Cold Lemon

Privacy Policy

POPIA PRIVACY POLICY

Introduction

Cold Lemon (Pty) Ltd (referred to in this policy as “we”, “us”, or “our”) is committed to protecting the personal information of our customers, website visitors, and any other individuals whose personal information we process. This Privacy Policy explains how we collect, use, store, share, and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and the regulations promulgated thereunder.

We recognise that your privacy is important. This policy sets out your rights as a data subject and how you can exercise them. We encourage you to read this policy carefully. By using our website at coldlemon.co.za or engaging with our services, you acknowledge that you have read and understood this policy.

Our website is located at: coldlemon.co.za

Definitions

The following terms are used throughout this policy and carry the meanings assigned to them in POPIA section 1:

  • Personal Information means information relating to an identifiable, living, natural person or an identifiable, existing juristic person, including but not limited to a name, identity number, contact details, location information, online identifiers, financial information, and any opinions about a person.
  • Special Personal Information means personal information concerning a data subject’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, criminal behaviour, or the alleged commission of an offence (POPIA section 26).
  • Processing means any operation or activity, whether automated or not, concerning personal information — including collection, receipt, recording, organisation, storage, updating, distribution, erasure, or destruction of that information.
  • Data Subject means the natural or juristic person to whom personal information relates — in most cases, this means you, our customer or website visitor.
  • Responsible Party means the entity that determines the purpose and means of processing personal information — in this policy, Cold Lemon (Pty) Ltd.
  • Operator means a person who processes personal information on behalf of the responsible party in terms of a contract or mandate, without coming under the direct authority of the responsible party (POPIA section 1).
  • Information Regulator means the independent statutory body established by POPIA to promote, enforce, and monitor compliance with POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA).

Information We Collect

We collect the following categories of personal information:

  • Contact Information — including your name, email address, phone number, and physical address.
  • Account/Login Information — including usernames and passwords. Passwords are stored in hashed (encrypted) form and are not stored in plain text.
  • Financial Information — including payment details and bank information. Financial and payment data is handled securely via our third-party payment processor and is not stored directly on our systems.
  • Technical Information — including your IP address, browser type, and device information.
  • Usage Data — including website activity, clicks, and pages visited.
  • User-Generated Content — including comments, reviews, and posts you submit through our platform.
  • Location Data — where collected in the course of providing our services.

How We Collect Information

We collect personal information through the following methods:

  • Directly from individuals — for example, through forms you complete, emails you send us, or calls you make to us.
  • Automatically via our website — for example, through cookies and server logs that collect technical and usage information when you visit our website.

Lawful Basis for Processing (POPIA Section 11)

POPIA section 11(1) provides that personal information may only be processed if at least one of six lawful grounds applies. We rely on the following grounds when processing your personal information:

  • (a) Consent (s11(1)(a)) — Where you have given us your express consent, for example, when you subscribe to marketing communications or submit a form on our website. You have the right to withdraw consent at any time (POPIA section 11(2)(b)).
  • (b) Contract (s11(1)(b)) — Processing is necessary for the conclusion or performance of a contract with you. This applies when we provide and manage cleaning services, process your bookings, handle payments, and communicate with you about your account or service.
  • (c) Legal Obligation (s11(1)(c)) — Processing is necessary to comply with a legal obligation imposed on us, for example, obligations under tax law (SARS), consumer protection legislation, or other applicable South African law.
  • (d) Protection of Legitimate Interest of the Data Subject (s11(1)(d)) — Processing is necessary to protect a legitimate interest of the data subject, for example, fraud detection measures that protect our customers.
  • (e) Public-Law Duty (s11(1)(e)) — This ground is not applicable to our business operations.
  • (f) Legitimate Interest of the Responsible Party (s11(1)(f)) — Processing is necessary for pursuing our legitimate business interests, for example, improving our website and services through analytics, and ensuring the security and integrity of our systems. Where we rely on this ground, we balance our interests against your rights and interests as a data subject.

