Privacy Policy

Who is responsible for your information.

Envision Nathanael (Pty) Ltd is the responsible party for personal information that it determines the purpose and means of processing through Nathanael, myNathanael, Nathanael+, publishing enquiries and related customer operations.

What we may collect.

• Identity and contact information: name, email address, telephone number and account identifiers.
• Delivery information: delivery address, city, province, postal code and delivery instructions.
• Account information: login credentials in protected form, account status, saved preferences, wishlist data and customer-support history.
• Transaction information: orders, products, formats, amounts, payment status, payment references, refunds and fulfilment records.
• Reading information: purchased digital entitlements, Nathanael+ membership level, book selections, reading progress and reader state needed to provide the service.
• Publishing information: publishing enquiry details, quotation information and any manuscript or sample voluntarily uploaded for a quotation or publishing workflow.
• Technical information: IP address, device/browser information, timestamps, security logs and similar data reasonably required to operate, secure and troubleshoot the platform.
• Communication preferences: newsletter subscription, marketing consent or objection, and unsubscribe status.

We do not intentionally collect more personal information than is reasonably relevant to the purpose for which it is requested.

Why we process personal information.

Personal information may be processed where necessary to enter into or perform a transaction, comply with law, protect legitimate business or security interests, administer a customer relationship, or where valid consent or another lawful basis applies.

• create and secure myNathanael accounts;
• process orders, payments, refunds and customer support;
• pack, dispatch, track and deliver physical goods;
• grant and secure purchased eBook access;
• administer Nathanael+ memberships, allowances and recurring payment status;
• maintain reading progress requested by the customer;
• respond to publishing enquiries and prepare requested quotations;
• prevent fraud, abuse, unauthorised access and security incidents;
• maintain accounting, tax, legal and operational records;
• improve service reliability and understand platform performance; and
• send marketing only where permitted by applicable law.

Information collected for one purpose will not be reused incompatibly merely because it is technically available.

Payment information.

Online payments are processed through third-party payment infrastructure. Nathanael may receive transaction references, payment status, amount, payer identity details and related information needed to reconcile a transaction, investigate fraud, fulfil an order or administer a subscription.

Nathanael does not require customers to disclose full payment-card credentials directly into Nathanael’s own order database where the payment provider hosts the secure payment entry process. The payment provider processes payment information under its own legal and security obligations.

Who may receive information.

Nathanael does not sell personal information. Information may be disclosed only where reasonably necessary for a lawful purpose, including to:

• payment processors and financial-service providers involved in a transaction;
• courier and logistics providers who need delivery information to carry a parcel;
• hosting, email, backup, security and technology service providers;
• professional advisers, auditors, insurers or legal representatives where necessary;
• regulators, law-enforcement bodies, courts or public authorities where disclosure is lawfully required; and
• a successor or acquirer in a lawful restructuring or sale of the business, subject to applicable information-protection obligations.

Service providers should receive only the information reasonably required for their function and are expected to process it consistently with applicable law and their contractual role.

Where personal information is transferred outside South Africa, Nathanael will use lawful cross-border transfer mechanisms and safeguards required by POPIA.

Newsletters and direct marketing.

Nathanael may send transactional messages necessary for an account, purchase, delivery, publishing enquiry or membership. These operational messages are different from promotional marketing.

Electronic direct marketing will be sent only where permitted by law. Where consent is required, Nathanael will seek it. Where an existing-customer basis or another lawful basis applies, marketing will remain subject to the customer’s right to object or unsubscribe.

An unsubscribe request stops the relevant marketing stream but does not prevent essential transactional or legal communications connected to an active account, order or subscription.

Sessions, cookies and logs.

Nathanael may use session cookies and similar technology that are necessary for functions such as account authentication, shopping-cart state, security and preference continuity. Where analytics or other non-essential technologies are enabled, they are used to understand performance and usage rather than to create an unrestricted personal profile.

Browser settings can restrict cookies, but blocking essential cookies may prevent login, cart, checkout, reader or account functions from working correctly.

We do not keep everything forever.

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, for the duration of an active customer relationship, or for a longer period where accounting, tax, legal, fraud-prevention, dispute or other lawful recordkeeping obligations require it.

When information is no longer lawfully required, Nathanael may delete, destroy, de-identify or securely archive it as appropriate. A deletion request does not require Nathanael to erase records that the law requires or permits it to retain.

Reasonable safeguards.

Nathanael uses reasonable administrative, technical and organisational measures appropriate to the information and service, including access controls, protected authentication, transaction verification, restricted digital-content delivery and security logging.

No internet service can guarantee that a compromise will never occur. Where a security compromise affecting personal information triggers a notification duty, Nathanael will handle notification and remediation in accordance with applicable law.

Customers must protect their passwords and should notify Nathanael promptly if they reasonably suspect that an account has been compromised.

Access, correction, objection and deletion.

Subject to POPIA and other applicable law, a data subject may ask whether Nathanael holds personal information about them, request access where permitted, request correction or deletion of inaccurate or unlawfully retained information, object to certain processing, or withdraw consent where processing depends on consent.

Nathanael may require reasonable identity verification before releasing, correcting or deleting account information. This protects the customer against an unauthorised request made by another person.

Personal information of children.

Nathanael’s transactional account and payment functions are intended for persons who have the legal capacity to enter the relevant transaction, or who act with the lawful involvement of a competent person where required.

Nathanael does not knowingly seek to process children’s personal information in a way that requires special authorisation or consent without first establishing an appropriate lawful basis.

Privacy requests.

Privacy requests should be sent to sales@nathanael.co.za with “Privacy Request” in the subject line. Please describe the request clearly and provide only the identity information reasonably necessary for verification.

A person who believes their personal information has been processed unlawfully may also use the complaint mechanisms available through the Information Regulator (South Africa), subject to the Regulator’s procedures and jurisdiction.