Privacy Policy

About this policy

Last updated: 5 October 2026

This policy explains how FoodGrown collects, uses and shares personal information when you use www.foodgrown.co.za, and your rights under the Protection of Personal Information Act, 2013 (POPIA). When you click through to Dis-Chem, Facebook or Instagram, that business's own privacy policy applies.

1. Who we are and how to contact us

FoodGrown ("we", "us") is the responsible party for personal information collected through this website. This means we decide why and how it is used. Our products are sold through Dis-Chem.

Email: info@foodgrown.co.za
Address: Building 2, Boundary River Park, Northriding, Johannesburg, Gauteng, 2169, South Africa

Our Information Officer handles privacy requests and questions. Please email info@foodgrown.co.za and mark your email "Attention: Information Officer".

2. Information we collect

Information you give us

  • Contact form: your name, email address, phone number and message, which may include health details you choose to share (see section 3).
  • Site search: the words you type into the search box.
  • Customer account: if you sign in or create an account (hosted by Shopify), your email address and any name, address or other details you add.
  • Anything else: if you use the cart or checkout, or give us information another way, we collect what you provide.

Information collected automatically

When you visit, our website host's servers and our cookies, pixels and tags (see section 8) collect:

  • your IP address, device, browser and approximate location;
  • the site you came from and the pages and products you view, including the full web address (URL) of each page, which can contain words you typed into the search box or a form;
  • your scrolls and clicks, including "Shop Now" links to Dis-Chem and links to our social media pages;
  • pack-insert downloads, form starts and submissions, and searches;
  • online identifiers, such as cookie IDs, Google click IDs and Meta browser IDs.

POPIA treats this as personal information, so we do not treat it as anonymous.

Information from others

Google and Meta give us ad-performance reports, and Google (through Google signals) gives us combined age, gender and interest reports about groups of visitors. These reports do not identify you to us.

Do you have to give us information?

Giving us your details is voluntary, and you can browse without contacting us. Some information is collected automatically when you browse (see above); you can limit this with the tools in section 8. On the contact form only your email address is required; without it we cannot reply. No law requires you to give us information through this website. Some features, such as the account login, the cart and bot checks, need essential Shopify cookies and may not work if you block them.

3. Health information in your messages

Health information is "special personal information" under POPIA, which means the law gives it extra protection. Please do not include health or medical details in your message unless we need them to answer your question.

If you choose to include them, you consent to FoodGrown using them to respond to you and to keep a record of your enquiry. Shopify delivers your message to us and our email service provider stores it, and either may process it outside South Africa (see section 9). We do not use health details you send us to target or personalise advertising. You can withdraw this consent at any time by emailing info@foodgrown.co.za, and we will delete them unless the law requires us to keep them.

Please do not type personal or health details into the search box. The words you type may be shared with Google and Meta to measure and improve our advertising (sections 6 and 7).

4. How we use your information, and our lawful grounds

  • To answer your enquiry and keep a record of it: your legitimate interest in an answer and ours in responding (POPIA section 11(1)(d) and (f)); for health details, your consent (section 27(1)(a)).
  • To run your customer account: providing the account you set up (section 11(1)(b)) and our legitimate interests (section 11(1)(f)).
  • To show search results, and to understand and improve our site with Google Analytics and Shopify's analytics: our legitimate interests (section 11(1)(f)).
  • To measure and improve our advertising, by checking whether our Google and Meta ads lead to visits, searches, enquiries or clicks through to Dis-Chem, and by showing FoodGrown ads to people who visited our site (remarketing): our legitimate interest in promoting our products (section 11(1)(f)). You can object or opt out (sections 8 and 12).
  • To keep the site secure and prevent spam and abuse, using Shopify's security tools and hCaptcha: our legitimate interests (section 11(1)(f)).
  • To comply with the law (section 11(1)(c)).

A "legitimate interest" is a genuine business reason, such as running and promoting our website, that POPIA allows us to rely on. You can object to it (section 12).

We will not use your information for a new, unrelated purpose without telling you first, or getting your consent where the law requires it. We make no decisions with legal or similarly significant effects about you based solely on automated processing; ad platforms do personalise the ads you see (see section 8).

