Privacy Policy
Last updated: 22 September 2026
[INSERT] need to be completed with our registered business details before this policy is considered final, and we recommend review by a South African attorney before relying on it.1. Who we are
DigiStore operates the Food Depot and Electro-Tech online stores at mydigistore.co.za. For the purposes of POPIA, DigiStore is the responsible party for the personal information described below.
Registration number: [INSERT: CIPC registration number, or "sole proprietor"]
Registered address: [INSERT: registered business address]
Information Officer: [INSERT: name and direct email — POPIA s55 requires every responsible party to appoint one]
2. What we collect
- Name and contact details (mobile number and/or email)
- Delivery address and, where relevant, GPS location for map-based address entry
- Order history — items purchased, quantities, prices, order status
- Account authentication data (one-time PINs sent via SMS or email — we don't store your password)
- Basic usage data (pages viewed, device/browser type) for site reliability and fraud prevention
We do not store your card or bank details — payment is processed directly by PayFast (see below).
3. Why we collect it
- To create and secure your account, and verify you via one-time PIN
- To process, fulfil, and deliver your orders
- To provide customer support and handle returns/refunds
- To prevent fraud and keep the platform secure
- To meet our own legal and tax record-keeping obligations
4. Third parties we share information with
We use the following service providers to run DigiStore. Each only receives the information it needs to perform its specific function:
- PayFast — payment processing (South African payment gateway)
- Twilio — SMS delivery for one-time PIN authentication
- Resend — transactional email (order confirmations, updates)
- Mapbox — address lookup and delivery-location mapping
- Bob Go — courier booking and delivery tracking, where applicable
- Vercel and Neon — website hosting and database infrastructure
We don't sell your personal information to anyone.
5. Cross-border transfers
Some of the service providers above (including our hosting and database infrastructure) operate servers outside South Africa. Where personal information is processed outside the country, we rely on those providers' own data-protection commitments and standard contractual safeguards, in line with POPIA section 72.
6. Data security
We use industry-standard security measures — encrypted connections (HTTPS), secure authentication, and access controls — to protect your information. No system is completely immune to risk, but we take reasonable technical and organisational steps appropriate to the sensitivity of the information involved.
7. How long we keep your information
We retain order and account records for as long as your account is active, and for a reasonable period afterward to meet tax, accounting, and dispute-resolution obligations. You can ask us to delete your account at any time — see your rights below.
8. Your rights under POPIA
- To ask what personal information we hold about you, and access it (s23)
- To ask us to correct information that is inaccurate, outdated, incomplete, or misleading (s24)
- To ask us to delete information we no longer have a lawful basis to retain (s24)
- To object to our processing of your information in certain circumstances (s11(3))
- To object to your information being used for direct marketing (s69)
- To lodge a complaint with the Information Regulator if you believe we've handled your information unlawfully
To exercise any of these rights, contact us via our contact page.
9. Information Regulator
If you're not satisfied with how we've handled a request or complaint, you can contact South Africa's Information Regulator. Confirm current contact details at inforegulator.org.za before writing in, as these can change.
10. Changes to this policy
We may update this policy as our services change. The "last updated" date at the top reflects the most recent revision.