer in terms of section 69(3), subject to the opportunity to object at the time of collection and in every subsequent communication.
6.4 Consent may be withdrawn at any time, by means of the unsubscribe facility in any marketing communication or by notice to hello@hareloom.co.za. Withdrawal is given effect without delay.
6.5 A record of an objection or withdrawal is retained for the purpose of preventing further contact.
7. Cookies
7.1 Cookies strictly necessary for the operation of the Website, including those maintaining the shopping cart and checkout session, are set without consent.
7.2 All other cookies, including the analytics cookies of Google Analytics, are set only with the consent of the user, obtained before the cookie is set.
7.3 Consent may be refused or subsequently withdrawn through the cookie settings facility on the Website. Refusal does not affect the functioning of the Website.
8. Operators and recipients
| Recipient | Function | Location |
| Shopify Inc. | Hosting of the Website and processing of Orders | Canada, with processing on servers in several jurisdictions |
| Google LLC (Google Analytics) | Website analytics, only where cookie consent is given | United States, with processing on servers in several jurisdictions |
| Payfast | Payment processing | South Africa |
| Pargo | Delivery. Receives name, delivery address and telephone number only | South Africa |
| Hareloom's accountant | Statutory accounting and tax compliance | South Africa |
8.1 Each operator is bound by written contract to process personal information only on Hareloom's instructions and to maintain appropriate security safeguards, as required by sections 20 and 21 of POPIA.
8.2 Personal information may be disclosed where disclosure is required by law, or is necessary to establish, exercise or defend a legal claim.
9. Trans-border flows
9.1 Personal information is processed by Shopify Inc. and, where consent to analytics cookies is given, by Google on servers outside the Republic of South Africa.
9.2 This transfer is permitted under section 72 of POPIA on the grounds that the recipient is subject to a binding agreement providing a level of protection that upholds principles for the lawful processing of personal information substantially similar to those in POPIA, and that the transfer is necessary for the performance of the contract between Hareloom and the data subject.
10. Retention
10.1 Personal information is retained no longer than is necessary for the purpose for which it was collected, as required by section 14 of POPIA, except where retention is required or authorised by law.
| Record | Retention period |
| Order, transaction and accounting records | 7 years, being the longer of the periods required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011 |
| Delivery records | 12 months from delivery |
| Correspondence | 12 months from the conclusion of the matter |
| Marketing database | Until consent is withdrawn, or after 3 years without engagement, whichever occurs first |
| Record of objection to marketing | Indefinitely, for the purpose set out in clause 6.5 |
10.2 On expiry of the applicable period, records are deleted or de-identified.
11. Security safeguards
11.1 Hareloom maintains appropriate, reasonable technical and organisational measures in terms of section 19 of POPIA, including transmission of all Website traffic over an encrypted connection, restriction of access to personal information to persons who require it, and engagement of a PCI-DSS compliant payment provider.
11.2 Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Hareloom will notify the Information Regulator and the affected data subjects as required by section 22 of POPIA.
12. Rights of data subjects
12.1 A data subject has the right to:
12.1.1 be notified that personal information is being collected, and of a security compromise (sections 18 and 22);
12.1.2 request confirmation of the personal information held, and a record of it (section 23);
12.1.3 request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24);
12.1.4 object to processing on reasonable grounds (section 11(3));
12.1.5 object at any time to processing for purposes of direct marketing (section 11(3)(b) and section 69);
12.1.6 withdraw consent previously given, without affecting the lawfulness of processing carried out before withdrawal; and
12.1.7 submit a complaint to the Information Regulator (section 74).
12.2 Requests are made to the Information Officer at hello@hareloom.co.za. Hareloom may require verification of the identity of the requester. A request under section 23 is dealt with in terms of the Promotion of Access to Information Act 2 of 2000 and Hareloom's PAIA Manual.
12.3 No fee is charged for exercising a right under clause 12.1, save for the fees prescribed under PAIA in respect of access to records.
13. Complaints
13.1 Complaints should be addressed in the first instance to the Information Officer at hello@hareloom.co.za.
13.2 A complaint may be lodged with the Information Regulator:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 · Toll-free: 0800 017 160
Email: enquiries@inforegulator.org.za
Complaints under POPIA are lodged through the Regulator's eService Portal at inforegulator.org.za
14. Access to information
Hareloom's PAIA Manual, prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, is published at hareloom.co.za/pages/paia-manual and is available on request at hello@hareloom.co.za.
15. Children
15.1 The Goods are sold to persons of 18 years and older. Hareloom does not knowingly process the personal information of a child as defined in POPIA.
15.2 Hareloom does not collect the name, date of birth, photograph or any other personal information of any child in respect of whom the Goods are purchased. No material placed in the Goods by a purchaser is transmitted to or held by Hareloom.
15.3 Where Hareloom becomes aware that it holds the personal information of a child without the consent of a competent person, that information will be deleted. Notification may be given to hello@hareloom.co.za.
16. Amendment
This Policy may be amended. The version published on the Website is the current version, and the effective date at the head of this document indicates when it took effect.
Varona (Pty) Ltd t/a Hareloom. Registration number 2026/088657/07.