5. Who we share it with

  • Shopify, which hosts our website. Shopify collects and processes your personal information to run our pages, forms, search, accounts, cookies and security, and emails contact-form messages to us. It uses its own service providers and uses some information for its own purposes, as set out in the Shopify Consumer Privacy Policy. You can make requests to Shopify through Shopify's privacy controls.
  • hCaptcha (Intuition Machines, Inc.), loaded by Shopify. When you fill in our contact form or an account form, hCaptcha checks in the background whether you are a person, using device, browser, network and interaction data such as mouse movements. See the hCaptcha Privacy Policy.
  • Our email service provider, which hosts the inbox where contact-form messages arrive.
  • Google: Google Tag Manager, Google Analytics, Google Ads and Google Search Console (section 6).
  • Meta (Facebook and Instagram): the Meta Pixel and Meta Conversions API (section 7).
  • Professional advisers and authorities, where the law requires or allows it.

Depending on the recipient, this includes contact details, message content, online identifiers, device and usage data, page addresses, search terms, and contact details in coded (hashed) form.

Dis-Chem sells our products. When you click "Shop Now" or another Dis-Chem link, you go to dischem.co.za and Dis-Chem collects information under its own privacy policy. The link does not send your contact details to Dis-Chem, although your browser may tell Dis-Chem that you came from our site.

6. Google Analytics and Google Ads

We use Google Tag Manager to load Google's tags, and Google Analytics 4 to understand how our site is used. Google Analytics sets cookies on our own website address (first-party cookies), such as _ga, and records page views (including the full page address), scrolls, clicks, file downloads, form starts and submissions, and search terms. It is linked to Google Ads and Google Search Console.

Advertising Features. We use Google signals, demographics and interests reporting, and remarketing audiences through our Google Ads link. If you are signed in to Google with ad personalisation on, Google signals connects your visits across devices for our combined reports. We and Google use Google Analytics cookies together with Google advertising cookies and identifiers to measure our ads, build remarketing lists and show you our ads.

Google Ads and remarketing. Our Google Ads tags, including those added by Shopify's Google & YouTube app, record page views, product views, searches and clicks on links to Dis-Chem (and cart and checkout events if used), and set cookies such as _gcl_au. Third-party vendors, including Google, show our ads on sites across the internet and use cookies or device identifiers to show you ads based on your past visits to foodgrown.co.za. You can opt out of personalised Google ads with the tools in section 8.

Your contact details in coded form. When you submit our contact form, or otherwise give your email address, phone number, name or address on our site, our Google tags may detect them automatically, code (hash) them in your browser and send them to Google. Google uses them to match the submission to a Google account to measure whether our ads led to it, and may use them to improve ad delivery. If you sign in to an account or use the checkout, Shopify may also send your details in coded form to Google and Meta for the same purposes.

Google also uses information from our site for its own purposes, such as personalising ads and improving its services, under its own policies. Read more: How Google uses information from sites or apps that use its services, How Google uses cookies in advertising and the Google Privacy Policy.

7. Meta (Facebook and Instagram)

We use the Meta Pixel (in your browser, on every page) and the Meta Conversions API (copies of the same events, sent from Shopify's servers) through Shopify's Facebook & Instagram app. They record page views, product views and searches (and cart and checkout events if used), your IP address, browser and device information, and identifiers such as the _fbp and _fbc cookies. They may also include the address of the page you are on, your search terms and, for signed-in customers or checkouts, contact details in coded (hashed) form.

We use pixels, web beacons (small pieces of code that report your visit) and similar storage technologies from third parties, including Meta, to collect or receive information from our site. Meta and other third parties also collect information elsewhere online, and use it to provide measurement services and to target and deliver ads, including our ads to you and to similar people. Meta also uses it for its own purposes under the Meta Privacy Policy and Meta Cookies Policy.

We do not intend to send Meta health information, but the words you search for can reveal health interests, so please keep personal health details out of the search box (section 3). To opt out, see section 8.

8. Cookies and similar technologies

Cookies are small files stored on your device; pixels, tags and browser storage work similarly. Our site does not currently show a cookie banner, so these load when you visit. You can control them with the tools below.

Cookies on our site

  • Shopify, essential (for example _shopify_essential, localization, cart): session, cart, security and country settings. Kept up to 1 year.
  • hCaptcha, essential (hmt_id): bot protection on forms. Kept up to 30 days.
  • Shopify, analytics and marketing (_shopify_analytics, _shopify_marketing): site statistics and marketing attribution. Kept up to 1 year.
  • Google Analytics (_ga, _ga_497F6MFNTG): measuring how the site is used. Kept up to 2 years.
  • Google Ads (_gcl_au, _gcl_aw, and Google advertising cookies such as IDE): ad measurement and remarketing. _gcl cookies 90 days; IDE up to 2 years.
  • Meta (_fbp, _fbc): ad measurement and remarketing. See Meta's Cookies Policy for how long.

