Privacy Policy & POPIA

This policy explains how Nutrition Rage collects, uses, shares and protects your personal information, and what you can require of us. It is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Responsible party and Information Officer

Nutrition Rage (Pty) Ltd, registration number 2024 / 394102 / 07, of Jetvest Building, Cnr Linden & Neven St, eMalahleni, 1035, is the responsible party for the personal information described here.

Our Information Officer is reachable at privacy@nutritionrage.com or 066 305 8851. The Information Officer is registered with the Information Regulator as POPIA requires.

2. What we collect, and why

Information	Why we need it	Lawful basis
Name, email address, phone number	To process your order and contact you about it	Performance of our contract with you
Delivery and billing address	To deliver the goods and issue a valid tax invoice	Contract; legal obligation
Order and payment history	Fulfilment, returns, warranty and accounting	Contract; legal obligation (SARS records)
Chosen home branch and approximate location	To show branch stock, distance and collection times	Legitimate interest; consent for precise location
Website usage and device data	To keep the site working, secure and fast	Legitimate interest
Marketing preferences and consent records	To send only what you asked for, and to prove you asked	Consent
Messages you send us, including WhatsApp	To answer you and to keep a record of what was agreed	Contract; legitimate interest
Questions you type into Your Personal Coach	To answer them and to improve the tool	Legitimate interest; consent

We do not ask for health information and you should not send us any. If you tell us about a medical condition in the course of a conversation, we treat it as special personal information under section 26 of POPIA, use it only to answer you safely, and do not add it to any marketing profile. Our AI tools are built to refuse medical questions and hand you to a person precisely so this data is not collected at scale.

We do not knowingly collect information from children under 18. If you believe we have, contact the Information Officer and we will delete it.

3. Payment information

We do not see or store your full card number. Card payments are processed by our PCI-DSS compliant payment provider. We receive only a transaction reference, the amount, the result and the last four digits.

4. Consent, and how to withdraw it

Marketing is opt-in. We will only send you marketing if you have actively agreed — a ticked box you ticked yourself, a form you completed, or a message you sent us asking to be added. Consent is never bundled into the act of buying something, and an unticked box stays unticked.

You can withdraw consent at any time, through any of these channels, and it costs you nothing:

• WhatsApp: reply STOP to any message from us, or send STOP to 066 305 8851.
• SMS: reply STOP to any SMS we send.
• Email: click the unsubscribe link at the foot of any marketing email.
• Your account: update your marketing preferences under My Account.
• In person or by phone: tell any branch, or phone 066 305 8851.
• In writing: email privacy@nutritionrage.com.

We action opt-outs within 3 working days and no later than 7. Withdrawing marketing consent does not stop transactional messages about an order you have actually placed — order confirmations, “ready to collect”, delivery tracking and refund notices. Those are part of the sale, not marketing.

5. Direct marketing (POPIA s 69)

We may only send electronic direct marketing to you if you are an existing customer whose contact details we obtained in the course of a sale (and we tell you how to opt out every time), or if you have given consent. We keep a record of when and how each consent was given. You may ask us to show it to you.

6. Who we share information with

Only with operators who need it to do a job for us, under a written agreement that binds them to POPIA standards:

• Couriers — name, delivery address and phone number, so they can deliver.
• Our payment provider — to take payment.
• Email and messaging providers (including the WhatsApp Business Platform) — to send what you asked for.
• Our hosting and website providers — to run the site.
• Our accountants and, where required, SARS — for statutory records.
• Where the law requires it, or to establish or defend a legal claim.

We do not sell your personal information. Ever. We do not rent or trade mailing lists.

7. Cross-border transfers (POPIA s 72)

Some of our providers process data outside South Africa. We only use providers who are subject to laws or binding agreements giving substantially similar protection to POPIA, and we contract for that protection in writing.

8. How long we keep it

• Order, invoice and tax records: 5 years from the end of the tax year, as required by the Tax Administration Act.
• Account details: while your account is open, and 12 months after you ask us to close it.
• Marketing consent and opt-out records: as long as we market, plus 3 years, so we can prove the opt-out was honoured.
• Support and WhatsApp conversations: 24 months.
• Website analytics: 26 months.

After that it is deleted or de-identified.

9. Your rights under POPIA

You have the right to:

• be told what personal information we hold about you, and where we got it;
• ask for a copy of it;
• have it corrected or updated if it is wrong;
• have it deleted or destroyed where we no longer have a lawful basis to keep it;
• object, on reasonable grounds, to our processing it;
• withdraw consent, at any time, for anything based on consent;
• not be subject to a decision with legal consequences based solely on automated processing;
• complain to the Information Regulator; and
• seek civil relief in a court.

To exercise any of these, email privacy@nutritionrage.com. We may ask you to verify your identity — we are not going to hand your order history to somebody who merely knows your email address. Formal access requests use Form 2 under the Promotion of Access to Information Act; we will send you the form. We respond within 30 days.

10. Security

The site runs over HTTPS. Passwords are hashed, never stored in readable form. Access to customer data is limited to staff who need it and is logged. Our home-branch cookie is cryptographically signed so it cannot be tampered with. If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as section 22 requires.

11. Cookies

See the Cookie Policy for exactly what is set and how to control it.

12. Complaints — the Information Regulator

If you are not satisfied with how we have handled your information, please give us a chance to fix it first. If we cannot, you may complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Email: complaints.IR@justice.gov.za
General enquiries: enquiries@inforegulator.org.za
Website: inforegulator.org.za

13. Changes

We will post any change here and update the date below. Where a change is material we will tell you directly.

Last updated: 15 August 2026.