The mapping of our processing purposes to these grounds is as follows:

  • To provide and manage services/products — ground (b) Contract.
  • To process payments — ground (b) Contract.
  • To communicate with users (support, updates) — ground (b) Contract and (f) Legitimate Interest.
  • For marketing and promotions (with consent where required) — ground (a) Consent and/or (f) Legitimate Interest, subject to the requirements of POPIA section 69.
  • To improve website/services (analytics) — ground (f) Legitimate Interest.
  • To comply with legal obligations — ground (c) Legal Obligation.
  • For security and fraud prevention — ground (f) Legitimate Interest and (d) Protection of Legitimate Interest of the Data Subject.

How We Use Your Personal Information

We use your personal information for the following purposes:

  • To provide and manage services/products.
  • To process payments.
  • To communicate with users (support, updates).
  • For marketing and promotions (with consent where required).
  • To improve website/services (analytics).
  • To comply with legal obligations.
  • For security and fraud prevention.

We will not use your personal information for any purpose other than those listed above, or for a purpose that is incompatible with the original purpose for which it was collected, without your knowledge and, where required, your consent.

Sharing of Personal Information

We may share your personal information with certain third parties in order to deliver our services. We only share personal information where there is a lawful basis to do so under POPIA, and we ensure that any third party acting as an operator on our behalf is bound by appropriate data processing agreements in terms of POPIA section 21. The categories of recipients and the reason for each disclosure are as follows:

  • Independent Cleaning Contractors — To dispatch service providers to the client’s location and fulfill cleaning appointments.
  • Payment Processors — To securely process transactions and handle credit card or electronic payments.
  • Software and Hosting Providers — To power the booking platform, website hosting, and infrastructure used to manage client accounts.

We do not sell your personal information to third parties. We do not share your personal information with any party for that party’s own marketing purposes. Where required by law — for example, pursuant to a court order, a lawful request by a regulatory authority, SARS, or a law-enforcement authority — we may be required to disclose your personal information regardless of the above.

International Transfer of Personal Information

Some of our third-party service providers, including cloud infrastructure and software-as-a-service (SaaS) providers, may be based outside the Republic of South Africa. In such cases, your personal information may be transferred to, stored in, or processed in jurisdictions outside South Africa.

POPIA section 72 permits the transfer of personal information to a foreign country only if one or more of the following conditions are met:

  • The recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA;
  • You, the data subject, have consented to the transfer;
  • The transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken at your request;
  • The transfer is for your benefit and it is not reasonably practicable to obtain your consent, and if it were reasonably practicable you would likely give it.

We satisfy the requirements of POPIA section 72 in the following way:

Standard contractual clauses and data processing agreements implemented with cloud infrastructure and software-as-a-service providers to ensure data protection standards align with POPIA requirements.

We take reasonable steps to ensure that any personal information transferred outside South Africa receives an adequate level of protection.

Cookies and Similar Tracking Technologies

Our website at coldlemon.co.za uses cookies and similar tracking technologies. A cookie is a small text file placed on your device when you visit a website. Cookies help us provide core functionality and improve your experience.

Essential / Strictly Necessary Cookies

Essential cookies are used for core platform functionality, user authentication, and managing booking sessions through our booking engine. These cookies are strictly necessary for our website to operate and cannot be disabled without affecting the functionality of the site. They do not require your consent.

Functional / Preferences Cookies

We do not currently use functional or preferences cookies beyond what is described in the Essential category above.

Analytics / Performance Cookies

Analytics cookies are utilized to monitor website traffic and improve user experience on the landing page. These cookies collect information about how visitors use our website, such as which pages are visited most often. The data collected is aggregated and does not directly identify you. Your consent is required before these cookies are placed.

Marketing / Advertising Cookies

We do not currently use marketing or advertising cookies.