These names are examples, not a complete list; providers may add or change cookies.

How to control cookies and ads

9. Transfers outside South Africa

Our service providers store and process information outside South Africa:

  • Shopify: Ireland, Canada, the United States and other countries;
  • Google: the United States and other countries where Google or its own service providers have facilities;
  • Meta: the United States and other countries;
  • hCaptcha: the United States and other countries;
  • our email service provider: possibly outside South Africa.

These countries may not protect personal information to POPIA's standard. Under section 72 of POPIA, we rely on these providers' binding data-processing and data-protection terms. Where those do not apply, we rely on the transfer being needed to answer your request or being for your benefit, or, for health details in your messages, on your consent (section 3).

10. How long we keep it

  • Contact messages: as long as we need them to deal with your enquiry and any follow-up, and to keep a reasonable record of it, unless the law requires us to keep them longer.
  • Customer account: while the account exists, or until you ask us to close it.
  • Google Analytics: our current setting keeps event-level and user-level data for 14 months, and Google signals data follows the same limit. This setting does not cover Google Analytics' standard reports, which combine data from many visits and can include the web addresses of pages viewed; these may be kept longer.
  • Meta: Meta's terms let it keep website event data for up to two years. Audiences built from that data can be kept until they are deleted.
  • Everything else: only as long as needed for the purpose we collected it for, or as the law requires. When we no longer need information, we delete it or remove anything that identifies you.

11. Security

We take reasonable technical and organisational steps to protect your information. Shopify serves our site over an encrypted (HTTPS) connection, and we use service providers whose terms require them to protect the information they process. No internet transmission or storage is completely secure.

12. Your rights

Send requests to our Information Officer at info@foodgrown.co.za, or by post to the address in section 1. An email is enough; you may use the Information Regulator's Form 1 (objection) or Form 2 (correction or deletion), but you do not have to. We may ask you to prove your identity.

  • Access: you may ask us, free of charge, to confirm whether we hold personal information about you, and ask for a record or description of it, including which third parties have had access to it. A copy of records may carry the fee prescribed under the Promotion of Access to Information Act, 2000 (PAIA); if so, we will give you a written estimate first. We may refuse access only on grounds allowed by PAIA.
  • Correction and deletion: you may ask us, free of charge, to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we may no longer keep. We will tell you in writing what we did about your request, as soon as reasonably possible and within the time the POPIA regulations set.
  • Objection: you may object at any time, free of charge, on reasonable grounds, to our use of your information for analytics, advertising or other purposes based on our legitimate interests. You may object to direct marketing at any time. We will then stop that use unless the law allows it to continue. Because an email does not let us recognise your browser, the quickest way to stop analytics and advertising cookies on your device is to use the tools in section 8.
  • Withdrawing consent: where we rely on your consent, such as for health details, you may withdraw it at any time. This does not affect what we did before.
  • Complaints: you may complain to the Information Regulator. You are welcome to contact us first, but you do not have to.

We will respond as soon as reasonably possible. Please tell us if your details change or are wrong.

When we delete information at your request, we will also, where we can, ask our service providers to delete what they hold for us (for example Shopify account data, or Google Analytics data linked to your device). Google, Meta and Shopify also use some information for their own purposes under their own terms. We cannot delete that information for you, so please use their tools in sections 5 and 8.

You may also request access to records under PAIA from our Information Officer.

Information Regulator (South Africa)

  • Website: https://inforegulator.org.za
  • Online complaints: eServices complaints portal (register a profile first)
  • POPIA complaints: POPIAComplaints@inforegulator.org.za
  • General enquiries: enquiries@inforegulator.org.za
  • Phone: 010 023 5200 or toll-free 0800 017 160
  • Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

13. Direct marketing

We do not currently run a newsletter. We will only send you electronic marketing, such as emails, SMSs or WhatsApp messages, if you have agreed to receive it, and every message will say who it is from and how to stop it. Replying to your enquiry is not marketing. Remarketing ads (sections 6 and 7) are advertising based on your visits to our site; you can opt out (section 8) or object (section 12).

14. Children

Our website is meant for adults. If you are under 18, please do not send us information through the contact form or an account without a parent's or guardian's consent, or ask them to contact us for you. If we learn that a child has sent us information without that consent, we will delete it, unless the law requires us to keep it.

15. Changes to this policy

We will update this policy when our practices change and post the new version on this page with a new "Last updated" date.