Privacy Policy

Effective Date: 30 May 2026

At Gracalea, we are committed to protecting your privacy and ensuring a secure online experience. This Privacy Policy outlines how we collect, use, process, and safeguard your personal information when you visit our website, purchase our handcrafted candles, or interact with our services.

1. Who We Are

Our website address is: https://gracaleamassagetherapy.co.za. If you have any questions regarding this Privacy Policy or your personal data, you can contact us directly via our website layout contact channels.

2. Personal Data We Collect & Why We Collect It

Account & Order Information

When you purchase candle refills or create an account on our online shop, we collect the personal information necessary to fulfill your order and manage your account. This includes:

  • Identification Data: Your name, surname, and account login details.
  • Contact Details: Your email address and telephone number.
  • Logistics & Delivery Data: Your physical shipping/delivery address, which we use to process local service delivery or coordinate jar refill returns.
  • Transaction Records: Details of the products you purchased and the total order amounts.

Customer Comments & Forms

When visitors leave comments or submit forms on the site, we collect the data shown in the respective forms. To protect our platform from malicious activity, we also record the visitor’s IP address and browser user agent string to assist with automated spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media Uploads

If you upload images to the website (for example, uploading reference photos of custom jars for candle refills), you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can potentially download the images and extract any embedded location data.

3. Cookies and Tracking Technologies

We use cookies to optimize your browsing experience, remember your preferences, and maintain your active shopping cart.

  • User Interactions: If you leave a comment on our site, you may opt-in to saving your name, email address, and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies last for one year.
  • Login Authentication: If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser. When you log in, we establish several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for one year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies are automatically removed.
  • Content Management: If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data, simply indicates the post ID of the article you just edited, and expires after 1 day.

4. Embedded Content From Third Parties

Articles and pages on this site may include embedded content (e.g., payment gateways, videos, images, maps, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website directly.

These external websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content—including tracking your interaction if you have an account and are logged in to that specific external website.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal information to third parties. Your data is shared strictly under the following operational circumstances:

  • Payment Processing: To securely process your checkout transactions, your payment data is passed directly to our integrated, PCI-DSS compliant payment gateways.
  • Logistics & Delivery: Your name and physical shipping address are shared with our local delivery partners to ensure your orders reach you efficiently.
  • Security & Operations: If you request a password reset, your IP address will be included in the automated reset email.
  • Compliance & Spam Control: Visitor comments and form entries may be processed through a secure, automated third-party spam detection service.

6. Payment Security & Processing

Your financial security is a top priority. All payments made on our online shop are handled with strict confidentiality and industry-standard protection:

  • No Stored Card Details: We do not collect, view, or store your credit/debit card numbers, CVV codes, or banking credentials on our website servers.
  • Encrypted Transmissions: All transactional data sent between your web browser and our payment processors is fully encrypted using Secure Socket Layer (SSL) technology.
  • Third-Party Gateways: Payment processing is handled externally by our trusted, secure payment gateway providers. They are legally required to manage your transactional details in strict compliance with global Payment Card Industry Data Security Standards (PCI-DSS).

7. How Long We Retain Your Data

We retain your personal information only for as long as necessary to provide our services and maintain security records:

  • Community Interactions: If you leave a comment, the comment and its metadata are retained indefinitely. This allows our system to recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.
  • Registered Profiles: For users that register an account on our website, we store the personal information they provide in their user profile. All users can view, edit, or delete their personal information at any time (except they cannot change their account username). Website administrators can also view and edit that administrative information.

8. What Rights You Have Over Your Data

If you hold an account on this site, have made purchases, or have left comments, you have the right to control your personal data:

  • Data Export: You can request to receive an exported file of the personal data we hold about you, including any data you have provided to us.
  • Data Erasure: You can request that we erase any personal data we hold about you. This does not include any operational data that we are legally or administratively obliged to keep for financial tax tracking, legal compliance, or security purposes.

9. Where Your Data Is Sent

Visitor comments and form completions may be processed through an automated, secure third-party spam detection service to preserve website integrity.