Privacy & POPIA notice

Vora Water ("Vora", "we", "us") sells and delivers still natural spring water in South Africa through drinkvora.co.za. We are the responsible party for the personal information described in this notice. Vora is in the process of being registered as a company; the registered name and registration number will be published here once registration is complete.

Address: 40 Augrabies Street, Mooikloof, Pretoria, Gauteng, South Africa.

Information Officer: Sheldon — hello@drinkvora.co.za. Please mark your message "Information Officer — POPIA".

• Account details — name, email address and password (stored only as a secure hash). Purpose: to create and secure your account.
• Delivery details — delivery address, contact name, phone number and delivery notes. Purpose: to fulfil your subscription deliveries.
• Subscription details — bottle format, quantity, delivery interval and status. Purpose: to schedule and manage your orders.
• Enquiries — anything you send us through the contact form or by email. Purpose: to answer you.
• Technical data — essential session data needed to keep you signed in and to keep the site secure.

We collect information directly from you. We do not sell personal information, and we do not use it for automated decision-making or profiling.

We process your information because it is necessary to conclude and perform our contract with you (delivering the water you order) and to comply with legal obligations such as tax record-keeping. Where we ask for consent — for example on the enquiry form — you may withdraw it at any time without affecting deliveries you have already ordered.

We do not send marketing or promotional emails. You will only receive messages relating to your account and your deliveries.

Providing delivery information is voluntary, but we cannot deliver an order without it.

We share personal information only with service providers who help us run the site and deliver orders, under confidentiality obligations: our website and database hosting provider, our email provider, and the courier or delivery partner handling your parcel. We may also disclose information where the law requires it.

Our hosting and database infrastructure may store data on servers outside South Africa. Where information is transferred cross-border, it is protected by the provider's contractual safeguards and security standards, as permitted by section 72 of POPIA.

Account and subscription records are kept for as long as your account is active, and afterwards only as long as needed for legal, tax and accounting purposes (generally five years, as required by South African tax law). Enquiry emails are kept for up to two years. After that, records are deleted or de-identified.

We apply reasonable technical and organisational measures as required by section 19 of POPIA, including: encrypted connections (HTTPS/TLS) across the whole site, passwords stored only as salted hashes, row-level database rules so each customer can access only their own records, an administrator area restricted to a fixed allow-list of approved staff accounts, and least-privilege access to backend systems.

No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

Under POPIA you have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct or update information that is wrong or incomplete;
• ask us to delete information that is no longer needed, or that we are not allowed to keep;
• object to processing, and opt out of direct marketing at any time;
• complain to the Information Regulator.

You can update your own details and cancel a subscription yourself from your deliveries dashboard, or email hello@drinkvora.co.za. We respond to requests within 30 days.

Requests for access to records under the Promotion of Access to Information Act 2 of 2000 may be sent to our Information Officer at hello@drinkvora.co.za. We will respond within the periods set out in PAIA and may charge the prescribed fee for copies.

We use strictly necessary storage only: a session token so you stay signed in, and a record of your cookie choice. These are required for the site to work and cannot be switched off. We do not run advertising or cross-site tracking cookies. If we ever add analytics or marketing cookies, we will ask for your consent first through the banner.

The site is intended for people aged 18 and over. We do not knowingly collect personal information from children without the consent of a competent person, and will delete it if we learn that we have.

Please contact us first so we can put things right. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg — complaints.IR@inforegulator.org.za.

We may update this notice as our services change. The date at the top reflects the current version, and material changes will be communicated by email or on the site.