Privacy Policy

Last updated: 4 September 2026

1. Introduction

True Muscle Culture (“TMC”, “we”, “us” and “our”) respects your privacy and is committed to processing personal information lawfully, reasonably and securely.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you:

• Visit www.truemuscleculture.com (“Website”);
• Create or use a customer account;
• Purchase, return or enquire about a product;
• Subscribe to marketing communications;
• Contact us through email, telephone, WhatsApp, social media or the Website; or
• Otherwise interact with True Muscle Culture.

This Policy must be read together with our Terms of Service, Shipping Policy, Returns and Refund Policy and Legal Notice.

If there is a conflict between our Terms of Service and this Privacy Policy concerning the processing of personal information, this Privacy Policy will apply to that processing.

2. Responsible party

For purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), the responsible party is:

Legal entity or proprietor: [INSERT FULL REGISTERED NAME]
Trading name: True Muscle Culture
Registration number: [INSERT REGISTRATION NUMBER, IF APPLICABLE]
Physical address: 52 Smith Avenue, Edenvale, Gauteng, 1613, South Africa
Email: Kiara@truemuscleculture.com
Telephone/WhatsApp: +27 60 704 1880
Website: www.truemuscleculture.com
Information Officer or privacy contact: [INSERT NAME]

The responsible party determines why and how personal information is processed in connection with True Muscle Culture.

Shopify and certain other service providers may also act as independent responsible parties or operators for information they process through their services.

3. Applicable law

We process personal information in accordance with applicable South African law, including:

• The Protection of Personal Information Act 4 of 2013 (“POPIA”);
• The Electronic Communications and Transactions Act 25 of 2002 (“ECTA”);
• The Consumer Protection Act 68 of 2008 (“CPA”); and
• Other applicable South African legislation.

Nothing in this Privacy Policy limits any right available to a data subject under applicable law.

4. Meaning of personal information

“Personal information” has the meaning given to it under POPIA and generally includes information relating to an identifiable living person and, where applicable, an identifiable existing juristic person.

Information that has been irreversibly anonymised so that it cannot reasonably identify or be linked to a person is not treated as personal information.

5. Personal information we collect

Depending on how you interact with us, we may collect the following categories of personal information:

Contact information

• Full name;
• Email address;
• Telephone or WhatsApp number;
• Billing address;
• Street or PUDO delivery address; and
• Other contact details you provide.

Account information

• Customer-account details;
• Login identifiers;
• Preferences;
• Saved addresses; and
• Account settings.

Passwords and login credentials may be processed through Shopify’s secure systems rather than being directly accessible to us.

Order and transaction information

• Products viewed, added to a cart or purchased;
• Order number;
• Order value;
• Payment status;
• Billing and shipping information;
• Returns, exchanges and refunds;
• Customer-support history; and
• Previous transactions.

Payment information

Payment providers may process:

• Payment-card information;
• Bank or account information;
• Payment method;
• Payment confirmation;
• Transaction identifiers; and
• Fraud-prevention information.

We do not ordinarily store or have direct access to complete payment-card details. Payments are processed through Shopify’s checkout infrastructure and payment providers such as PayFast.

Delivery information

• Recipient details;
• Delivery address;
• Selected PUDO locker;
• Courier instructions;
• Tracking number;
• Delivery status;
• Proof of delivery; and
• Communications relating to delivery.

Communications

We may process information you provide when you contact us through:

• Email;
• WhatsApp;
• Telephone;
• Contact forms;
• Social media;
• Product reviews; or
• Other customer-support channels.

Reviews and submitted content

Where you submit a review or other content, we may process:

• Your name or displayed name;
• Rating;
• Written review;
• Photographs or videos;
• Product and order information; and
• Information used to verify that the review relates to a genuine purchase.

Device and usage information

We and our service providers may automatically collect:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Device identifiers;
• Website pages viewed;
• Links or buttons selected;
• Date and time of access;
• Referring website;
• Shopping-cart activity; and
• Cookie and similar technology information.

