Privacy Policy / POPIA

Effective Date: 26 September 2026
Last Updated: 4 October 2026

1. Introduction

SUSTA (Pty) Ltd (“SUSTA”, “we”, “us” or “our”) respects the privacy of persons whose personal information we process.

This Privacy Policy explains how SUSTA collects, uses, stores, protects and otherwise processes personal information when you visit our website, communicate with us, create an account, place an order, purchase our products, subscribe to communications or otherwise interact with SUSTA.

SUSTA processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

This Privacy Policy should be read together with SUSTA’s Website Terms & Conditions, PAIA Manual, and other applicable website policies.

2. Responsible Party

SUSTA (Pty) Ltd

Registration Number: 2026/707252/07
Registered Office: 14A Luttig Street, Middelburg, Mpumalanga, 1050, South Africa
Telephone: 083 388 2616 / 076 124 2023
General Email: hello@susta.co.za
Information Officer: N.A. du Randt
Information Officer Email: management@susta.co.za
Information Regulator Registration Number: 2026-067686

SUSTA is the responsible party for personal information processed by SUSTA for its own purposes.

3. Information We Collect

Depending on how you interact with SUSTA, we may collect the following categories of personal information:

3.1 Identity and Contact Information

Name and surname
Email address
Telephone or mobile number
Billing and delivery address
Other contact information you provide to us

3.2 Order and Transaction Information

Products purchased
Order details
Delivery information
Returns, refunds and exchanges
Transaction and payment-related information
Correspondence relating to orders or purchases

Where payment is processed through an external payment service provider, that provider may process payment information in accordance with its own privacy terms and applicable law. SUSTA may receive information such as payment status, transaction references and related information necessary to process and reconcile an order.

3.3 Account Information

Where website accounts are available, we may process:

Account login details
Account information
Order history
Saved preferences
Information you provide through your account

3.4 Communications

We may process information contained in:

Emails
Website enquiries
Customer-service communications
Complaints
Feedback
Other communications sent to SUSTA

3.5 Marketing Information

Where applicable, we may process:

Marketing preferences
Newsletter or mailing-list subscriptions
Records of marketing communications
Your responses to marketing communications

3.6 Website and Technical Information

When you use our website, certain technical information may be collected automatically, depending on the website functions and technologies in use, including:

IP address
Browser and device information
Operating system
Website usage information
Security and diagnostic information
Cookie and similar technology information

4. How We Collect Personal Information

SUSTA may collect personal information:

Directly from you when you place an order or submit information through our website
When you create or use an account
When you contact us
When you subscribe to communications
When you communicate with us through other channels
Automatically through website technologies such as cookies, where applicable
From service providers where lawful and necessary for the relevant purpose
From publicly available sources where permitted by law

Where POPIA requires personal information to be collected directly from the data subject, SUSTA will do so unless a lawful exception applies. POPIA generally requires collection directly from the data subject, subject to specified exceptions.

Provision of personal information is generally voluntary, but certain information may be necessary to create an account, process an order, make payment, deliver products, respond to an enquiry or comply with a legal obligation. If required information is not provided, SUSTA may be unable to provide the relevant product, service or functionality.

Where personal information is collected from a source other than the data subject, SUSTA will, where required by POPIA, take reasonably practicable steps to identify the source of the information.

Where applicable, SUSTA will also inform data subjects of the recipients or categories of recipients of their personal information, applicable rights, any relevant legal requirement for providing the information, and any applicable transfer of information outside South Africa.

5. Why We Process Personal Information

SUSTA may process personal information for purposes including:

Creating and managing customer accounts
Processing and fulfilling orders
Processing payments
Delivering products
Managing returns, refunds and exchanges
Responding to enquiries
Providing customer support
Managing complaints and feedback
Communicating with customers
Sending marketing communications where permitted by law
Maintaining business and financial records
Preventing fraud and misuse
Maintaining website and information security
Improving our website, products and services
Managing suppliers and service providers
Complying with legal and regulatory obligations
Establishing, exercising or defending legal rights and claims
Other purposes permitted by applicable law

6. Lawful Basis for Processing

SUSTA will process personal information only where a lawful basis under POPIA exists.

Depending on the circumstances, processing may be based on:

Your consent, where required or appropriate;
The performance or conclusion of a contract to which you are a party;
Compliance with an obligation imposed by law on SUSTA;
The protection of a legitimate interest of the data subject;
The pursuit of a legitimate interest of SUSTA or a third party to whom the information is supplied, where permitted by law.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, or processing that is otherwise permitted under another lawful ground in POPIA.

You may also object to certain processing of your personal information where permitted by POPIA.

7. Marketing Communications

SUSTA may send direct marketing communications where permitted by POPIA and other applicable law.

