ASTERIA LIFESTYLE

PRIVACY POLICY

Last updated: 14 September 2026

Asteria Lifestyle respects your privacy and processes personal information in accordance with applicable South African law, including the Protection of Personal Information Act, 2013 (“POPIA”). This policy explains what we collect, why we use it, who may receive it, and your choices.

1. RESPONSIBLE PARTY

The responsible party for this website and online store is:

Trading name: Asteria Lifestyle

Legal entity: Asteria Pharmaceuticals (Pty) Ltd

Registration number: 2016/347798/07

Address: 17 Midas Avenue, Olympus Boulevard Office Park, 

1^st Floor Heartsease Building, Asteria House, 

Olympus A.H, 0081

Email: sales@asteriasa.co.za

Telephone: 012 998 4486

Information Officer: Elmarie Cloete

Privacy/Information Officer email: Elmarie Cloete

2. SCOPE

This policy applies when you visit www.asterialifestyle.co.za, use the online store, create an account, place an order, contact us, subscribe to marketing, submit a review, or complete a skin quiz or recommendation form.

Separate privacy terms may apply to third-party services linked from the website.

3. INFORMATION WE COLLECT

Depending on how you interact with us, we may collect:

• identity and contact details, such as name, email, telephone number, delivery and billing addresses;
• account details and login information;
• order, transaction, delivery, returns and customer-service records;
• payment status, method and transaction references (complete card details are submitted directly to the payment provider);
• communications, reviews, survey responses and marketing preferences;
• device and usage information, such as IP address, browser, device type, pages visited, referring source, timestamps and cookie identifiers;
• information voluntarily submitted through a skin quiz or recommendation form, such as skin type, concerns, sensitivities, goals, routine and product preferences;
• limited health or lifestyle information you choose to provide in connection with wellness or supplement enquiries; and
• fraud-prevention, security and consent records.

Please do not send medical records or other information that is not necessary for your enquiry. Skin-quiz information is used to make general product recommendations and is not used to diagnose or treat a medical condition.

4. HOW WE COLLECT INFORMATION

We collect information directly from you, automatically through the website and cookies, and from service providers involved in transactions, fraud prevention, communications, analytics and delivery. We may also receive information lawfully from a person placing an order on your behalf.

5. PURPOSES OF PROCESSING

We use personal information to:

• provide the website, account and online-store functions;
• process payment, fulfil and deliver orders, and manage returns or refunds;
• respond to enquiries, complaints and support requests;
• provide requested product recommendations and improve our product range;
• send service messages, order updates and, where permitted, marketing communications;
• secure the website, prevent fraud and enforce our terms;
• analyse performance and improve user experience;
• meet tax, accounting, product-safety and other legal obligations; and
• establish, exercise or defend legal claims.

6. LAWFUL JUSTIFICATION

Depending on the circumstances, processing is necessary to perform a contract, comply with law, pursue a legitimate interest that does not unjustifiably infringe your rights, or act with your consent.

Where skin-quiz or enquiry responses reveal health-related information, we will process that information only where permitted by law and, where required, with your express consent. You may withdraw consent, but this does not affect processing already lawfully completed.

7. PAYMENT INFORMATION

Online payments are processed through Netcash. Payflex may be available as a separate payment option, subject to its own terms and privacy practices. PayJustNow

Payment providers may collect card, bank, identity, device and fraud-prevention information directly. Asteria Lifestyle receives limited transaction details such as payment status, amount and reference, but does not receive or store complete card credentials entered into a provider’s secure payment interface.

8. WEBSITE, STORE AND OTHER SERVICE PROVIDERS

The website and store use Duda and Ecwid technologies. We may also use:

• Netcash and Payflex for payments;
• courier and fulfilment providers;
• email, newsletter and customer-support services;
• hosting, security, backup and IT support;
• analytics, advertising and social-media services; and
• professional advisers, auditors and authorities where required.

[CLIENT TO CONFIRM: complete supplier list, including analytics, advertising pixels, newsletter platform, courier and CRM.]

Providers may process information only for the services they supply, subject to contracts, their own legal obligations and appropriate safeguards.

9. COOKIES AND SIMILAR TECHNOLOGIES

Cookies help the website and store function, remember preferences, protect sessions, measure performance and, where enabled, support marketing.

Essential cookies may operate because they are necessary for requested services. Non-essential analytics or advertising cookies should be used in line with the consent choices presented on the website. You can change browser settings or use any available consent tool, although blocking essential cookies may affect checkout and account functions.

Cookie and tracking technologies currently enabled: [CLIENT TO CONFIRM after cookie scan, including retention periods and providers].