Your Cookie Choices

When you first visit our website, a cookie consent banner will be presented to you. You may accept or decline non-essential cookies at that time. You may also change your cookie preferences at any time through the cookie settings in the banner or through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

Most web browsers allow you to manage cookies through your browser settings. You can set your browser to refuse cookies, delete existing cookies, or notify you when a cookie is set. Please refer to your browser’s help documentation for instructions.

How We Protect Your Information

We take the security of your personal information seriously and implement appropriate technical and organisational measures as required by POPIA section 19. Our security safeguards include:

  • Secure Sockets Layer (SSL)/Transport Layer Security (TLS) encryption.
  • Password protection and hashing.
  • Access controls (limiting who can see data).
  • Regular software updates and patching.
  • Firewalls and intrusion detection systems.
  • Secure data storage practices.

While we take reasonable precautions to protect your personal information, no method of electronic transmission or storage is completely secure. If you believe that your personal information has been compromised, please contact our Information Officer immediately using the details set out in the “Contact Us” section of this policy.

In the event of a security compromise that is likely to affect you or any other data subject, we will notify the Information Regulator and affected data subjects as required by POPIA section 22.

The Eight POPIA Conditions for Lawful Processing

POPIA Chapter 3 (sections 8 to 25) establishes eight conditions for the lawful processing of personal information. We are committed to complying with each of these conditions as follows:

1. Accountability (Section 8)

Cold Lemon (Pty) Ltd, as the responsible party, takes full accountability for ensuring that all personal information processing activities comply with POPIA. We have appointed an Information Officer, Ilne de Klerk, who is responsible for overseeing data protection compliance, handling data subject requests, and acting as the primary point of contact for privacy matters.

2. Processing Limitation (Sections 9 to 12)

We only collect personal information that is adequate, relevant, and not excessive in relation to the purposes for which it is collected. Personal information is collected directly from you wherever reasonably practicable. We rely on lawful grounds under POPIA section 11 for each processing activity, and we do not process your information beyond what is necessary for the stated purposes.

3. Purpose Specification (Sections 13 to 14)

We collect personal information only for specific, explicitly defined, and lawful purposes as described in the “How We Use Your Personal Information” section of this policy. You are informed of these purposes at the time of collection. We retain personal information only for as long as is necessary to fulfil those purposes or as required by applicable law.

4. Further Processing Limitation (Section 15)

We will not process your personal information for a purpose that is incompatible with the original purpose for which it was collected, unless we have your consent, or a separate lawful basis exists for such further processing. Before using your information for any new or different purpose, we will assess compatibility and, where necessary, obtain your prior consent.

5. Information Quality (Section 16)

We take reasonable steps to ensure that the personal information we hold about you is complete, accurate, not misleading, and updated where necessary. We encourage you to inform us if any of your details change so that we can update our records accordingly. You may also request the correction of inaccurate information in terms of your rights under POPIA section 24.

6. Openness (Sections 17 to 18)

We are transparent about our personal information processing activities. This Privacy Policy serves as our primary means of informing you about how we collect, use, and process your personal information, as required by POPIA sections 17 and 18. We notify you of the purposes for processing, the categories of information collected, and your rights at the time of collection.

7. Security Safeguards (Sections 19 to 22)

We implement appropriate, reasonable technical and organisational security measures to protect your personal information against loss, damage, unauthorised access, disclosure, interference, or destruction, as required by POPIA section 19. Our security measures are listed in the “How We Protect Your Information” section of this policy. Where we engage operators to process personal information on our behalf, we require them to implement equivalent security safeguards under written agreements in terms of POPIA section 21.

8. Data Subject Participation (Sections 23 to 25)

You have the right to request access to, correction of, or deletion of your personal information held by us, as provided in POPIA sections 23 to 25. We will respond to all such requests within a reasonable time and in accordance with the POPIA Regulations. Details of how to exercise your rights are set out in the “How to Exercise Your Rights” section of this policy.

