Legal

Privacy policy

Last updated 10 September 2026

This page explains what personal information we collect when you visit kindrakitchen.co.za, why we collect it, who else gets to see it, and what you can ask us to do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible for your information

Kindra Kitchen operates this website and is the responsible party for the personal information described here. Our Information Officer is the owner of the business.

For any question or request about your personal information, email axcptemail@gmail.com. That address reaches us directly.

2. What we collect

When you place an order, we collect your name, email address, delivery address, phone number and what you bought. We need all of it to get the parcel to you and to deal with a return if you want one.

We never see your card details. Payment happens on Shopify's checkout at shop.kindrakitchen.co.za, and your card number goes from your browser to Shopify and its payment providers without passing through us. We cannot see it, and we do not store it.

Automatically, as you browse, we collect the pages you look at, the link or advert that brought you here, an approximate location worked out from your IP address, your device and browser type, and how you interact with the page — what you click, how far you scroll and how long you stay.

3. Session recordings and heatmaps

We use Microsoft Clarity to understand how people actually use this site. It is worth being precise about what this does, because "recording" sounds worse than it is.

• It is not video of you, and it does not use your camera or microphone. Clarity saves the content of the page you were shown along with your mouse movements, clicks, taps and scrolling, then replays them as an animation. What we watch is a reconstruction of the page, not a recording of you.
• Clarity masks what you type into form fields by default, and we have not turned that off. We do not use it to capture anything you enter.
• It does not run on the checkout. Shopify's checkout is sealed off from third-party code, so a recording ends at the moment you go to pay. We cannot see anything you do on the payment pages.
• Microsoft keeps recordings for 30 days. If one of them shows a problem we are trying to fix, we can flag it, which keeps it for up to 13 months.

We use this to find things that are broken or confusing — a button people tap that isn't actually a button, a section nobody scrolls to, a form that trips people up. We are not trying to identify you, and we do not attempt to link recordings to your name or your order.

4. Cookies and similar technologies

Necessary cookies keep your basket working and connect your basket to Shopify's checkout (_shopify_y and _shopify_s). The site cannot function without these — if you block them, you will not be able to check out.

Analytics and advertising cookies come from the Meta Pixel and from Microsoft Clarity. These tell us how many people arrive from a particular advert and what they do once they are here.

A random identifier is stored in your browser the first time you visit, and sent to Meta alongside those events. It is a string of random characters. It is not built from your name, your email address or anything else about you, and on its own it tells nobody who you are — its only purpose is to let us see that the same browser looked at a product and later bought it, rather than counting that as two unrelated strangers.

You can clear or block cookies in your browser settings, and clearing your browsing data removes the identifier above as well. Most browsers' built-in tracking protection, and any ad blocker, will stop both the Meta Pixel and Clarity from loading at all.

5. Why we use your information

• To take payment, pack your order and deliver it.
• To handle returns, refunds and questions about an order.
• To find and fix problems on the website.
• To measure whether our adverts are working, so we are not wasting money on ones that aren't.
• To detect and prevent fraudulent orders.
• To meet our tax and company-law obligations.

6. Who we share it with

We do not sell your personal information. We share it only with the companies that make the shop work:

• Shopify — runs our product catalogue, basket, checkout and payments.
• Meta (Facebook and Instagram) — receives events from the Meta Pixel so we can measure our advertising.
• Microsoft — provides the Clarity session recordings and heatmaps described above.
• Google — our page fonts load from Google's servers, which means Google can see your IP address when a page loads.
• Our couriers — receive your name, delivery address and phone number, because otherwise they cannot deliver your parcel.

7. Information sent outside South Africa

Shopify, Meta, Microsoft and Google all process information on servers outside South Africa. POPIA allows this where the recipient is subject to laws or binding agreements that protect your information to a comparable standard, or where the transfer is necessary to perform the contract you have entered into with us. Each of these companies publishes its own privacy terms covering how it handles that data.

8. How long we keep it

• Order and invoice records — for as long as South African tax and company law requires us to keep them, which is at least five years.
• Session recordings — 30 days, or up to 13 months for a recording we have flagged to investigate a specific problem.
• Analytics and advertising data — for the retention periods set by Shopify, Meta and Microsoft on their own systems.

9. Your rights

Under POPIA you can:

• Ask us what personal information we hold about you.
• Ask us to correct anything that is wrong or out of date.
• Ask us to delete information we no longer have a reason to keep.
• Object to us processing your information for advertising measurement.
• Withdraw a consent you previously gave.
• Complain to the Information Regulator.

Email axcptemail@gmail.com to make any of these requests. We may ask you to confirm who you are first, so that we are not handing your information to someone else. Requests are free, and we will respond as soon as we reasonably can.

Note that we cannot delete information we are legally required to keep — an invoice for an order you actually placed, for example, has to stay on record for tax purposes.

10. Security

The whole site is served over HTTPS. Payments and card data are handled entirely by Shopify, which maintains PCI DSS Level 1 certification, the highest level in the card industry's security standard. Because we never receive card numbers, they cannot be exposed by a breach on our side.

11. Children

This shop is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, contact us and we will delete it.

12. Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. If a change is significant, we will say so on the site rather than quietly editing this page.

13. Complaints

Please contact us first — most things are quicker to sort out directly. If you are not satisfied with how we have handled it, you can complain to the Information Regulator of South Africa:

• Website: inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za (using POPIA Form 5, available on their website)
• General enquiries: enquiries@inforegulator.org.za · 010 023 5200
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

This policy describes our actual practices in plain language. It is not legal advice, and if your business circumstances change it is worth having it reviewed.