Marketing information

Where applicable, we may process:

• Marketing preferences;
• Subscription status;
• Advertising interactions;
• Products viewed or added to a cart;
• Email engagement information; and
• Information used to measure campaign performance.

6. How we collect personal information

We may collect personal information:

• Directly from you when you place an order, create an account, subscribe, contact us or submit a review;
• Automatically when you use the Website;
• From Shopify and other service providers that support the Website;
• From payment providers;
• From courier and PUDO delivery providers;
• From review platforms;
• From advertising and analytics providers where enabled;
• From fraud-prevention and security services; and
• From publicly available or lawful third-party sources.

Where reasonably practicable, we collect personal information directly from you.

7. Grounds for processing personal information

We process personal information only where permitted by law. Depending on the circumstances, processing may be justified because:

• You have consented to the processing;
• Processing is necessary to conclude or perform a contract with you;
• Processing is required by law;
• Processing protects your legitimate interests;
• Processing is necessary for the proper performance of a public-law duty; or
• Processing pursues our legitimate interests or those of a third party without unjustifiably affecting your rights.

Where we rely on consent, you may withdraw that consent. Withdrawal will not affect processing that was lawful before consent was withdrawn or processing permitted on another lawful basis.

8. How we use personal information

We may use personal information to:

Operate the Website and provide our services

• Display and maintain the Website;
• Create and manage customer accounts;
• Remember customer preferences;
• Provide shopping-cart and checkout functionality;
• Improve Website navigation and performance; and
• Recommend relevant products.

Process orders and payments

• Confirm customer and order details;
• Process and verify payments;
• Detect payment errors or suspected fraud;
• Send order notifications;
• Prepare and fulfil orders; and
• Maintain transaction records.

Arrange delivery

• Provide delivery information to couriers;
• Process PUDO deliveries;
• Send tracking information;
• Resolve delivery problems; and
• Confirm delivery.

Handle returns and customer support

• Respond to questions;
• Process cancellations, returns, exchanges and refunds;
• Investigate damaged, missing or incorrect orders;
• Manage complaints; and
• Maintain records of customer interactions.

Marketing and advertising

Where we have a lawful basis, we may:

• Send promotional emails or messages;
• Inform you about products, promotions and launches;
• Display relevant advertising;
• Measure marketing performance; and
• Analyse engagement with our communications.

Security and fraud prevention

We may use information to:

• Protect customer accounts;
• Verify transactions;
• Detect and investigate fraud;
• Prevent malicious or unlawful activity;
• Secure our Website and systems; and
• Protect our legal rights and those of customers or third parties.

Business improvement

We may analyse information to:

• Understand how customers use the Website;
• Improve products and customer service;
• Identify Website errors;
• Develop new products or services; and
• Produce aggregated or anonymised business statistics.

Legal and regulatory purposes

We may process information to:

• Comply with legal, tax, accounting and regulatory obligations;
• Respond to lawful requests from public authorities;
• Establish, exercise or defend legal claims;
• Enforce our Terms and policies; and
• Maintain records required by law.

9. Direct marketing

We will send electronic direct marketing only where permitted by POPIA, ECTA and other applicable law.

Where consent is required, marketing consent will be requested separately and will not be made a condition of purchasing a product unless the marketing is genuinely necessary for that transaction.

You can unsubscribe from marketing emails by using the unsubscribe link included in the message or by contacting us.

Where marketing is sent through WhatsApp, SMS or another channel, you may opt out using the method provided in the message or by asking us to stop.

Opting out of marketing will not prevent us from sending non-promotional communications relating to:

• Existing orders;
• Delivery;
• Returns or refunds;
• Account security;
• Product safety; or
• Other service-related matters.

We will maintain an appropriate suppression record to avoid sending further marketing after a valid opt-out request.

10. Cookies and similar technologies

The Website and our service providers may use cookies, pixels, tags, local storage and similar technologies.

