Privacy policy

Last updated 21 September 2026

Cosmic Spa respects your privacy and processes personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Information we collect

• Account details: name, email address, phone number and password (stored only in encrypted, hashed form).
• Service and payment records: what you bought, when, order totals, points, vouchers and referral links.
• For ambassadors: bank payout references and payout history.
• Technical data needed to keep the site secure (for example sign-in attempts).

We do not collect or store your card number. Card payments happen on Yoco's secure payment page.

2. Why we use it

• To provide your services, bookings, rewards points, vouchers and ambassador commission.
• To process payments and refunds and to prevent fraud.
• To send account messages (password resets, vouchers).
• To send promotional emails only if you agreed. You can unsubscribe at any time.

3. Who we share it with

We only share information with service providers who help us run the business: Yoco (payment processing), our email and hosting providers, and our bank for commission payouts. We do not sell your personal information. We may disclose information where the law requires it.

4. Keeping it safe and how long

We use encrypted connections (HTTPS), hashed passwords, access controls and two-step verification for administrators. We keep records only as long as needed to provide services and meet legal and accounting duties, then delete or anonymise them.

5. Your rights

You may ask to see, correct or delete your personal information, object to its use, or withdraw marketing consent at any time. Email rewards@cosmicspa.co.za. If you are unhappy with how we handled a request, you may complain to the Information Regulator of South Africa (inforegulator.org.za).

6. Contact