Privacy Policy

This site is operated by Esite Online Services CC, registration number 2006/078051/23, a close corporation registered in South Africa (“Esite”, “we”, “us”). Esite provides a multi-tenant e-commerce platform to pharmacies and pharmacy groups.

Privacy and information-officer enquiries: hello@esite.co.za.

POPIA distinguishes between the party that decides why personal information is processed (the responsible party) and the party that processes it on their instruction (the operator). Esite occupies both roles, in different contexts:

• On this website (esite.co.za) and in our own sales and support dealings, Esite is the responsible party for the limited business-contact information described below.
• On a pharmacy storefront or app built on our platform, the pharmacy or pharmacy group is the responsible party for its customers’ personal information, including health information. Esite is its operator: we host and process that data on the pharmacy’s instruction and for no purpose of our own. The pharmacy’s own privacy notice governs that relationship, and requests about a shopping account, an order or a prescription should be directed to the pharmacy concerned.

• Information you send us. If you email us or request a demonstration, we receive your name, business email address, telephone number, pharmacy or group name, and whatever else you choose to include.
• Sample data you supply. Where you send us a Unisolv or ProPharm export so we can demonstrate the platform on your own catalogue, we treat it as confidential, use it only for that demonstration, and delete it on request or when the evaluation ends.
• Technical request data. Our content delivery network records standard server log information — IP address, date and time, page requested, referrer and user agent — to serve the site, keep it secure and diagnose faults.

This marketing site does not run advertising trackers or third-party analytics profiling, and it does not set cookies for advertising purposes.

• To respond to your enquiry, prepare a proposal and carry out a demonstration.
• To provide, support, secure and improve the platform under a signed agreement.
• To meet our own legal, tax and record-keeping obligations.
• To protect the platform against fraud, abuse and unauthorised access.

We do not sell personal information, and we do not use client or customer data to train third-party models. Where the platform uses AI to draft product copy or page content, only product and catalogue text is submitted — never customer, patient or prescription data.

We use a small number of processors to run the service, each bound to confidentiality and to processing only on our instruction:

• Amazon Web Services — hosting, storage, database and email delivery. Platform data is hosted in the AWS Africa (Cape Town) region.
• Paystack — payment processing and payouts on storefront checkouts.
• Sage Business Cloud Accounting and Xero — only where a store connects its own accounting account, under that store's own authorisation.
• Google and Meta — only where a store opts in to publish a product feed for advertising, and only for the products it opts in.

Some processors operate infrastructure outside South Africa. Where personal information crosses a border, it is transferred under contractual terms that provide protection substantially similar to POPIA. We disclose information to anyone else only with your instruction, or where the law requires it.

• Encryption in transit (TLS) and at rest, including for uploaded prescription files.
• Strict tenant isolation, so no pharmacy on the platform can see another's products, orders, customers or prescriptions.
• Role-based staff access, with an append-only audit trail of privileged actions.
• Least-privilege infrastructure access, backups, and point-in-time database recovery.

No system is absolutely secure, but if a security compromise affecting personal information occurs we will notify the affected responsible party and, where POPIA requires, the Information Regulator and the data subjects.

Enquiry correspondence is kept for as long as we are in contact and for a reasonable period afterwards. Data we hold as an operator is retained for as long as the client’s agreement requires, and on termination is exported to the client and then deleted on their instruction. Records we must keep by law are kept for the period the law prescribes.

Under POPIA you may, subject to its conditions:

• Ask what personal information we hold about you, and request a copy.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully.
• Object to processing, and withdraw a consent you previously gave.
• Complain to the Information Regulator of South Africa.

Send requests to hello@esite.co.za. If your request concerns your account with a pharmacy that uses our platform, we will refer it to that pharmacy as the responsible party and assist them in answering it.

We may update this policy as the platform and the law develop. The current version is always published at esite.co.za/privacy, with the date it took effect shown above.