Blossom Bloom privacy notice — POPIA

Owner-approved version: BB-PRIVACY-2026-09-14-1. Applies when published and presented with the corresponding terms.

1. Responsible party and contact

The responsible party is Blossom Bloom Trading (Pty) Ltd, trading as Blossom Bloom, registration number 2024/047754/07, with its office at 152 Bram Fischer Drive, Blairgowrie, Randburg, Gauteng, 2194, South Africa. Privacy and access requests may be sent to support@blossombloom.me, our designated privacy contact. Address requests for the Information Officer, access procedures and the PAIA manual to this contact. This contact designation does not itself identify or appoint an Information Officer.

This notice covers customers, distributors, applicants, helpers and Stockists using Blossom. POPIA means South Africa’s Protection of Personal Information Act 4 of 2013. It explains our processing commitments and your rights; it is not a certification of regulatory compliance.

2. Information and its source

Depending on your activity, we process your name, contact and delivery details, member identifier, sponsor relationship, registration and package choices, orders, payment references, wallet and accrual movements, support requests, messages, pickup arrangements and account-security records. Verification or payout processes may require additional identity or banking information through their designated secure channels.

You usually provide information directly. Other sources may include a distributor whom you authorised to help register you, your chosen transaction participant, payment and fulfilment providers, and relevant account records retained from the former system. In an assisted application we record the helper and permission declaration, tell you about the application, and let you review your details. A helper must provide this notice before collection and cannot consent to marketing for you.

Do not send passwords, claim links, payment-card security codes, unnecessary identity documents or medical information in chat or general support messages. We do not need health details merely because you buy a wellness product.

3. Purpose and choice

Required account and transaction details let us identify the correct member, process the requested registration or purchase, arrange fulfilment, calculate the applicable benefits, keep records and resolve errors. Without information genuinely needed for a requested service, we may be unable to provide that service; we will explain what is missing.

Optional marketing preferences and optional location searches must not be a condition of ordinary account use. We must identify any specific legally required collection in the relevant form or notice rather than treating every field as compulsory by law. You may ask why a particular field is requested through our privacy contact.

We distinguish processing needed to perform requested transactions, comply with applicable obligations or protect legitimate interests from processing that requires consent. Optional consent must be specific and withdrawable. Withdrawal does not undo lawful earlier processing or extinguish necessary transaction records. We will assess objections and explain any lawful reason to continue restricted processing.

4. Who can receive information

Recipients may include authorised Blossom personnel and contracted providers supporting identity, hosting, payment, messaging, fulfilment and security, with access limited to their task. Google Cloud/Firebase and PayFast are used for account, hosting or payment services where those services are enabled. Contact our privacy contact for information about the providers, processing locations and safeguards relevant to your use.

A helper may see their own registration attempt and payment, activation and welcome-delivery status, not the new member’s password, session or wallet. Sponsor and network views must expose only information needed for the authorised relationship and benefits. Private Stockist conversations are for their participants; they do not create a general staff reading permission.

Approved Stockists who choose to publish a site make its exact pickup address, hours, stock availability and advertised fees visible to authenticated members. Owners should consider this before publishing a home address. Unpublishing removes future directory visibility but does not erase valid previous transactions or conversation evidence.

We do not authorise recipients to reuse member details for unrelated marketing. Required legal disclosures must be assessed and limited to their lawful purpose. Provider contracts and actual permissions must support these restrictions.

5. Location, device information and cookies

Where nearby Stockist search is enabled, location permission is requested only when you choose it. Search coordinates are used for that search and must not be retained as a movement history. Area search remains an alternative.

The service uses necessary authentication and security mechanisms. Before enabling optional advertising or analytics tracking, Blossom must document the tools and provide any required choice. This notice does not authorise undisclosed trackers. You may request details of the storage mechanisms relevant to your use, including their purposes and duration, through our privacy contact.

6. Marketing

Account, purchase, security and requested pickup notices are service communications, not permission to send promotions. Promotional email, SMS, telephone or other electronic marketing must use valid consent or the qualifying existing-customer route under POPIA section 69.

The existing-customer route is limited to contact details obtained in a sale, marketing our own similar products or services, and a free, straightforward objection opportunity when collecting details and in each message. It is not permission to market to an entire sponsor network. Any permitted request for consent must follow the prescribed process and must not repeatedly approach someone who has withheld it.

Marketing identifies the sender and offers a working stop/unsubscribe channel. Refusing marketing does not forfeit membership or earned benefits. Keep marketing choices separate from acceptance of commercial terms. A minimal suppression record may remain so that an objection is respected.

7. Retention and deletion

We retain information only for a documented purpose and justified period, including relevant transaction, accounting, dispute and security needs. The retention schedule must specify each category, duration or decision criterion, deletion method and any legal hold; no universal indefinite period is approved here.

A failed registration is not automatically a zero-trace event. Unused new provisioning records may qualify for governed cleanup. Paid purchases, required records, legitimate audit evidence and temporarily retained backups may need restricted retention. We will explain the applicable basis and what can be corrected, deleted, restricted or de-identified rather than promise immediate removal from every system.

8. Security and incidents

Blossom must maintain proportionate technical and organisational safeguards and require appropriate safeguards from operators. Safeguards must address access control, protected credentials, secure transmission, audit controls and recovery procedures.

If there are reasonable grounds to believe an unauthorised person accessed or acquired personal information, we will investigate and make the notifications required by POPIA section 22 to the Regulator and affected people as soon as reasonably possible, subject to the Act’s permitted exceptions and delays. We do not substitute a blanket 72-hour promise for that requirement. Operators must notify Blossom of relevant compromises.

9. Cross-border processing

Some providers may process information outside South Africa. Before a transfer, Blossom must establish an applicable section 72 basis, such as adequate protection through the recipient’s law or binding agreement, including onward-transfer protection, or another lawful statutory basis. Accepting general terms is not blanket transfer consent.

Contact our privacy contact for information about relevant countries, recipients and transfer safeguards. Do not assume a South African website address means that all data stays in South Africa.

10. Your rights and complaints

You can request confirmation of processing, access, correction and applicable deletion or restriction, object where POPIA permits, and withdraw optional consent. Use the verified privacy contact in section 1. We may request proportionate identity evidence before disclosing information, but never your password. We will explain any lawful refusal, prescribed fee or applicable procedure.

You may complain directly to the Information Regulator at https://inforegulator.org.za, using its current complaint channels and forms. You need not waive that right or obtain a sponsor’s permission. The Regulator’s published enquiries contact is enquiries@inforegulator.org.za, telephone 010 023 5200; use its website to verify the appropriate complaint submission route.

11. Children and automated decisions

The distributor journey is adult-only. A helper must not bypass it by entering an adult’s birth date for a child. Any necessary processing concerning a child or special personal information requires a separately assessed lawful basis and safeguards.

PV, qualification, attribution and accrual calculations apply recorded transaction and plan rules. You may ask for an explanation or review of an apparent error through support. Before introducing a solely automated decision with substantial legal or similar effects, Blossom must assess POPIA section 71 and the required safeguards; this notice is not advance consent to unrestricted automated decisions.

12. Updates

We will identify the effective version and communicate material changes. New purposes requiring additional notice or consent will be addressed before that processing begins. The account-claim acceptance record must identify the exact terms and privacy versions presented; reading this notice must not be recorded as an optional marketing opt-in.