Golay

1. Introduction

This Protection of Personal Information (POPI) Policy sets out how we collect, use, store, and protect your personal information in accordance with the Protection of Personal Information Act, 2013 (Act 4 of 2013) ("POPI Act") of South Africa. We are committed to protecting your privacy and ensuring the security of your personal information.

2. What is Personal Information?

Personal information includes any information that can be used to identify you, such as:

Name, surname, and identity number
Contact details (email address, telephone number, physical address)
Financial information (bank account details, credit card information)
Biometric information
Demographic information (age, gender, race)
Online identifiers (IP address, cookies, device information)
Employment information
Any other information that can be linked to you as an individual

3. How We Collect Personal Information

We collect personal information in the following ways:

Directly from you: When you register on our website, subscribe to our services, complete forms, or communicate with us
Automatically: Through cookies, web beacons, and other tracking technologies when you visit our website
From third parties: Such as service providers, business partners, or publicly available sources
During transactions: When you make purchases or payments through our platform

4. Purpose of Processing Personal Information

We process your personal information for the following lawful purposes:

To provide and improve our services
To process transactions and manage your account
To communicate with you about our services, updates, and promotions
To comply with legal obligations and regulatory requirements
To prevent fraud and ensure security
To conduct market research and analytics
To customize your experience on our website
To respond to your inquiries and provide customer support

5. Legal Basis for Processing

We process your personal information based on the following legal grounds under the POPI Act:

Consent: You have given clear consent for us to process your personal information for specific purposes
Contractual necessity: Processing is necessary for the performance of a contract with you
Legal obligation: We need to process your information to comply with legal requirements
Legitimate interests: Processing is necessary for our legitimate business interests, provided these do not override your rights and freedoms

6. Sharing of Personal Information

We may share your personal information with:

Service Providers: Third-party companies that provide services on our behalf (payment processors, hosting providers, analytics services)
Business Partners: Trusted partners who assist us in operating our website and conducting our business
Legal Authorities: When required by law, court order, or regulatory authority
Business Transfers: In connection with any merger, sale of assets, or acquisition

We ensure that all third parties with whom we share your information are bound by appropriate confidentiality and data protection obligations.

7. Security Measures

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

Encryption of data in transit and at rest
Secure servers and databases
Regular security assessments and updates
Access controls and authentication procedures
Staff training on data protection
Incident response procedures

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law. When personal information is no longer needed, we will securely delete or anonymize it.

9. Your Rights Under POPI Act

You have the following rights regarding your personal information:

Right to Access: Request access to the personal information we hold about you
Right to Correction: Request correction of inaccurate or incomplete personal information
Right to Deletion: Request deletion of your personal information under certain circumstances
Right to Object: Object to the processing of your personal information for specific purposes
Right to Restrict Processing: Request restriction of processing in certain situations
Right to Data Portability: Request transfer of your personal information to another service provider
Right to Withdraw Consent: Withdraw consent where processing is based on consent
Right to Lodge a Complaint: Lodge a complaint with the Information Regulator if you believe your rights have been violated

10. Cross-Border Transfers

If we transfer your personal information outside of South Africa, we will ensure that appropriate safeguards are in place to protect your information in accordance with the POPI Act. This may include:

Ensuring the recipient country has adequate data protection laws
Using standard contractual clauses approved by the Information Regulator
Obtaining your explicit consent for such transfers

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing behavior. You can control cookies through your browser settings, but disabling cookies may affect the functionality of our website.

12. Children's Privacy

We do not knowingly collect personal information from children under the age of 18 without parental consent. If we become aware that we have collected personal information from a child without proper consent, we will take steps to delete such information.

13. Changes to This Policy

We may update this POPI Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date.

14. Information Regulator Contact Details

If you have concerns about how we handle your personal information, you can contact the Information Regulator:

Information Regulator (South Africa)
Email: inforeg@justice.gov.za
Website: www.justice.gov.za/inforeg