POPIA Compliance

1. Who is responsible for your information

Biltong Boeties is the responsible party for the personal information described on this page. We decide why the information is collected and how it is used, and we are accountable for protecting it.

2. What we collect, why, and our lawful basis

POPIA requires a lawful basis for every piece of personal information we process. There is no "legitimate interest" catch-all hidden in the small print — every item below is needed to fulfil your order, required by law, or collected with your consent.

We do not collect special personal information (such as health, religious or biometric data), and we do not build profiles of you or make automated decisions about you. We also don't knowingly collect information from children — our store is meant for adults.

3. Our commitments under POPIA's conditions

• Accountability — we take responsibility for the personal information we hold.
• Processing limitation — we collect the minimum we need, with your consent or another lawful basis.
• Purpose specification — we collect information for the specific reasons listed on this page.
• Further processing limitation — we don't use your information for unrelated purposes.
• Information quality — we keep your details accurate and up to date.
• Openness — this page and our Privacy Policy tell you what we do with your information.
• Security safeguards — we protect your information against unauthorised access, loss, damage or destruction.
• Data subject participation — you can ask for your information, correct it or have it deleted.

4. Consent notices we use on this site

Consent must be voluntary, specific and informed, so each of our forms asks for it in plain language — and the marketing boxes are never ticked for you in advance. These are the notices exactly as you'll see them:

Withdrawing consent is as easy as giving it. Tick nothing, untick the box, unsubscribe from any marketing email, or email our Information Officer and we'll stop.

5. Security and storage

We are committed to safeguarding the personal information we hold against unauthorised access, loss, damage, destruction and unlawful disclosure. Our safeguards include:

• encrypted connections (HTTPS) across the whole site;
• access restricted to the people who need your details to pack, deliver or support your order;
• card details handled entirely by our payment gateway, PayFast, on their own secure platform — they never reach our servers;
• confidentiality obligations for every operator and service provider who works with our data;
• secure deletion or anonymisation of information once we no longer need it.

We keep personal information only for as long as it serves an operational, legal or tax purpose: order, payment and invoice records for at least 5 years for tax, enquiries for up to 24 months after the matter is closed, newsletter subscriptions until you unsubscribe, and published reviews until you ask us to remove them. After that, information is deleted or anonymised. No system is perfectly secure, so if you ever suspect your information has been compromised, tell us immediately so we can act.

6. Who we share it with

We never sell your personal information, and we don't share it for anyone else's marketing. We share it only with the operators who help us run the store, and only what they need:

• Our courier partners — your name, delivery address and mobile number, so your parcel can be delivered.
• PayFast — to process your payment and confirm it to us.
• Hosting and email service providers — who keep this website and our order emails running, under contracts that require them to protect your information.
• Our accountants and auditors — where required for the financial records the law expects us to keep.
• Authorities — only where we are legally obliged to disclose information.

Some operators may store information on servers outside South Africa. Where that happens, we take reasonable steps to ensure your information receives a level of protection comparable to POPIA.

7. Your rights as a data subject

Under POPIA you have the right to:

• Access — ask whether we hold personal information about you and receive a copy of it;
• Correction — ask us to correct or update information that is inaccurate, incomplete, misleading or out of date;
• Deletion — ask us to delete or destroy information we no longer have a lawful reason to keep;
• Objection — object to processing based on legitimate interests, and object at any time to direct marketing;
• Withdrawal of consent — withdraw any consent you gave us, without it affecting what we lawfully did before;
• Complaint — lodge a complaint with the Information Regulator (details below).

Send any request to hello@biltongboeties.co.za addressed to the Information Officer. We may ask you to verify your identity so we don't hand your information to someone else, and we'll respond within a reasonable time, usually within 30 days. A first access or correction request is free of charge.

8. Complaints to the Information Regulator

We'd rather fix a problem than have you escalate it, so please contact our Information Officer first. If you're still unhappy, you may complain to the Information Regulator (South Africa):

• Email: complaints.IR@justice.gov.za
• Website: inforeg.org.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

9. Changes to this page

We'll update this page as our store or the law changes. The date at the top shows the current version — if the changes are significant, we'll tell you by email as well.