Data Retention

We retain your personal information for the following period: as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws.

This is consistent with POPIA section 14, which requires that personal information not be retained any longer than is necessary for achieving the purpose for which it was collected, unless retention is required or authorised by law. Applicable legal retention requirements may include, but are not limited to, obligations under South African tax legislation (including requirements imposed by the South African Revenue Service) and other applicable regulatory frameworks.

Once personal information is no longer required for any lawful purpose, we will take reasonable steps to destroy or de-identify it securely.

Children’s Information

Our services and website are not directed at children under the age of 18 years. We do not knowingly collect, use, or store personal information from minors without the verifiable consent of a parent or legal guardian, as required by POPIA sections 34 and 35.

If you believe that we have inadvertently collected personal information from a child under 18 without appropriate consent, please contact our Information Officer immediately so that we may take steps to delete such information.

Special Personal Information

POPIA section 26 defines “special personal information” as particularly sensitive categories of personal information, including information about a data subject’s religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, criminal behaviour, or the alleged commission of an offence.

Cold Lemon (Pty) Ltd does not process special personal information as part of its ordinary business activities, unless specifically authorised to do so under POPIA section 27 — for example, where you have given explicit consent, where processing is necessary for the establishment, exercise, or defence of a legal claim, or where processing is required by an applicable employment law obligation.

Your Rights as a Data Subject

POPIA grants you a number of important rights in relation to your personal information. These rights are summarised below:

  • Right of access — The right to be told what personal information we hold about you and to be given a copy of it (POPIA section 23).
  • Right to correction or deletion — The right to ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained (POPIA section 24).
  • Right to withdraw consent — Where we process your personal information on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal (POPIA section 11(2)(b)).
  • Right to object to processing — The right to object to the processing of your personal information on reasonable grounds relating to your particular situation, except where the law requires us to process the information (POPIA section 11(3)).
  • Right to object to direct marketing — The right to object at any time to the processing of your personal information for purposes of direct marketing (POPIA section 69).
  • Right to lodge a complaint — The right to lodge a complaint with the Information Regulator if you believe that your personal information has been processed in violation of POPIA (POPIA section 74).
  • Right to seek civil relief — The right to seek civil relief in a competent court if your rights under POPIA have been infringed (POPIA section 99).

How to Exercise Your Rights

To exercise any of the rights described above, or to submit any query or concern regarding your personal information, please contact our Information Officer:

Name: Ilne de Klerk
Email: ilne.deklerk@gmail.com
Phone: +27 72 876 0591

Requests for access to your personal information must be submitted using the prescribed Form 1 (Request for Access to Record) under the POPIA Regulations. Requests to object to processing must be submitted using the prescribed Form 2 (Objection to Processing) under the POPIA Regulations. These forms are available from the Information Regulator’s website and from our Information Officer on request.

We will acknowledge your request promptly and endeavour to respond within a reasonable time, and in any event within the timeframes prescribed by the POPIA Regulations.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. Updates will be communicated in the following way: by posting the updated privacy policy on this website.

We encourage you to review this policy periodically. The latest version of this Privacy Policy is always available at coldlemon.co.za.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal information, please contact our Information Officer:

Cold Lemon (Pty) Ltd
Information Officer: Ilne de Klerk
Email: ilne.deklerk@gmail.com
Phone: +27 72 876 0591
Website: coldlemon.co.za

Information Regulator

If you are not satisfied with the way in which we have handled your personal information, or if you believe that we have processed your personal information in violation of POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa (POPIA section 74). The Information Regulator’s contact details are:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, 2017
General enquiries: inforeg@justice.gov.za
POPIA complaints: complaints.IR@justice.gov.za
Website: https://inforegulator.org.za

This Privacy Policy is effective from 26 September 2026. We may update this policy from time to time. The latest version is always available at coldlemon.co.za (or on request from our Information Officer).