For unsolicited electronic direct marketing, including email, SMS and similar electronic communications, SUSTA will obtain consent where required by POPIA.

Where permitted by section 69 of POPIA, SUSTA may communicate electronically with an existing customer about SUSTA’s own similar products or services where the customer’s contact details were obtained in the context of a sale and the customer was given a reasonable opportunity, at the time the information was collected and on each subsequent marketing communication, to object free of charge and without unnecessary formality.

Every electronic direct marketing communication will identify SUSTA or the person on whose behalf the communication is sent and provide a means by which the recipient may request that further communications cease.

You may withdraw consent or object to direct marketing by using the unsubscribe or opt-out mechanism provided in the communication or by contacting SUSTA.

8. Cookies and Similar Technologies

SUSTA may use cookies and similar technologies on its website to support website functionality, security, performance and user experience.

These technologies may collect or process information such as browser and device information, IP address, website usage information, preferences and other technical information, depending on the technology used.

Cookies and similar technologies may be used for purposes including:

Essential website functionality
Security and fraud prevention
Remembering preferences
Website performance
Analytics and website usage measurement
Improving the website and user experience

Some cookies may be placed or operated by third-party service providers used by SUSTA, such as hosting, payment, analytics, security or other technology providers.

The specific cookies and similar technologies used by SUSTA may change as the website, services and technology providers change.

Where required by applicable law, SUSTA will obtain appropriate consent before using cookies or similar technologies that require consent.

Where consent is required, non-essential cookies and similar technologies will not be activated before the required consent is obtained. You may change or withdraw your cookie consent through the website’s cookie-management tools, where available.

You can manage or disable cookies through your browser settings and, where available, through cookie-management tools provided on the website. Disabling certain cookies may affect website functionality or prevent some features from operating correctly.

9. Sharing Personal Information

SUSTA may share personal information where necessary and lawful with categories of recipients including:

Payment service providers
Delivery and courier providers
Website and hosting service providers
IT and technology service providers
Email and communication service providers
Analytics and website service providers
Professional advisers
Accounting and financial service providers
Government, regulatory or law-enforcement authorities where legally required
Legal representatives or other advisers where necessary to establish, exercise or defend legal rights
Other service providers necessary to operate SUSTA’s business

SUSTA will only share personal information where there is a lawful purpose for doing so and will limit the information shared to what is reasonably necessary for the relevant purpose.

Where a third party processes personal information on SUSTA’s behalf as an operator, SUSTA will require the operator to process the information only with SUSTA’s knowledge or authorisation, maintain confidentiality and comply with applicable requirements under POPIA.

As required by POPIA, SUSTA will enter into a written contract with each operator requiring appropriate security measures to protect the personal information processed on SUSTA’s behalf. Operators must notify SUSTA immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

10. Information Processed Outside South Africa

Some of SUSTA’s service providers may process or store personal information outside the Republic of South Africa.

Where personal information is transferred outside South Africa, SUSTA will ensure that the transfer meets at least one of the conditions permitted by section 72 of POPIA, as applicable to the circumstances. These conditions may include adequate protection under a law, binding corporate rules or binding agreement; the data subject’s consent; necessity for the performance or conclusion of a contract in the data subject’s interest; or another condition permitted by section 72.

The specific countries and service providers may depend on the technology, payment, hosting, communication and other services used by SUSTA from time to time.

11. Security of Personal Information

SUSTA takes appropriate, reasonable technical and organisational measures to protect the integrity and confidentiality of personal information and to prevent its loss, damage, unauthorised destruction, unlawful access or unlawful processing.

SUSTA takes reasonable measures to:

Identify reasonably foreseeable internal and external risks to personal information
Establish and maintain appropriate safeguards against identified risks
Regularly verify that security safeguards are effectively implemented
Update security safeguards where reasonably necessary to address new risks or identified deficiencies

Depending on the systems and services used by SUSTA, security measures may include:

Access controls
Password protection
Secure website connections
Appropriate hosting and technical security measures
Limiting access to personal information to persons who require it
Data backup and recovery measures
Security monitoring and maintenance where appropriate

SUSTA will have due regard to generally accepted information security practices and procedures applicable to its business.

No electronic system can be guaranteed to be completely secure.

12. Security Compromises

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, SUSTA will notify the Information Regulator and the affected data subjects as required by section 22 of POPIA.

SUSTA will make the required notifications as soon as reasonably possible after discovering the security compromise, subject to any lawful delay permitted by POPIA.

The notification to affected data subjects will provide sufficient information to enable them to take protective measures against the potential consequences of the security compromise, including information about the possible consequences and the measures taken or proposed by SUSTA to address the compromise and mitigate potential harm.

Where a security compromise occurs at an operator, the operator must notify SUSTA as required by POPIA, and SUSTA will take the required steps as the responsible party.

