Privacy policy

Privacy Policy

Last updated: 21 September 2026

This policy explains what personal information Vasco Da Gama Peri Peri (Pty) Ltd (registration number 2013/119496/07) collects when you use https://vascodagamaperiperi.com or buy from us, why we collect it, who we share it with and what your rights are. We are the "responsible party" under the Protection of Personal Information Act 4 of 2013 (POPIA). Our address is Unit 10, 240 Vonkprop Road, Samcor Park, Pretoria, Gauteng 0184. Questions about privacy can be sent to our Information Officer at office@vascodagamaperiperi.com or +27 71 342 8860.

1. What we collect

Order details: your name, delivery and billing address, email address, phone number, what you bought and your order history.
Business details for trade customers: business name, VAT number, contact person and trading address, so that we can issue correct tax invoices.
Payment details: card payments are processed by Yoco. We never see or store your full card number. For EFT payments we see the account name and reference on our bank statement.
Communications: emails, WhatsApp or phone messages, complaints and product feedback, including photos and batch numbers you send us about an order.
Website data: IP address, device and browser type, pages viewed and how you arrived at the site, collected through cookies and similar tools (see section 6).
Marketing preferences: whether you have agreed to receive our emails and whether you have unsubscribed.

We do not intentionally collect special personal information (such as health information). If you tell us about an allergy or a reaction to a product as part of a complaint, we record only what we need to investigate and respond, and we treat it as confidential.

2. Why we use it and our lawful basis

To fulfil your order - process payment, pack and deliver goods, issue tax invoices and handle returns. This is necessary to perform our contract with you.
To meet legal obligations - keep tax and accounting records, respond to lawful requests, and keep food-safety traceability records so that we can contact you in the event of a product recall.
To run and protect our business - prevent fraud, keep the website secure, and improve our products and service. This is in our legitimate interest and does not override your rights.
To send marketing emails - only with your consent, or where you are an existing customer and we are telling you about similar products, in which case every email includes an unsubscribe link (section 69 of POPIA).

3. Who we share it with

We use trusted service providers ("operators" under POPIA) who process information on our instructions and under written terms that require them to keep it secure:

Shopify - hosts our online store and stores order and customer records.
Yoco - processes card payments.
Bob Go and the courier companies it books - receive your name, address and phone number to deliver your parcel and send tracking updates.
Brevo - sends our marketing and order emails and records opens, clicks and unsubscribes.
Google Analytics and Meta (Facebook) Pixel - measure website traffic and the performance of our advertising (see section 6).
Our accountants, bank and email provider - as needed to run the business.

We may also share information where the law requires it, for example with SARS, a regulator or a court, or with the Department of Health or the National Consumer Commission in a product recall. We do not sell your personal information.

4. Transfers outside South Africa

Some of our providers (Shopify, Brevo, Google and Meta) store data on servers outside South Africa. Where this happens, we rely on the provider being bound by contractual terms or laws that give substantially similar protection to POPIA, as section 72 of POPIA requires.

5. How long we keep it

Order, invoice and payment records: at least 5 years after the transaction, as tax and company law require.
Food-safety complaint and traceability records: for the shelf life of the product plus a reasonable period after, so that we can investigate any issue and cooperate with a recall.
Marketing data: until you unsubscribe or ask us to remove you, after which we keep only a record that you opted out.
Website analytics: according to the retention settings of Google Analytics and Meta, which we keep to the shortest practical period.

When we no longer need information we delete it or remove anything that identifies you.

6. Cookies and analytics

Our site uses cookies that are necessary for the shop to work (for example, your cart and checkout session) and, with your agreement, analytics and advertising cookies from Google Analytics and Meta Pixel. These tell us which pages are popular, where visitors come from and whether our adverts lead to sales. They may set identifiers that Google and Meta use across sites. You can refuse non-essential cookies in the cookie banner, change your choice at any time, or block cookies in your browser. Blocking necessary cookies may stop checkout from working.

7. Security

We use reasonable technical and organisational measures to protect your information, including encrypted (HTTPS) connections, access controls and reputable providers. Card details are handled entirely by Yoco. If we become aware of a security breach that affects your personal information, we will notify you and the Information Regulator as POPIA requires.

8. Your rights

Under POPIA you may:

ask what personal information we hold about you and receive a copy;
ask us to correct or delete information that is inaccurate, out of date or no longer needed;
object to processing based on our legitimate interests;
withdraw consent to marketing at any time by clicking unsubscribe in any email or emailing us;
complain to the Information Regulator if you are unhappy with how we handle your information.

To exercise these rights, email office@vascodagamaperiperi.com. We may ask you to confirm your identity first. We will respond within a reasonable time and, where the law sets a period, within that period. We cannot delete records we are legally required to keep, such as tax invoices, but we will tell you if that applies.

The Information Regulator (South Africa) can be contacted at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, by email at POPIAComplaints@inforegulator.org.za, or via https://inforegulator.org.za.

9. Children

Our website and products are intended for adults. We do not knowingly collect personal information from children under 18. If you believe a child has given us information, please contact us and we will remove it.