Privacy policy.

This policy applies to personal information processed by SAGA through this website, customer accounts, checkout, order fulfilment, customer support, marketing communications and related online services.

“Personal information” has the meaning given to it under POPIA and includes information that identifies or can reasonably be linked to an identifiable person and, where applicable under the Act, an identifiable juristic person.

This policy should be read with our Terms & Conditions, Returns & Refunds Policy and Shipping & Delivery Policy.

Depending on how you interact with SAGA, we may collect the following categories of personal information:

• identity and contact information, such as your name, email address and mobile number;
• delivery information, including street address, suburb, city, province, postal code and delivery instructions you provide;
• account information, such as your account identifier, login email and authentication/session information;
• order information, including products ordered, quantities, prices, delivery method, order status and order history;
• payment-related information such as payment provider, payment status and provider transaction/reference identifiers;
• customer-service information, including messages, return requests, complaints and supporting photographs you send us;
• marketing preferences and newsletter subscription status;
• technical information such as IP address, browser/device information, session data and security logs where generated by the website or authentication systems; and
• website/cart information stored through cookies or browser storage as described below.

SAGA does not need to receive or store your full payment-card details on its own servers where checkout is handled by a third-party payment provider.

We collect personal information directly from you when you create an account, place an order, enter a delivery address, subscribe to communications, contact customer care, request a return or otherwise provide information through the website.

Some information is collected automatically when you use the website, for example session identifiers, IP address, browser or device information, security records and local cart information.

We may also receive limited information from service providers, such as confirmation from a payment provider that a payment has succeeded, failed or been refunded, or delivery-status information from a courier.

SAGA processes personal information only for defined and lawful purposes connected with operating the business and website. These purposes may include:

• creating and managing customer accounts;
• processing, verifying and fulfilling orders;
• calculating and arranging delivery;
• confirming and reconciling payments and refunds;
• providing customer support and responding to enquiries;
• handling returns, complaints and product issues;
• preventing fraud, abuse and unauthorised access;
• maintaining website security and reliability;
• keeping transaction and accounting records;
• complying with legal and regulatory obligations;
• sending marketing communications where permitted by law and your communication preferences; and
• improving SAGA’s website, products and customer experience using information that is appropriate for that purpose.

POPIA does not require every processing activity to rely on consent. Depending on the circumstances, SAGA may process personal information because you consented, because it is necessary to perform or take steps relating to a contract with you, because a legal obligation applies, or because another lawful basis permitted by POPIA applies.

Where consent is the basis for processing, you may withdraw that consent subject to applicable law and provided that withdrawal does not affect processing that was already lawful before the withdrawal.

If certain information is required to process an order or provide a requested service and you do not provide it, we may be unable to complete the transaction or service.

SAGA uses third-party payment providers to process customer payments. Depending on which providers are enabled, these may include PayFast, Payflex or another approved payment service.

When you choose a payment provider, information necessary to start and reconcile the payment may be shared with that provider, such as your name, email address, mobile number, billing or delivery information, order amount and SAGA order reference.

The provider may collect payment credentials directly from you on its own hosted or secure payment service. Its own privacy policy and terms will apply to that processing.

SAGA may retain payment-provider identifiers, status information and transaction references for reconciliation, fraud prevention, refunds, accounting and customer support. We do not treat a browser redirect alone as proof that payment succeeded.

To fulfil an order, SAGA may provide a courier or delivery provider with the information reasonably necessary to perform delivery. This can include the recipient’s name, mobile number, delivery address, delivery instructions and order reference.

Delivery providers may process that information under their own legal obligations and privacy practices. We aim to share only the information reasonably required for fulfilment and delivery.

Where you create a SAGA account, authentication information is used to sign you in securely, maintain sessions and associate your account with relevant orders or account activity.

Authentication systems may record session identifiers, expiry times, IP address and browser/device information for account security and fraud prevention.

Passwords should never be stored by SAGA as readable plain text. Authentication credentials are handled through the website’s authentication system using appropriate security mechanisms.

You can also sign in with Google. If you do, Google shares your name, email address and profile image with SAGA so we can create or link your account. We do not receive your Google password. Google processes that sign-in under its own privacy policy. If the Google email matches a verified SAGA account, the sign-in is linked to that existing account.

SAGA may use cookies and similar technologies that are necessary for website operation, account authentication, session security, cart functionality and remembering certain preferences.

The current SAGA cart stores limited cart information in your browser’s local storage, such as product identifiers and quantities. The browser cart is not treated as the authoritative source of product pricing or payment totals; those values are recalculated securely by the server during checkout.

Where SAGA introduces non-essential analytics, advertising or marketing cookies, we will implement an appropriate notice and consent or preference mechanism where required.

