Privacy Policy
Comprehensive information on how Living Culture Health collects, uses, safeguards, and processes personal data under POPIA (Protection of Personal Information Act No. 4 of 2013), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA/CPRA).
1. Overview & Information Officer Details
Living Culture Health ('we', 'us', 'our') operates a Pan-African multivendor heritage marketplace and cultural experiences directory across all 54 African member states and international diaspora. We are committed to protecting the privacy, dignity, and personal autonomy of all buyers, artisans, cultural hosts, and platform visitors.
Our designated Information Officer under the South African Protection of Personal Information Act (POPIA) and Data Protection Officer (DPO) under the EU GDPR can be contacted directly at privacy@livingculturehealth.com or at our headquarters: Living Culture Health, 100 Grayston Drive, Sandton, Johannesburg, 2196, South Africa.
2. Personal Information Collected
We collect personal information that you provide voluntarily or that is gathered automatically through your use of our platform:
Account & Profile Information
Full name, email address, password hash, telephone/WhatsApp number, preferred language, African region/country of residence, and store details if registered as a seller.
Order, Shipping & Billing Data
Delivery street address, postal code, recipient contact phone, Pudo smart locker selection, order history, and payment status. Full credit card data is securely tokenized through PCI-DSS Level 1 payment processors (PayFast/Stripe) and never stored on our servers.
Device, Browser & Technical Log Information
IP address, browser type and version, operating system, referrer URL, pages visited, timestamp of access, and session analytics.
AI Features & Antigravity Assistant Interactions
Search queries, cultural interest preferences, and conversational prompts submitted to our AI assistant to suggest authentic remedies, regional recipes, or festival schedules. Prompts are processed strictly to serve recommendations and are not sold to third-party data brokers.
Social Media Integrations (Facebook / Meta & TikTok)
When you connect via Facebook Login or TikTok Login, we receive basic profile info (such as your public name, email, and social user identifier) in accordance with the permissions you grant. You can revoke access or delete this data at any time via our dedicated deletion tools.
3. Legal Bases & Purposes for Processing
We process your personal information strictly for legitimate commercial and legal purposes:
• Contractual Performance: Processing orders, dispatching couriers (The Courier Guy / Pudo), managing bookings, and processing refunds.
• Legitimate Business Interests: Protecting our marketplace against fraud, safeguarding verified CIPC vendor documentation, improving UI/UX performance, and providing real-time customer support.
• Legal & Statutory Obligations: Complying with South African Revenue Service (SARS) tax auditing, anti-money laundering regulations, and POPIA statutory records retention.
• Explicit Consent: Sending optional cultural newsletters, promotional SMS alerts, or personalized regional event notifications.
4. International Cross-Border Data Transfers
Because we operate across 54 African countries and international shipping lanes, your data may be transferred to and processed in cloud data centers located in South Africa, the European Union, and Google Cloud secure regions. All international data transfers adhere to POPIA Section 72 and GDPR Chapter V Standard Contractual Clauses (SCCs), ensuring an adequate level of data protection.
5. Data Retention & Security Safeguards
We retain your personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable tax, commercial, and financial laws (typically 5 to 7 years for financial transactions).
We implement industry-grade technical and organizational safeguards including 256-bit TLS/SSL encryption in transit, AES-256 database encryption at rest, strict Role-Based Access Control (RBAC), multi-factor authentication for administrative staff, and regular vulnerability audits.
6. Your Statutory Rights (POPIA, GDPR, CCPA/CPRA)
Under applicable data protection laws, you possess fundamental rights regarding your personal information:
• Right to Access: Request a copy of all personal records we hold about you.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure / Deletion: Request permanent deletion of your account and personal records ('Right to be Forgotten').
• Right to Object & Restrict: Object to direct marketing or request limitation of processing.
• Right to Data Portability: Receive your personal data in a structured, machine-readable JSON/CSV format.
• Right to Lodge a Complaint: Lodge a complaint with the South African Information Regulator (inforeg@justice.gov.za) or your national Data Protection Authority.
7. Children's Privacy
Our platform is intended for users aged 18 and older. We do not knowingly collect or solicit personal data from children under 16 without verified parental or legal guardian consent.
8. Contact & Escalations
To exercise any of your privacy rights, please use our automated tools (/data-deletion, /data-access, /data-correction) or email our Data Privacy Officer at privacy@livingculturehealth.com. We respond to all verified requests within 30 calendar days.