Last updated: 1 August 2025
Who we are
Shesha Commerce (Pty) Ltd (“Shesha Commerce”, “we”, “us”, or “our”) operates the Shesha Commerce platform and the website at shesha-commerce.com. We are registered in South Africa and are subject to the Protection of Personal Information Act 4 of 2013 (“POPIA”).
For any privacy-related queries, contact our Information Officer at hello@shesha-commerce.com or by phone at +27 82 545 5880.
Information we collect
We collect personal information in the following categories:
- Account information — your name, email address, organisation slug, and password (hashed; we never store it in plain text) when you create an account.
- Billing information — payment method details processed by our payment provider. We do not store full card numbers.
- Usage data — pages visited, features used, session duration, browser type, and IP address, collected automatically when you use the platform.
- Communications — the content of emails, support requests, or messages you send us.
- Your customers' data — when you use Shesha Commerce to operate a storefront, data about your end-customers (orders, contact details) is processed by you as the responsible party. We act as operator under POPIA for this data.
How we use your information
- To create and manage your account and provide the Shesha Commerce service.
- To process payments for your subscription.
- To send transactional emails (account verification, invoices, password resets).
- To send product updates and relevant announcements (you can opt out at any time).
- To improve the platform — we analyse aggregated, anonymised usage data to understand what works and what doesn't.
- To investigate and prevent fraud, abuse, or violations of our Terms of Service.
- To comply with legal obligations applicable to us in South Africa.
Legal basis for processing
Under POPIA, we process your personal information on the following grounds:
- Contract performance — processing necessary to deliver the service you signed up for.
- Legitimate interests — improving the platform, preventing fraud, and communicating relevant product updates.
- Legal obligation — retaining records as required by South African law.
- Consent — for optional marketing communications, where we rely on your explicit opt-in.
How we store and protect your information
Your data is stored on servers located in South Africa and/or within jurisdictions that provide an adequate level of data protection. We use industry-standard encryption (TLS in transit, AES-256 at rest), access controls, and regular security reviews to protect your information.
No method of transmission or storage is completely secure. If we become aware of a data breach that affects your rights, we will notify you and the Information Regulator as required by POPIA.
Sharing your information
We do not sell your personal information. We may share it with:
- Service providers — payment processors, hosting providers, and analytics tools that operate on our behalf under confidentiality obligations.
- Legal authorities — when required by law or valid legal process in South Africa.
- Successors — in the event of a merger, acquisition, or sale of assets, where the buyer is bound by equivalent privacy obligations.
Cookies and tracking
We use strictly necessary cookies to keep you logged in and maintain your session. We also use analytics cookies (which you can opt out of) to understand platform usage in aggregate. No advertising cookies or third-party tracking pixels are used on the Shesha Commerce platform.
Your rights under POPIA
You have the right to:
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to correct inaccurate or incomplete information.
- Deletion — request erasure of your personal information where we have no legal basis to retain it.
- Objection — object to processing based on our legitimate interests.
- Withdrawal of consent — withdraw consent for optional processing at any time without affecting prior processing.
- Complaint — lodge a complaint with the South African Information Regulator at inforegulator.org.za.
To exercise any of these rights, email hello@shesha-commerce.com. We will respond within 30 days.
Data retention
We retain your account information for as long as your account is active, and for a further 5 years after closure to meet financial record-keeping requirements. Usage logs are retained for 12 months. You may request earlier deletion where permitted by law.
Children's privacy
The Shesha Commerce platform is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email or a prominent notice on the platform at least 30 days before they take effect. Your continued use of Shesha Commerce after the effective date constitutes acceptance of the updated policy.