Privacy Policy · Last updated 26 October 2026
WATER INNOVATIONS (PTY) LTD (registration number 2026/618059/07) is the responsible party for the personal information described in this policy. We collect and use personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA) and we keep to the eight conditions for lawful processing.
1. Who to contact
Our Information Officer handles privacy questions and requests. Email mo@greyonion.com (marked “Privacy”) or write to 8 Northfield Avenue, Glenhazel, Johannesburg, Gauteng, 2192, South Africa. Telephone 082 454 5458. We respond within 30 days, as POPIA requires.
2. What we collect, and why
| When | What | Why |
|---|---|---|
| Browsing | IP address, browser type, pages visited, referring page, date and time | Server logs, security and diagnosis of faults |
| Cart and checkout | Name, email address, telephone number, delivery address, order contents, delivery preference | To quote, deliver, invoice and support the order |
| Creating an account (optional) | Name, email address, password, order history | So you can see past orders and track them |
| Payment | Handled by PayFast; we receive the result, the amount, and a transaction reference — not your card or banking password | To take payment, and to refund through the same method |
| Sufficiency check before buying | Your answers, name, email address, telephone number, suburb and photographs of your bathroom, toilet or pool | To judge whether the system will actually fit and work, and to quote for it |
| Contacting us | Whatever you send us in an email or by phone | To answer you and keep a record of the query |
We do not collect special personal information (such as health data), we do not buy or rent personal information, and we do not profile you or run marketing analytics.
3. Who else sees it
- PayFast (Payfast by Network) — processes the payment and refunds. Their own privacy policy applies to the payment page.
- Our courier and hosting provider — get only what they need to deliver your order or run the servers, and act on our instructions as operators.
- Professional advisers, auditors, or a court or regulator — only where the law requires it.
We do not sell or trade personal information. If personal information is ever processed outside South Africa, we do so only where the recipient is subject to a law or binding agreement that gives an adequate level of protection, and we will say so here.
4. Photos you upload to us
Some of our system pages ask you to upload photographs of your bathroom, toilet, container or pool so that we can judge whether a POOLFLUSH system will fit and work properly. These photos are personal information about your home, so we treat them carefully:
- They are not public. Uploaded photos are not added to our website’s media library and are never displayed on the site, in a gallery, or anywhere else that can be reached by a search engine or the public.
- Only authorised staff can see them. They are stored in a private location and can only be opened by signing in to our administration area with an account that is permitted to review enquiries.
- They are used only to assess your installation and to quote — not for marketing, advertising, or any other purpose, and never sold or shared with advertisers.
- They are deleted when no longer needed — see the retention periods below.
- Please do not upload anything you would not want us to see. Photograph the toilet, the pipe and the surrounding area; there is no need to include people, documents or valuables in the frame.
You must be entitled to send us the photographs you upload — for example, the owner or tenant of the property, or someone acting with their permission.
5. Cookies
This site sets only the cookies a shop needs to work, and no advertising or analytics cookies. In practice: a session cookie that keeps your cart while you browse, a logged-in cookie if you sign in, WooCommerce’s cart and “recently viewed” cookies, and a short-lived random token used so that the suitability form can show you your own result after you submit it. All are functional, none track you across other sites, and all are removed when they expire or when you clear your browser. Because none of them track you across other sites, we do not show a cookie-consent wall.
6. How long we keep it
- Order and invoice records: 5 years after the order, to meet tax and company law.
- Account details: while your account is open; delete it and we remove the account information, keeping only the order records the law requires.
- Suitability enquiries and their photos: 6 months (about 180 days) after you send them, after which they are deleted automatically. We keep them that long because an installation may be quoted now and accepted months later.
- Server logs: up to 90 days, unless needed to investigate a security incident.
When a retention period ends we delete or de-identify the information.
7. Your rights
Under POPIA you may ask us to:
- confirm what personal information we hold about you, and give you a copy of it;
- correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- withdraw consent to processing that relies on your consent (this may mean we can no longer serve your order);
- object to processing, including for direct marketing, which you can always refuse and never have to opt out of again;
- complain to the Information Regulator (South Africa), at inforegulator.org.za, if we get something wrong.
To exercise a right, email mo@greyonion.com. We respond within 30 days and may ask for proof of identity so we do not give your information to someone else. We will not charge a fee for a reasonable request.
8. Security
We protect personal information with technical and organisational measures: the site is served over HTTPS, access to the store’s administration is restricted to named people with individual logins, data is held only in access-controlled systems, and payment details are handled only by PayFast. Photographs you upload through a suitability check are stored in a private location that the web server refuses to serve, are given randomised file names so they cannot be guessed, and are only reachable by a member of staff who has signed in. If a security compromise affects your personal information, we notify you and the Information Regulator as POPIA requires.
9. Your responsibility
If you create an account, keep your password to yourself. Choose a password you do not use anywhere else, and tell us at once if you think someone else has got hold of it. We never ask for your password by email, telephone or WhatsApp.
10. Changes to this policy
We may update this policy if our practices change, and the date at the top of this page shows the current version. A material change is announced on this page before it takes effect.