These technologies may be used to:

• Keep the Website functioning;
• Remember cart contents and preferences;
• Authenticate customer accounts;
• Protect the Website against fraud;
• Understand Website usage;
• Measure performance;
• Support advertising; and
• Personalise content where permitted.

Cookies may include:

Essential cookies

These are necessary for the Website, cart, checkout, security and customer-account functions.

Analytics cookies

These help us understand how customers use the Website and identify improvements.

Advertising cookies

Where enabled and lawfully permitted, these may be used to measure advertising and show more relevant marketing.

You may manage cookies through available Website controls or your browser settings. Blocking essential cookies may prevent parts of the Website or checkout from working correctly.

Where consent is legally required for a non-essential cookie, we will request it through an appropriate consent mechanism.

11. How we disclose personal information

We may disclose personal information only where reasonably necessary and lawfully permitted.

Recipients may include:

• Shopify, which hosts and supports our online store;
• Payment providers, including PayFast;
• Banks and financial institutions involved in payment or refund processing;
• Courier and delivery providers, including Courier Guy and PUDO;
• Review providers, including Judge.me;
• Email, communication and customer-support providers;
• Analytics and advertising providers, where enabled;
• Website developers, hosting, security and IT service providers;
• Professional advisers, including accountants, auditors, insurers and attorneys;
• Government bodies, regulators or law-enforcement authorities, where legally required; and
• A purchaser, successor or adviser involved in a genuine sale, restructuring or transfer of the business.

Service providers acting as operators are expected to process personal information only for authorised purposes and to implement appropriate security safeguards.

We do not disclose personal information merely because a third party requests it. A lawful basis or legal obligation must exist.

12. Relationship with Shopify

Our Website and online store are powered by Shopify.

Shopify processes information relating to your access to and use of the Website to provide services such as:

• Website hosting;
• Shopping-cart functionality;
• Checkout;
• Customer accounts;
• Order management;
• Security;
• Fraud prevention; and
• Store analytics.

Information submitted through the Website may be transmitted to and processed by Shopify and its service providers in countries outside South Africa.

Shopify may act as our operator for certain processing and as an independent responsible party for processing it determines separately.

More information is available in the Shopify Consumer Privacy Policy and through the Shopify Privacy Portal.

Requests concerning information processed independently by Shopify may need to be submitted directly to Shopify.

13. Payment processing

Payments may be processed through Shopify’s checkout infrastructure and independent payment providers such as PayFast.

Payment providers may collect and process payment information under their own privacy policies and security standards.

We ordinarily receive confirmation of the transaction, the payment status and limited payment-related details rather than complete payment-card information.

Customers should review the applicable payment provider’s privacy and security information before completing payment.

14. Delivery providers

To deliver an order, we may provide couriers and PUDO service providers with information such as:

• Recipient name;
• Delivery or locker address;
• Telephone number;
• Email address;
• Order or parcel reference; and
• Delivery instructions.

This information must be used for arranging, completing and communicating about the delivery, or for another purpose lawfully permitted by the provider’s privacy policy.

15. Third-party websites and social media

The Website may contain links to third-party websites, social-media platforms or external services.

These services operate independently and have their own privacy policies.

We are not responsible for how an independent third party processes information that you provide directly to it. We encourage you to review the third party’s privacy information before providing personal information.

Information posted in a public or semi-public area of a social-media or review platform may be visible to other users.

The inclusion of a link does not necessarily constitute endorsement of every aspect of the external service.

16. International transfers

Shopify and some of our service providers may process or store personal information outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with section 72 of POPIA.

This may include transferring information where:

• The recipient is subject to a law, binding corporate rules or an agreement that provides an adequate level of protection;
• You have consented to the transfer;
• The transfer is necessary to perform a contract with you;
• The transfer is necessary to conclude or perform a contract in your interests; or
• Another lawful basis applies.

The laws of another country may differ from South African privacy law.

17. Information security

We implement reasonable technical and organisational safeguards appropriate to the nature of the personal information we process.

These measures may include:

• Access restrictions;
• Authentication controls;
• Secure payment processing;
• Software and security updates;
• Data-backup measures;
• Service-provider safeguards; and
• Measures designed to detect unauthorised access or loss.