SUSTA will report security compromises to the Information Regulator through the prescribed reporting process and channel applicable at the time of notification.

13. Retention of Personal Information

SUSTA will retain personal information only for as long as reasonably necessary for the purpose for which it was collected or subsequently processed, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

The nature and purpose of the information
The relationship with the data subject
Legal and regulatory requirements
Accounting and tax requirements
Contractual obligations
The establishment, exercise or defence of legal rights
Legitimate business requirements

Where SUSTA is required or permitted by law to retain personal information for a specified period, the information will be retained for that period.

When personal information is no longer required to be retained and SUSTA is no longer authorised to retain it, SUSTA will take reasonably practicable steps to delete, destroy or de-identify the information in a manner that prevents it from being reconstructed in an intelligible form, where applicable.

14. Rights of Data Subjects

Subject to POPIA and other applicable law, you have rights in relation to your personal information processed by SUSTA.

These rights may include the right to:

Request confirmation of whether SUSTA holds personal information about you
Request access to personal information held by SUSTA about you
Request correction or updating of personal information that is inaccurate, incomplete, misleading or out of date
Request the deletion or destruction of personal information that SUSTA is no longer authorised to retain
Object to certain processing of your personal information where permitted by POPIA
Withdraw consent where processing is based on consent
Object to direct marketing
Lodge a complaint with the Information Regulator where you believe your rights under POPIA have been infringed

SUSTA may take reasonable steps to verify your identity before acting on a request. Any refusal, restriction or limitation of a request will be made only where permitted by POPIA or other applicable law.

Where a request is made to access, correct or delete personal information, SUSTA will process the request in accordance with POPIA and the applicable prescribed requirements.

To exercise your rights under POPIA, please contact SUSTA through our Contact Us page or write to our Information Officer using the details provided in Section 2 of this Privacy Policy.

For formal requests for access to records under PAIA, please refer to the PAIA Manual.

SUSTA will provide reasonable assistance where required by law to enable a data subject to exercise their rights.

15. Special Personal Information

SUSTA does not intentionally collect or process special personal information unless this is permitted or required by POPIA or another applicable law.

Special personal information includes information relating to, among other things:

Religious or philosophical beliefs
Race or ethnic origin
Trade union membership
Political persuasion
Health or sex life
Biometric information

Where SUSTA processes special personal information, it will do so only where a lawful exception under POPIA or another applicable law applies and only to the extent reasonably necessary for the relevant purpose.

SUSTA will apply appropriate safeguards to special personal information that it lawfully processes.

16. Children’s Personal Information

SUSTA does not knowingly collect or process personal information of children unless the processing is permitted by POPIA or another applicable law and all applicable legal requirements are met.

Where SUSTA becomes aware that it has collected personal information relating to a child in circumstances where the processing is not permitted by law, SUSTA will take reasonably practicable steps to address the situation, which may include deleting or de-identifying the information where appropriate.

Where processing of a child’s personal information is lawfully permitted, SUSTA will process the information only for the relevant lawful purpose and will apply the safeguards required by applicable law.

17. Automated Decision-Making

SUSTA does not intend to make decisions based solely on automated processing of personal information where those decisions produce legal consequences for a data subject or similarly significantly affect a data subject, except where permitted by applicable law.

Where SUSTA uses automated processing that falls within section 71 of POPIA, SUSTA will comply with the applicable requirements of POPIA, including any requirements relating to the protection of the data subject’s legitimate interests.

18. Accuracy of Personal Information

SUSTA takes reasonably practicable steps to ensure that personal information processed by it is complete, accurate, not misleading and updated where necessary, having regard to the purpose for which the information is processed.

If you believe that information held by SUSTA is inaccurate or incomplete, you may contact us using the details in this Privacy Policy.

19. Complaints

If you have a privacy concern or believe that SUSTA has not processed your personal information in accordance with POPIA, please contact our Information Officer using the details in Section 2 of this Privacy Policy or through our Contact Us page.

You may also lodge a complaint with the Information Regulator of South Africa, where applicable. Contact details and complaint information are available on the Information Regulator’s official website.

20. Changes to this Privacy Policy

SUSTA may update this Privacy Policy from time to time to reflect changes to:

Our business
Our website
Our products or services
Our information-processing practices
Technology and service providers
Applicable laws or regulatory requirements

The current version will be published on this website with its applicable “Last Updated” date.

21. Contact Us

For general enquiries about this Privacy Policy or SUSTA’s handling of personal information, please use our Contact Us page.

For matters requiring the attention of SUSTA’s Information Officer, please use the contact details provided in Section 2 of this Privacy Policy or consult the PAIA Manual.

Nothing in this section limits your right to lodge a complaint with the Information Regulator where permitted by law.