POPIA Compliance Notice

BanBanz Solutions complies with the Protection of Personal Information Act, 4 of 2013 (POPIA). This notice explains, in plain language, what personal information we process, why we process it, the lawful basis we rely on, and the rights you have as a data subject.

We process personal information for clearly defined business purposes only, we collect the minimum needed for those purposes, and we keep it secure for only as long as it is needed.

As the responsible party, BanBanz Solutions collects the following categories of personal information:

• Identity and contact details — name, email address, phone number, WhatsApp number
• Delivery details — physical delivery address, pickup preference, recipient contact
• Order details — event names, child names and ages, themes, wording and quantities you ask us to print
• Uploaded files — child photographs, design references, logos and brand files
• Payment records — amounts, invoice and quote numbers, proof-of-payment documents; card data is processed by Paystack and never stored by us
• Account records — sign-in identifiers, acceptance of our policies, and activity on your own quotes and jobs
• Technical data — device, browser and, where analytics is enabled, aggregated usage data

We use personal information only for these purposes:

• Preparing quotations and responding to quote requests
• Producing the personalised products and design work you order
• Processing deposits, balances, invoices and refunds
• Arranging pickup or courier delivery, and keeping you updated
• Customer support by email, phone and WhatsApp
• Keeping accounting, tax and order records as required by South African law

We do not use your information for automated decision-making that has legal consequences for you, and we do not sell it.

Section 11 of POPIA requires a lawful ground for each processing activity. We rely on the following:

• Performance of a contract — processing your order, quote, invoice and delivery
• Consent — uploading a child's photograph for personalisation, and optional marketing communication
• Legal obligation — retaining invoices and accounting records
• Legitimate interests — securing our platform, preventing fraud and recovering unpaid amounts

Where we rely on consent, that consent is voluntary, specific and informed, and you give it through a clear action — for example ticking the confirmation box when you approve a quote or make a payment, or choosing to upload a photograph.

You may withdraw consent at any time by contacting our Information Officer. Withdrawal does not affect processing already lawfully carried out, and where the information is needed to complete an order in progress we will tell you what the practical effect of withdrawal will be.

Personal information and uploaded files are stored in our managed cloud database and file storage, with access controls and row-level security rules that limit each customer's account to their own records.

We keep order records for as long as needed to complete your order and to meet accounting, tax and legal retention obligations. Uploaded artwork source files and child photographs are kept only as long as needed to produce and reprint your order, after which they may be deleted on request.

As required by section 19 of POPIA, we maintain appropriate, reasonable technical and organisational measures, including:

• Encrypted connections (HTTPS) for all data in transit
• Authentication on every customer and administrator account
• Row-level security so a customer can only read their own records and documents
• Private file storage buckets for child photographs, proof of payment and generated PDFs
• Access limited to authorised administrators who need it to fulfil an order
• Payment card processing handled entirely by Paystack, a PCI-DSS compliant provider

If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

We use the following operators, each of which processes information only on our instructions:

• Paystack — payment processing
• Our managed cloud backend — database, authentication and secure file storage
• Our email service provider — quote, invoice and notification emails
• Courier partners — delivery of physical orders

Some operators process information outside South Africa. Where that happens, we only use providers that are subject to laws or binding agreements offering protection substantially similar to POPIA, as required by section 72.

Under POPIA you have the right to:

• Be notified that your personal information is being collected
• Request access to the personal information we hold about you
• Request correction of information that is inaccurate, misleading or outdated
• Request deletion or destruction of information we are no longer entitled to keep
• Object to processing on reasonable grounds
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator of South Africa

• Correction requests — we update the record and, where relevant, reissue affected documents
• Deletion requests — we delete uploaded photographs and files we no longer need, and confirm in writing
• Objection requests — we stop the objected-to processing unless we have an overriding legal obligation

You can correct most of your own details directly in your dashboard under Profile. For anything you cannot change yourself, send a request to our Information Officer with your name, the order or quote number, and what you would like corrected or deleted.

We acknowledge requests promptly and aim to complete them within 30 days. We may need to verify your identity first. Where we must keep certain records for tax or accounting purposes, we will tell you which information we are retaining and why.

POPIA treats the personal information of children as special personal information. We apply extra care to it.

• A child's photograph may only be uploaded by that child's parent or legal guardian, who consents on the child's behalf
• Uploaded photographs are used solely to produce the personalised products the parent or guardian requested — for example avatar party packs, invitations and themed printables
• Photographs are stored in a private storage bucket that is not publicly accessible and cannot be browsed or indexed
• We never sell child photographs, and we never publish or share them for marketing, gallery, social media or any other purpose without the explicit permission of the parent or guardian
• We do not use children's images for any purpose beyond the specific order they were supplied for
• A parent or guardian may request deletion of an uploaded photograph at any time, and we will delete it once the order no longer requires it

If you are a school, crèche or event organiser supplying photographs of children who are not your own, you must first obtain written consent from each child's parent or legal guardian. By uploading, you confirm that you have that consent.

All POPIA queries, access requests, corrections, deletions, objections and complaints go to our Information Officer:

• Responsible party: BanBanz Solutions, Gauteng, South Africa
• Information Officer: The Owner, BanBanz Solutions
• Phone and WhatsApp: 072 999 6674
• Email: info@banbanz.online
• Preferred subject line: “POPIA request”, with your order or quote number

If you are not satisfied with how we handled your request, you may complain to the Information Regulator of South Africa at complaints.IR@justice.gov.za or via inforegulator.org.za.