10. MARKETING

We may send marketing where you have consented or where another lawful basis permits it. Each electronic marketing message will include a reasonable way to opt out. You may also unsubscribe by contacting sales@asteriasa.co.za.

Service communications about an order, account, security or requested support are not marketing and may still be sent when necessary.

11. SHARING

We may share information with service providers and recipients described in this policy where necessary for the stated purposes. We do not sell personal information.

We may disclose information where required by law, to protect rights or safety, in connection with a business reorganisation, or with your direction or consent.

12. CROSS-BORDER PROCESSING

Some platform, cloud, payment, analytics or communications providers may process information outside South Africa. Where this occurs, we will use a lawful transfer mechanism and reasonable contractual, technical or organisational safeguards as required by POPIA.

[CLIENT TO CONFIRM: countries or regions used by key service providers and the relevant transfer safeguards.]

13. RETENTION

We retain personal information only as long as reasonably necessary for the purpose collected, contractual and customer-service needs, legal obligations, dispute resolution and security.

Proposed retention schedule:

· Transaction, tax, accounting and financial records: 7 years, or longer where required by applicable law, an audit, investigation, objection, appeal or other legal requirement. The Tax Administration Act generally requires relevant tax records to be retained for 5 years, while section 24 of the Companies Act 71 of 2008 requires company records covered by that section to generally be retained for 7 years. Accordingly, a 7-year company retention period is a prudent overarching period for these records.

· VAT records and supporting documentation: 5 years, subject to any longer applicable statutory requirement, audit, investigation, objection or appeal. SARS specifically states that VAT vendors must retain relevant VAT records for 5 years. 

· Account, customer-service, order and contractual records: 7 years after the end of the customer relationship or completion of the relevant transaction, unless a longer period is required or permitted by law, necessary for the establishment, exercise or defense of a legal claim, or required in relation to a dispute, investigation or audit. 

· Skin-quiz responses and other treatment-related information: For as long as reasonably necessary for the purpose for which the information was collected and, where the information constitutes health or other special personal information, subject to the enhanced requirements applicable under POPIA. Where the information forms part of a patient's clinical/medical record, the applicable professional and healthcare-record retention requirements will apply.

· Marketing records: retained for as long as reasonably necessary to administer the marketing relationship and demonstrate compliance with applicable direct-marketing requirements. Where a person opts out, their details may be retained on a suppression/do-not-contact list for the purpose of ensuring that their preference is respected. 

· Website, technical, security and cookie logs: retained for the period reasonably necessary for website operation, cybersecurity, fraud prevention, troubleshooting, analytics and legal/compliance purposes, generally up to 12–24 months, unless a longer period is required or reasonably necessary for a specific investigation, security incident, dispute or legal obligation. 

· Complaints, disputes and legal claims: retained for as long as reasonably necessary to investigate, resolve and/or defend the complaint, dispute or claim and thereafter for the applicable statutory or limitation period, including any period required to preserve evidence for pending or reasonably anticipated legal proceedings. We securely delete, anonymize or restrict information when retention is no longer justified.

14. SECURITY

We use reasonable technical and organisational measures designed to protect personal information against loss, unauthorised access, interference, alteration or disclosure. No internet service is completely secure, and users should protect passwords and devices.

If a security compromise creates a notification obligation, we will notify the Information Regulator and affected data subjects as required by law.

15. YOUR RIGHTS

Subject to POPIA and applicable exceptions, you may ask whether we hold your personal information, request access, request correction or deletion, object to certain processing, withdraw consent, or lodge a complaint.

We may need to verify your identity. Some records cannot be deleted immediately where law requires retention or they are needed for a lawful purpose.

16. CHILDREN

The online store is intended for adults. A person under 18 should use it only with the involvement of a parent or legal guardian. We do not knowingly request special personal information about a child without appropriate authorisation. Contact us if you believe a child has submitted information improperly.

17. THIRD-PARTY LINKS

The website may link to brands, social networks or other third-party sites. We do not control their privacy practices. Review their notices before providing information.

18. CHANGES TO THIS POLICY

We may update this policy when our services, technology or legal duties change. The current version and “Last updated” date will be published on the website. Material changes may also be communicated through an appropriate channel.

19. CONTACT AND COMPLAINTS

For privacy requests or complaints:

Asteria Lifestyle

Privacy email: sales@asteriasa.co.za

Telephone: 012 998 4486

Address: 17 Midas Avenue, Olympus Boulevard Office Park, 

1^st Floor Heartsease Building, Asteria House, 

Olympus A.H, 0081

You may also complain to the Information Regulator (South Africa). Current contact information is available at www.inforegulator.org.za.