This Policy describes how we collect, use, store, and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").
1. Information Officer
The Information Officer is responsible for ensuring compliance with POPIA. Contact details are on our Contact page.
2. Information We Collect
We may collect: full name, email, phone, delivery address, company details, VAT/registration numbers, billing and shipping addresses, order history, communication records, and website usage data (cookies, IP address, browser type).
3. Purpose of Collection
- To fulfil orders and process payments
- To communicate about orders and enquiries
- To improve our products and services
- To comply with legal obligations
- To send marketing communications (with your consent)
4. Lawful Basis for Processing
- Contract: necessary to fulfil our agreement
- Legal obligation: compliance with laws
- Legitimate interest: operating our business
- Consent: where you have given clear consent
5. Disclosure of Information
We may share information with payment processors, courier providers, professional advisors, and regulatory authorities where required by law. We do not sell your personal information.
6. Data Security
We implement industry-standard security measures including:
- Encryption at rest: sensitive personal and financial data is encrypted using AES-256
- Encryption in transit: all data transmitted via encrypted connections (HTTPS/SSL)
- Secure password storage: passwords are hashed using bcrypt
- Access controls: role-based permissions limit data access to authorised staff
- Regular backups: data is backed up regularly to prevent loss
7. Your Rights
- Access: request a copy of your personal information
- Correction: request correction of inaccurate or incomplete data
- Deletion: request deletion of information no longer needed
- Objection: object to processing based on legitimate interests
- Withdraw consent: withdraw consent at any time (where processing is consent-based)
- Complain: lodge a complaint with the Information Regulator (www.justice.gov.za/inforeg)
8. Retention
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Retention periods include:
- Client records: retained while the relationship exists and for up to 3 years after last activity
- Invoice and payment records: retained for 5 years as required by tax law
- Activity logs: retained for 12 months
- Login attempt records: retained for 90 days
When no longer needed, information is securely deleted or anonymised.
9. Cookies
Our website uses cookies to enhance your browsing experience. You can manage cookie preferences through your browser settings.
10. Changes to This Policy
We may update this policy from time to time. Changes will be posted on this page with an updated effective date.
11. Contact Us
For questions about this policy or to exercise your rights, please contact us via our Contact page.