No system or transmission method can be guaranteed to be completely secure. However, we will take reasonable steps to protect information against loss, damage, unauthorised destruction, access, use, alteration or disclosure.

You are responsible for protecting your account credentials and should not share passwords or authentication information with another person.

18. Security compromises

Where we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and take appropriate action.

Where required by POPIA, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, taking account of legitimate law-enforcement needs and the measures required to determine the scope of the compromise.

A notification may include available information about:

• The nature of the compromise;
• Possible consequences;
• Measures we have taken or intend to take; and
• Steps the affected person may take to protect themselves.

19. Retention of personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or as required or permitted by law.

Retention periods may depend on:

• Whether you maintain a customer account;
• The duration of our relationship with you;
• Tax, accounting and transaction-record obligations;
• Returns, warranties and potential disputes;
• Fraud-prevention requirements;
• Consent or marketing preferences; and
• Legal proceedings or regulatory requirements.

When personal information is no longer required, we will delete, destroy or de-identify it in a reasonably secure manner, unless continued retention is permitted or required by law.

20. Children’s personal information

Our Website and products are not directed primarily at children.

A person under 18 should use the Website or place an order only with the involvement and consent of a competent person, such as a parent or legal guardian.

We do not knowingly collect children’s personal information without appropriate consent or another lawful basis.

If you believe that a child has provided personal information unlawfully, contact us so that we can investigate and take appropriate action.

21. Automated processing and fraud screening

Shopify, payment providers or fraud-prevention services may use automated tools to assess transaction risk, detect suspicious activity or protect the checkout process.

Where a decision based solely on automated processing produces legal consequences or substantially affects you, your rights will be handled in accordance with POPIA.

You may contact us if you believe that an automated decision has incorrectly affected your order.

22. Your rights under POPIA

Subject to POPIA and any applicable limitations, you may have the right to:

• Ask whether we hold personal information about you;
• Request access to your personal information;
• Request correction of inaccurate or incomplete information;
• Request deletion or destruction of information that we are no longer authorised to retain;
• Object to certain processing on reasonable grounds;
• Withdraw consent where processing is based on consent;
• Object to direct marketing;
• Request information about the identity of third parties that have had access to your information;
• Request reasons for certain automated decisions; and
• Lodge a complaint with the Information Regulator.

These rights are not absolute. We may retain or continue processing information where required or permitted by law.

23. Exercising your rights

To submit a privacy request, contact us using the details at the end of this Policy.

Please describe your request clearly and provide enough information for us to identify the relevant records.

We may request reasonable proof of identity before giving access to, correcting or deleting personal information. This is necessary to prevent information from being disclosed to an unauthorised person.

We will respond within the period required by applicable law.

Where a request is refused or limited, we will provide an explanation where required.

Authorised representatives may submit requests on behalf of a data subject, but we may require proof of their authority and verification of the data subject’s identity.

24. Complaints

If you have concerns about our processing of personal information, please contact us first so that we can attempt to resolve the matter.

You also have the right to submit a complaint to the South African Information Regulator.

Information Regulator contact information and complaint procedures are available at:

Website: https://inforegulator.org.za/

Submitting a complaint does not prevent you from exercising any other right or remedy available under law.

25. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to our processing activities;
• New service providers or technology;
• Changes to the Website;
• Operational or security requirements; or
• Changes in applicable law.

The revised Policy will be published on the Website and the “Last updated” date will be changed.

Where required by law, we will provide additional notice or request fresh consent.

Changes will apply prospectively and will not make previously unlawful processing lawful.

26. Contact us

Questions, privacy requests and complaints may be directed to:

True Muscle Culture
Physical address: 52 Smith Avenue, Edenvale, Gauteng, 1613, South Africa
Email: Kiara@truemuscleculture.com
Telephone/WhatsApp: +27 60 704 1880
Website: www.truemuscleculture.com

We aim to acknowledge privacy enquiries within one to two business days.