This policy explains what we do with your personal information when you visit skimmadisc.co.za, place an order or get in touch. We have tried to write it in plain language. If anything here is unclear, email us and we will explain it properly.
1. Who we are
SkimmaDisc is a trading name of HK Data Solutions (Pty) Ltd, a private company registered in the Republic of South Africa. Where this policy says “we”, “us” or “our”, it means that company. Where it says “you”, it means anyone who visits the site, buys from us or contacts us.
We are the responsible party for the personal information described below, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).
| Registered name | HK Data Solutions (Pty) Ltd |
|---|---|
| Trading as | SkimmaDisc |
| Registration number | [company registration number] |
| Registered address | [street address], Cape Town, Western Cape, South Africa |
| Website | https://www.skimmadisc.co.za |
| info@skimmadisc.co.za | |
| Information Officer | [full name], reachable at info@skimmadisc.co.za |
2. The information we collect
Information you give us
- When you order: your name, email address, delivery address, billing address and contact number, along with what you bought, the colours you chose and what you paid.
- When you contact us: your name, email address, phone number if you supply one, and whatever you write in your message.
- If you create an account: your login details and your saved addresses and order history.
- If you sign up for emails: your email address and the fact that you opted in.
Supplying delivery and contact details is not optional if you want an order shipped. Without them we cannot conclude or fulfil the sale. Everything else is voluntary.
Information we collect automatically
- Your IP address, browser type, device type, operating system and screen size.
- Which pages you viewed, when, for how long, and which site referred you.
- Cookie identifiers, described in section 4.
Information we never see
We do not collect or store your card number. Card payments are handled entirely by our payment provider on their own systems. We receive only a confirmation that the payment succeeded or failed, plus a reference number. If you pay by EFT we see the reference and the amount on our bank statement, nothing more.
3. Why we process your information
POPIA requires us to have a lawful justification for every use of your personal information. Ours are set out here.
| What we do | Why | Our justification under POPIA |
|---|---|---|
| Take, pack and deliver your order | To give you what you paid for | Necessary to perform our contract with you (section 11(1)(b)) |
| Send order, dispatch and delivery emails | So you know where your order is | Necessary to perform our contract with you (section 11(1)(b)) |
| Handle returns, refunds and warranty claims | To honour your rights under the Consumer Protection Act | Legal obligation (section 11(1)(c)) |
| Keep accounting and tax records | Required of every registered company | Legal obligation (section 11(1)(c)) |
| Answer your questions | To run a shop people can actually talk to | Our legitimate interest (section 11(1)(f)) |
| Detect fraud and abuse of the site | To protect you, us and our payment provider | Our legitimate interest (section 11(1)(f)) |
| Understand how the site is used | To fix what is broken and improve what is not | Our legitimate interest (section 11(1)(f)) |
| Send marketing emails | To tell you about new colours and offers | Your consent, or section 69 where you are already a customer |
We do not use your information to make automated decisions that have legal consequences for you, and we do not profile you.
4. Cookies
Cookies are small files a site stores on your device. We use them for three things.
- Making the shop work. Remembering what is in your cart, keeping you logged in, and carrying a security token that protects forms against forgery. The shop cannot function without these.
- Remembering your preferences. Small things, like a notice you have already dismissed.
- Understanding traffic. Counting visits and seeing which pages get read, in aggregate rather than by name.
You can block or delete cookies in your browser settings. If you block the essential ones, the cart and checkout will stop working. That is a limitation of how carts work, not a choice we made.
5. Who we share your information with
We do not sell your personal information. We never have and we will not. We share it only with the operators who help us run the shop, and only with what they need:
- Our courier gets your name, delivery address and contact number, so a driver can find you.
- Our payment provider gets what it needs to take the payment and to check it is not fraudulent.
- Our hosting and email providers hold the site and the mail that passes through it.
- Our accountants and auditors see transaction records.
Each of these is bound by a written agreement to process your information only on our instructions and to keep it secure, as POPIA section 21 requires.
We will also disclose information where a law, a court or a regulator requires it, or where it is needed to establish or defend a legal claim.
6. Sending information outside South Africa
Some of the services above may store or process data outside South Africa. POPIA section 72 allows this only where the receiving party is subject to a law or binding agreement that protects your information to a standard comparable to POPIA, or where the transfer is necessary to perform our contract with you. Where we use an operator abroad, we rely on contractual data protection terms with that operator.
7. How long we keep it
| Order and payment records | Five years from the end of the relevant tax year, as required by the Tax Administration Act 28 of 2011 |
|---|---|
| Company accounting records | Seven years, as required by the Companies Act 71 of 2008 |
| Enquiries sent through the contact form | Two years, then deleted |
| Marketing consent records | Until you unsubscribe, plus three years so we can show when and how you opted in |
| Website analytics | Fourteen months |
When a retention period ends we delete the information or strip it of anything that identifies you.
8. How we protect it
POPIA section 19 requires us to secure the integrity and confidentiality of your information. In practice that means the whole site runs over HTTPS, card data never touches our servers, administrator accounts are limited to the people who need them, and our systems and plugins are kept up to date.
No system is perfectly secure, and we would rather say so than pretend otherwise. If your personal information is ever accessed by someone who should not have it, POPIA section 22 requires us to notify the Information Regulator and to notify you as soon as reasonably possible. We will tell you what happened, what it means for you and what to do about it.
9. Your rights
Under POPIA you may:
- Ask what we hold about you and get a copy of it (section 23). We must confirm free of charge whether we hold anything. A copy of the information itself may carry a prescribed fee.
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
- Object to processing that rests on legitimate interest, on reasonable grounds relating to your situation (section 11(3)).
- Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo what was lawful beforehand.
- Opt out of marketing at any time, at no cost.
- Complain to us or to the Information Regulator (section 74).
To exercise any of these, email info@skimmadisc.co.za. We will respond within a reasonable period and in any event within 30 days. We may ask you to confirm who you are first, so that we do not hand your information to somebody else.
Some information we cannot delete on request, because a law requires us to keep it. Tax records are the usual example. Where that applies we will tell you which law and for how long.
10. Marketing emails
We only send marketing email if you asked for it, or if you bought from us and we are telling you about something similar, which section 69 of POPIA permits. Every marketing email carries an unsubscribe link that works, and we act on it immediately. Order confirmations, dispatch notices and replies to your questions are not marketing, and you will keep getting those while an order is live.
11. Children
SkimmaDisc is made for children to play with, but the shop is not built for children to use. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian, as POPIA section 34 requires. If you believe a child has given us information, tell us and we will delete it.
12. Other websites
Where we link to another site, this policy stops at our boundary. We have no control over what they collect and we are not responsible for their practices. Read their policy before you hand anything over.
13. Changes to this policy
We will update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects your rights we will tell you directly rather than relying on you to notice.
14. Complaints
Start with us. Email info@skimmadisc.co.za and we will do our best to sort it out.
If we cannot, you have the right to complain to the regulator, and you do not need to go through us first:
| Body | The Information Regulator (South Africa) |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Telephone | 010 023 5200, or toll free on 0800 017 160 |
| Website | inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za |
| POPIA complaints | Lodged through the Regulator’s eServices portal at eservices.inforegulator.org.za. You register a user profile first, then submit the complaint through the portal. |
| PAIA complaints | Prescribed Form 5, emailed to PAIAComplaints@inforegulator.org.za |