You can control cookies through your browser settings, although disabling essential cookies or storage may prevent parts of the website, such as sign-in or cart functionality, from working correctly.

We may send service communications that are necessary for your order or account, such as order confirmations, payment updates, delivery notifications, security messages and responses to customer-service enquiries.

Promotional email, SMS, WhatsApp or other electronic direct marketing will be handled in accordance with POPIA and applicable consumer law. Where consent is required, SAGA will request it in the required manner.

You may opt out of direct marketing at any time using the unsubscribe mechanism provided in the communication or by contacting SAGA. We will not charge you a fee merely to exercise an opt-out right.

Opting out of promotional marketing does not prevent us from sending transactional or service-related messages necessary for an order, account or legal obligation.

SAGA does not sell customer personal information to advertisers. We may disclose or make information available to carefully selected service providers where reasonably necessary for the purposes described in this policy.

These may include:

• payment providers and financial-service processors;
• couriers and fulfilment providers;
• website hosting, infrastructure and database providers;
• authentication and security-service providers;
• email or communications providers;
• professional advisers such as accountants or legal advisers;
• regulators, law-enforcement bodies or courts where disclosure is legally required or permitted; and
• a purchaser or successor in the event of a lawful sale, restructuring or transfer of the SAGA business, subject to applicable privacy obligations.

Where a service provider processes personal information on SAGA’s behalf as an operator, SAGA will take reasonable steps to require appropriate confidentiality and security safeguards.

Some service providers used for hosting, authentication, communications, payments, security or other infrastructure may process or store information outside South Africa.

Where personal information is transferred outside South Africa, SAGA will do so only where a basis permitted by POPIA applies, including appropriate legal protections, binding agreements, consent where required, or another basis recognised by section 72 of POPIA.

SAGA keeps personal information only for as long as reasonably necessary for the purpose for which it was collected or for a longer period where retention is required or permitted by law.

Different information may have different retention periods. Transaction and accounting records may need to be retained for legal, tax, audit, warranty, fraud-prevention or dispute purposes even after an account is closed.

Where information is no longer required and no lawful reason exists to retain it, SAGA will take reasonable steps to delete, destroy or de-identify it in a manner appropriate to the information.

SAGA takes reasonable technical and organisational measures designed to protect the integrity and confidentiality of personal information against loss, misuse, unauthorised access, unlawful processing, alteration or disclosure.

Depending on the system, these measures may include restricted administrative access, authenticated staff access, encrypted network connections, secure password handling, server-side validation, payment-provider hosted checkout, access controls, audit or security logging, database protections and separation of production secrets from public website code.

No internet-based system is completely risk-free. You should also protect your account by using a strong password, keeping login credentials private and signing out on shared devices.

If SAGA has reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate, take appropriate containment and remediation steps, and handle required notifications in accordance with POPIA.

Where required, this includes notifying the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful restriction on the timing of notification.

Subject to POPIA and other applicable law, you may have the right to:

• ask whether SAGA holds personal information about you and request access to it;
• ask us to correct or update inaccurate, incomplete, outdated or misleading information;
• request deletion or destruction of information where the legal requirements for deletion are met;
• object to certain processing on reasonable grounds where POPIA permits an objection;
• withdraw consent where processing is based on consent;
• object to or opt out of direct marketing as provided by law;
• complain to SAGA about the way your information has been processed; and
• lodge a complaint with the Information Regulator where you believe your POPIA rights have been infringed.

We may need to verify your identity before providing access to personal information or making certain account-level changes. Some information may lawfully be retained despite a deletion request, for example where retention is necessary to comply with another law or to establish, exercise or defend a legal claim.

SAGA’s online store is intended for adults who have legal capacity to transact, or for use with the involvement of a parent or legal guardian where appropriate.

We do not intentionally seek to collect children’s personal information for independent commercial profiles. Where POPIA requires the consent of a competent person for processing a child’s personal information, SAGA will not knowingly bypass that requirement.

Our website may link or redirect you to payment providers, social platforms, courier tracking pages or other third-party websites. Once you interact directly with those services, their own privacy notices and terms may apply.

SAGA is not responsible for the privacy practices of unrelated third parties that operate independently of SAGA. We encourage you to review their privacy information before providing personal information directly to them.

We may update this policy when SAGA’s services, technology, payment providers, legal obligations or privacy practices change.

The current version will be published on this page with an updated revision date. Where a change materially affects how personal information is processed, we will take any additional notification or consent steps required by law.

If you want to request access, correction or deletion, object to processing, withdraw marketing consent, ask a privacy question or make a privacy complaint, contact the Information Officer using the details below.

You may also contact the Information Regulator (South Africa) if you believe your personal information has been processed in a manner that infringes POPIA.