Privacy Policy
Last updated 22 September 2026
This policy explains what personal information Sphera collects, why we collect it, who we share it with and what rights you have over it. It is written to meet the notification requirements of section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA).
Who is responsible for your information
PLACEHOLDER: full registered company name, e.g. Sphera Mythos (Pty) Ltd (registration number PLACEHOLDER: CIPC registration number, format 2025/123456/07), trading as Sphera, is the responsible party for the personal information described in this policy. We are a private company registered in the Republic of South Africa.
| Detail | Value |
|---|---|
| Registered name | PLACEHOLDER: full registered company name, e.g. Sphera Mythos (Pty) Ltd |
| Registration number | PLACEHOLDER: CIPC registration number, format 2025/123456/07 |
| Physical address | PLACEHOLDER: street address, PLACEHOLDER: city, PLACEHOLDER: province, PLACEHOLDER: postal code, South Africa |
| Information Officer | PLACEHOLDER: full name of the designated Information Officer |
| Privacy contact | tragedyman@welkinstone.co.za |
What personal information we collect
We collect different information depending on how you use the site. We do not collect more than we need for the purpose we collected it for.
| Where it comes from | What we collect |
|---|---|
| Newsletter signup | Your email address, and the date and source of your subscription. |
| Contact form | Your name, email address, subject and the content of your message. |
| Placing an order | Your name, billing and delivery address, email address, telephone number, order contents and the edition number you buy. |
| Paying for an order | Payment is processed by Shopify and its payment providers. We receive confirmation that payment succeeded, and the card type and last four digits. We never receive or store your full card number. |
| Customer account | Your email address, password (stored by Shopify as a hash, never in readable form), saved addresses and order history. |
| Discord discount programme | The discount code issued to you, stored against your customer record so it can be applied automatically at checkout. |
| Using the site | Your IP address, browser and device type, pages viewed, referring site and interactions with the page. See our Cookie Policy. |
Why we process your information, and on what basis
POPIA requires a lawful justification for every purpose. Ours are set out below.
| Purpose | Justification under POPIA |
|---|---|
| Fulfilling and delivering your order, and handling returns | Necessary to carry out the contract of sale between you and us (section 11(1)(b)). |
| Answering an enquiry sent through the contact form | Necessary to take steps at your request, and our legitimate interest in responding to you (sections 11(1)(b) and 11(1)(f)). |
| Sending you marketing email about SPHERA | Your consent, given when you subscribed and withdrawable at any time (sections 11(1)(a) and 69). |
| Understanding how the site is used, so we can improve it | Your consent, given through the cookie banner (section 11(1)(a)). |
| Keeping tax and accounting records of sales | Compliance with an obligation of law, including the Tax Administration Act (section 11(1)(c)). |
| Detecting and preventing fraud and abuse of the site | Our legitimate interest in protecting the business and our customers (section 11(1)(f)). |
Supplying your name, address and payment details is voluntary, but we cannot accept or deliver an order without them. Everything else is optional, and refusing it does not affect your ability to buy.
Information sent outside South Africa
Several of the operators above are based outside South Africa: Shopify in Canada, Klaviyo, Resend and Vercel in the United States, and PostHog in the European Union.
Section 72 of POPIA permits a transfer outside the Republic where the recipient is subject to a law, binding agreement or binding corporate rules providing a level of protection substantially similar to POPIA, or where the transfer is necessary to perform a contract with you. We rely on contractual data-protection terms with each operator, and on necessity where the transfer is required to fulfil your order.
Marketing email
We only send marketing email to people who asked for it, or to customers about products similar to ones they have already bought, as section 69(3) of POPIA allows.
Every marketing email carries an unsubscribe link, and unsubscribing takes effect immediately. You can also write to us at the privacy address below. Withdrawing consent does not stop transactional messages about an order you have placed — order confirmations, delivery notifications and refund notices are part of the sale, not marketing.
A message sent through the contact form does not subscribe you to anything. Support enquiries are never added to the marketing list.
How long we keep it
| Information | Retention period |
|---|---|
| Order and tax records | Five years from the end of the tax year, as required by the Tax Administration Act. |
| Customer account | Until you ask us to close it, after which we keep only what the tax record above requires. |
| Newsletter subscription | Until you unsubscribe, after which your address is suppressed so that we do not re-add you. |
| Contact-form messages | Two years from the date the enquiry is resolved. |
| Analytics data | Retained by PostHog for twelve months, then deleted. |
Section 14 of POPIA requires us to delete or de-identify personal information once we no longer have a purpose for it, unless a law requires us to keep it.
How we protect it
The site is served only over HTTPS. Payment card data never reaches our systems; it is handled by Shopify and its PCI-DSS compliant payment providers. Access to customer records is limited to people who need it, and administrative access is protected by multi-factor authentication.
If personal information under our control is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and, where we can identify you, to notify you as soon as reasonably possible.
Your rights
Under POPIA you have the right to:
- Ask whether we hold personal information about you, and ask for a copy of it (section 23).
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
- Object, on reasonable grounds, to our processing of your information on legitimate-interest grounds (section 11(3)).
- Withdraw consent you have given, at any time, without affecting processing that already took place.
- Object at any time to your information being used for direct marketing.
- Not be subject to a decision based solely on automated processing that has legal consequences for you (section 71). We make no such decisions.
- Complain to the Information Regulator, and to approach a court.
To exercise any of these, write to tragedyman@welkinstone.co.za. We will respond within a reasonable period, and will ask you to verify your identity first so that we do not disclose your information to someone else. A request for access made under the Promotion of Access to Information Act may attract the prescribed fee.
Complaints
If you are unhappy with how we have handled your personal information, please raise it with us first at tragedyman@welkinstone.co.za so that we have a chance to put it right.
You may also complain directly to the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za, or through https://inforegulator.org.za.
Children
The site is not aimed at children, and we do not knowingly collect the personal information of a child under 18 without the consent of a competent person, as section 35 of POPIA requires. If you believe a child has given us personal information, write to us and we will delete it.
Changes to this policy
We update this policy when our processing changes. The date at the top shows when it was last amended. Where a change materially affects your rights, we will tell subscribers by email before it takes effect.
Questions about this policy can go to hello@spheramythos.com.