Privacy notice

How DRAFT handles your information.

Effective 13 September 2026 · South Africa

1. Who is responsible

Draft Skincare (Pty) Ltd, trading as DRAFT, is the responsible party for personal information collected through draftbody.com, the Founders List, DRAFT Product and OPEN LAB activities. Our initial market is South Africa. Contact our Information Officer through hello@draftbody.com.

2. Information we collect

We collect information you provide, including your name, email address, Founder position, referral code, referral source, messages, marketing consent and communication preferences. If you complete a Founder Profile, we also collect your voluntary answers about sports and movement, facial and body skin characteristics and concerns, hair and scalp characteristics, product preferences, purchasing preferences, event interests, broad location and optional demographic information. We do not request medical diagnoses in the general Founder Profile.

If you later join a specific product test, we may request additional suitability and product-experience information under separate Prototype terms and consent.

3. Why we use it

• Reserve and administer your Founders List position.
• Send requested confirmations, launch information and OPEN LAB invitations.
• Create your private Founder research profile and match relevant Prototype opportunities.
• Analyse grouped Founder insights, develop products and plan Founder events.
• Operate referrals and priority allocations.
• Respond to questions and improve DRAFT products and services.
• Protect the website, prevent abuse and comply with legal obligations.

4. Our lawful basis

We process information with your consent, to take steps you request before a possible contract, to perform a contract when one exists, to meet legal obligations, and for legitimate business interests that do not override your privacy rights. We request separate, explicit consent for electronic direct marketing. You can withdraw it at any time without affecting earlier lawful processing.

5. Sharing and international processing

We use carefully selected service providers for website hosting, database storage, domain services and email delivery. These providers process information only to supply those services. Some may process information outside South Africa; where that happens, we take reasonable steps to use appropriate contractual and security safeguards. We do not sell personal information.

6. Retention and security

Founder Profile responses are linked to an internal Founder identifier and kept in a restricted research database. Complete responses are not published or placed in general marketing lists. We keep information only as long as reasonably needed for the purposes above, legal requirements and legitimate recordkeeping. We use access controls, authentication, encrypted connections and reputable service providers, but no online system can be guaranteed completely secure.

7. Your rights

Subject to POPIA, you may ask whether we hold your information, request access, correction or deletion, object to certain processing, withdraw marketing consent, or complain to South Africa’s Information Regulator. We may need to verify your identity before acting on a request.

8. Children

The Founders List and product-testing programmes are intended for people aged 18 or older. Do not submit a child’s personal information through the website.

9. Cookies and measurement

The current website uses only technology required to operate its pages and forms. If we introduce optional analytics or advertising technologies, we will update this notice and request consent where required before activating them.