PRIVACY POLICY
Effective date: [DD Month YYYY]
Last updated: [DD Month YYYY]
Version: 1.0
1.INTRODUCTION
[Full Legal Name], registration number [Registration Number], trading as [Trading Name] (“we”, “us” or “our”), respects your privacy and is committed to protecting your Personal Information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African law.
This Privacy Policy explains how we collect, use, disclose, store and protect Personal Information when you visit [Website URL], contact us, create an account, place an order, subscribe to communications or otherwise interact with us.
2.RESPONSIBLE PARTY AND CONTACT DETAILS
Responsible party: [Full Legal Name]
Registration number: [Registration Number]
Physical address: [Physical Address]
Email address: [General Email Address]
Telephone number: [Telephone Number]
Information Officer: [Name or Role]
Information Officer email: [Information Officer Email]
3.PERSONAL INFORMATION WE COLLECT
Depending on how you interact with us, we may collect:
3.1 identity information, such as your name, title, identity or registration details where reasonably required;
3.2 contact information, such as your email address, telephone number, billing address and delivery address;
3.3 account information, such as your username, password credentials and account preferences;
3.4 transaction information, such as products or services purchased, order history, invoices, delivery details, refunds and payment status;
3.5 payment-related information processed by our payment service provider. We do not ordinarily receive or store your complete card details where payment is processed directly by the provider;
3.6 communications, enquiries, complaints, reviews and other information you submit to us;
3.7 marketing preferences and records of consent, objections or opt-outs;
3.8 technical and usage information, such as IP address, browser type, device information, approximate location, pages viewed, referring pages, cookie identifiers and security logs;
3.9 any other Personal Information you voluntarily provide or that we are legally entitled or required to collect.
4.HOW WE COLLECT PERSONAL INFORMATION
We may collect Personal Information:
4.1 directly from you through forms, checkout, account registration, email, telephone, messaging platforms or other communications;
4.2 automatically through cookies, server logs, analytics, security tools and similar technologies;
4.3 from payment providers, couriers, service providers, business partners or public sources where lawful and reasonably necessary;
4.4 from a person acting on your behalf, where that person is authorised to provide the information.
5.PURPOSES FOR PROCESSING
We may process Personal Information to:
5.1 provide and operate the Website;
5.2 respond to enquiries and provide customer support;
5.3 create and manage user accounts;
5.4 process orders, payments, deliveries, collections, returns and refunds;
5.5 issue quotations, invoices, statements and transaction records;
5.6 verify identity, prevent fraud and protect the security of our systems and users;
5.7 comply with tax, accounting, consumer-protection, record-keeping and other legal obligations;
5.8 manage complaints, disputes and legal claims;
5.9 improve our Website, products, services and customer experience;
5.10 send service and transactional communications;
5.11 send direct marketing where permitted by law;
5.12 conduct analytics, reporting and business administration;
5.13 perform any other purpose that is compatible with the original purpose or that we explain at the time of collection.
6.LEGAL JUSTIFICATIONS
Depending on the circumstances, we process Personal Information because:
6.1 it is necessary to conclude or perform an agreement with you;
6.2 it is required by law;
6.3 it protects your legitimate interests;
6.4 it is necessary for our legitimate interests or those of a third party, provided that your rights and interests are not unjustifiably affected;
6.5 you have consented, where consent is required.
You may withdraw consent at any time, but withdrawal does not affect processing that was lawful before withdrawal or processing based on another lawful justification.
7.MANDATORY AND VOLUNTARY INFORMATION
Where information is required to process an order, provide a service, comply with law or protect against fraud, failure to provide it may prevent us from completing the relevant transaction or request. Optional information will be identified where reasonably possible.
8.SHARING PERSONAL INFORMATION
We may share Personal Information with carefully selected operators and third parties, including:
8.1 website hosting, IT, security, backup and support providers;
8.2 payment gateways and financial institutions;
8.3 couriers, logistics and fulfilment providers;
8.4 email, messaging, customer-service and marketing platforms;
8.5 analytics, advertising and social-media platforms where permitted;
8.6 accountants, auditors, legal advisers, insurers and professional consultants;
8.7 regulators, courts, law-enforcement authorities or public bodies where required or permitted by law;
8.8 a purchaser, investor or adviser involved in a legitimate business sale, merger or restructuring, subject to appropriate safeguards.
We do not sell Personal Information to advertisers.
9.OPERATORS
Where another party processes Personal Information for us as an operator, we require appropriate confidentiality, security and processing obligations consistent with POPIA.
10.CROSS-BORDER TRANSFERS
Some service providers may process information outside South Africa. Where Personal Information is transferred internationally, we will take reasonable steps to ensure that the transfer is permitted under POPIA and that appropriate safeguards apply.
11.RETENTION
We retain Personal Information only for as long as reasonably necessary for the purposes described in this Policy, including legal, tax, accounting, warranty, fraud-prevention, dispute and record-keeping requirements.
Retention periods vary by category. When information is no longer required, we will delete, destroy or de-identify it in a secure manner, subject to lawful exceptions.
12.SECURITY
We use reasonable technical and organisational safeguards appropriate to the nature of the information and the risks involved. These may include access controls, authentication, encryption where appropriate, secure hosting, software updates, backups, monitoring and staff or supplier confidentiality obligations.
No internet-based system is completely risk-free. You should protect your login details and notify us promptly if you suspect unauthorised use of your account.
13.SECURITY COMPROMISES
Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, we will investigate and notify the Information Regulator and affected data subjects where required by POPIA, subject to lawful delay or restriction.
14.YOUR RIGHTS
Subject to POPIA and applicable law, you may have the right to:
14.1 ask whether we hold Personal Information about you;
14.2 request access to that information;
14.3 request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information;
14.4 object to certain processing on reasonable grounds;
14.5 withdraw consent where processing is based on consent;
14.6 object to direct marketing and unsubscribe from marketing communications;
14.7 lodge a complaint with the Information Regulator;
14.8 seek a remedy through an appropriate court or other forum.
We may need to verify your identity before acting on a request. Certain requests may be limited by legal obligations, the rights of others or lawful retention requirements.
15.DIRECT MARKETING
We send electronic direct marketing only where permitted by POPIA. Where consent is required, we will request it separately. Existing customers may receive marketing about our own similar products or services where the legal requirements are met.
You may opt out at any time using the unsubscribe method in the message or by contacting us. Transactional and service messages are not marketing and may still be sent where necessary.
16.COOKIES AND ANALYTICS
We use cookies and similar technologies as described in our Cookie Policy. Where required, non-essential cookies will be used only after the appropriate choice has been made through our cookie settings tool.
17.CHILDREN’S INFORMATION
Our Website is not intended to collect Personal Information from children without appropriate authorisation. Where we knowingly process a child’s Personal Information, we will do so only where permitted by law and with the required consent or authorisation.
18.THIRD-PARTY WEBSITES
The Website may contain links to third-party websites or services. Their privacy practices are governed by their own notices, and we are not responsible for their independent processing activities.
19.CHANGES TO THIS POLICY
We may update this Policy to reflect legal, operational or technology changes. The current version and effective date will be displayed on the Website.
20.CONTACT AND COMPLAINTS
Privacy enquiries or requests may be sent to:
Information Officer: [Name or Role]
Email: [Information Officer Email]
Address: [Physical Address]
Telephone: [Telephone Number]
You may also lodge a complaint with the Information Regulator of South Africa:
Website: [Insert current Information Regulator website link]
Email: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191