Security Policy

Effective date: 21 September 2026

Coreline Commerce takes reasonable steps to protect customer information, project information and access entrusted to us during the provision of our digital business services.

Coreline Commerce is a trading name associated with K2026801063 (Pty) Ltd, a South African registered business entity directed by Ndinani Mbeki.

This Security Policy explains the general measures and responsibilities that apply when Coreline Commerce collects, stores, accesses or processes information in connection with its website, services and customer projects.

1. Our approach to security

Coreline Commerce aims to protect information against:

  • Unauthorised access;

  • Accidental loss;

  • Unauthorised disclosure;

  • Unauthorised alteration;

  • Misuse; and

  • Unauthorised destruction.

Security measures are applied in a manner appropriate to the nature of the information and the circumstances in which it is processed.

Coreline Commerce does not claim that any online system, electronic communication method or third-party platform can be completely secure.

2. Access to customer accounts

Some Coreline Commerce services require access to customer platforms or accounts.

Depending on the platform, we may require access to services such as:

  • Shopify;

  • Meta;

  • TikTok;

  • Google services;

  • Domain or website services;

  • Email services; or

  • Other platforms required for the agreed project.

Where the platform supports it, Coreline Commerce will seek to use appropriate user permissions, collaborator access or other access arrangements rather than requiring a customer's primary account password.

Access will be limited to what is reasonably necessary to perform the agreed work.

3. Customer account security

Customers remain responsible for maintaining the security of their own accounts and credentials.

Customers should:

  • Use strong, unique passwords;

  • Enable multi-factor authentication where available;

  • Avoid sharing passwords unnecessarily;

  • Review account permissions periodically;

  • Remove access that is no longer required; and

  • Notify the relevant platform if they suspect their account has been compromised.

Customers should not send passwords, payment-card information or other highly sensitive credentials through ordinary email unless a secure method has specifically been arranged.

4. Information handled during projects

Depending on the service, Coreline Commerce may handle information such as:

  • Customer contact information;

  • Business information;

  • Project information;

  • Website content;

  • Product information;

  • Creative files;

  • Account or platform information;

  • Project communications;

  • Transaction and payment information;

  • Files provided by customers; and

  • Other information reasonably required to provide the purchased service.

Personal information is handled in accordance with applicable privacy requirements and the Coreline Commerce Privacy Policy.

5. Third-party services

Coreline Commerce may use third-party services as part of its business operations and service delivery.

The technology and service environment may include:

  • Shopify;

  • Google Analytics;

  • Shopify Analytics;

  • Meta;

  • TikTok;

  • Google Drive;

  • Canva;

  • WhatsApp;

  • Email and email-marketing services; and

  • Payment providers used by Coreline Commerce.

Third-party providers operate their own systems and security controls. Coreline Commerce does not control the security practices, availability or infrastructure of third-party platforms.

Where customer information is processed by a third-party service provider, Coreline Commerce will take reasonable steps appropriate to the circumstances to use and manage those services in accordance with applicable requirements.

6. Storage of information

Customer and project information may be stored electronically using systems and services required for business operations and service delivery.

Coreline Commerce aims to limit access to information to what is reasonably necessary and to avoid retaining information for longer than reasonably required for legitimate business, contractual, legal or operational purposes.

Information may remain within third-party systems according to the retention practices of those providers.

The specific retention periods applicable to different categories of information are addressed in the Privacy Policy where relevant.

7. Security of communications

Coreline Commerce may communicate with customers through email, WhatsApp and other appropriate electronic channels.

Electronic communications may involve risks outside Coreline Commerce's control, including interception, delivery failure, compromised accounts or third-party service outages.

Customers should avoid sending highly sensitive information through ordinary communications unless it is necessary and an appropriate method has been agreed.

8. Payment security

Coreline Commerce does not intend to receive or store customers' full payment-card credentials directly through ordinary email or project communications.

Where an online payment provider is used, payment information may be processed through that provider's systems.

Paystack is an intended payment provider, but this arrangement is not yet confirmed. Once a payment provider is activated, payments will be subject to that provider's applicable security, processing and privacy arrangements.

Customers should never send their full card number, CVV or online-banking credentials to Coreline Commerce by email or WhatsApp.

9. Security incidents

If Coreline Commerce becomes aware of a suspected security incident involving customer or personal information, reasonable steps will be taken to investigate the incident, contain or mitigate the issue where possible, and determine whether further action or notification is required.

Where a security compromise involving personal information triggers notification obligations under applicable law, Coreline Commerce will make the required notifications in accordance with those legal requirements.

Section 22 of the Protection of Personal Information Act 4 of 2013 (POPIA) addresses notification requirements where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person.

10. Third-party security incidents

Where an incident occurs within a third-party service used by Coreline Commerce, the response may also depend on the third party's investigation, notification procedures and available information.

Coreline Commerce will take reasonable steps to understand the impact on information under its responsibility and respond according to applicable legal and contractual requirements.

11. Employee and contractor access

Where third parties or service providers are involved in a project or business operation, access to customer information will be limited to what is reasonably necessary for the relevant purpose.

Where applicable, confidentiality and security requirements may be imposed through the relevant agreement or working arrangement.

12. Customer-provided materials

Customers are responsible for ensuring that materials and information supplied to Coreline Commerce are provided through appropriate channels and do not unnecessarily contain sensitive information that is not required for the project.

Coreline Commerce may decline to accept information that is unnecessary for the agreed service.

Customers should also maintain their own backups of important business information, website content, product data and other materials.

13. Limitations

Coreline Commerce takes reasonable security measures but cannot guarantee that:

  • A system will never be compromised;

  • A third-party platform will always remain secure;

  • Electronic communications will never be intercepted;

  • An online service will never experience an outage; or

  • Unauthorised access can never occur.

Security risks can arise from circumstances outside Coreline Commerce's reasonable control, including third-party vulnerabilities, compromised customer accounts, platform incidents, malware, phishing, internet failures and other security threats.

Nothing in this section is intended to exclude or limit liability or rights that cannot lawfully be excluded or limited.

14. Privacy and data protection

Security measures form part of Coreline Commerce's broader privacy and data-protection practices.

Personal information is processed in accordance with applicable South African data-protection requirements, including the Protection of Personal Information Act 4 of 2013 (POPIA), where applicable.

POPIA requires reasonable technical and organisational measures to protect the integrity and confidentiality of personal information and to address reasonably foreseeable internal and external risks.

For information about what personal information Coreline Commerce collects, why it is collected, how it may be used and the rights available to data subjects, please refer to the Privacy Policy.

15. Reporting a security concern

If you believe that your Coreline Commerce project information, account access or personal information may have been compromised, please contact us as soon as reasonably possible.

Coreline Commerce
Associated registered entity: K2026801063 (Pty) Ltd
South Africa
Email: help.commercecoreline@outlook.com

Please provide enough information for the concern to be identified and investigated, but do not send passwords, full payment-card details or other unnecessary sensitive credentials.

16. Governing law

This Security Policy is governed by the laws of the Republic of South Africa, subject to applicable mandatory rights and protections.

Nothing in this Security Policy is intended to remove or limit any legal right or protection that cannot lawfully be excluded or limited.

17. Policy updates

Coreline Commerce may update this Security Policy when its services, technology environment, security practices or legal requirements change.

The version published on this website represents the current version of the policy.