Privacy policy

01 Introduction and scope

1. 1.1Covergard (Pty) Ltd (registration number 2009/013078/07), of 55 5th Street, Wynberg, Johannesburg, Gauteng, 2090 ("Covergard", "we", "us" or "our") is the responsible party, as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA"), for the personal information described in this policy.
2. 1.2This policy applies to personal information processed through our website, our online store, our made-to-measure enquiry service, and any communication you have with our staff by email, telephone or in person.
3. 1.3Terms such as "personal information", "processing", "data subject", "operator" and "responsible party" have the meanings given to them in POPIA.
4. 1.4By using our website or placing an order, you acknowledge that you have read this policy. Where we rely on your consent, we will ask for it separately and you may withdraw it at any time.

02 Information Officer

We have appointed an Information Officer who is responsible for our compliance with POPIA and for dealing with requests made under it. Our Information Officer is registered with the Information Regulator.

Email

marketing@covergard.co.za

Telephone

+27 81 010 4494

Physical address

55 5th Street, Wynberg, Johannesburg, Gauteng, 2090

Our manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") is available from the Information Officer on request.

03 Personal information we collect

We collect only the personal information that is adequate, relevant and not excessive for the purposes set out in section 4. This may include:

Identity and contact details

Your name, email address, telephone number and username.

Account information

Your sign-in email, an encrypted password, saved addresses and your confirmation that you are 18 years of age or older.

Order and delivery information

Products purchased, order history, delivery or collection details and courier tracking information.

Payment information

Confirmation of payment status and transaction references. Card and banking details are captured and processed by PayFast and are not received or stored by us.

Made-to-measure enquiries

Item descriptions, measurements, fabric and colour choices, province and any notes you provide.

Communications

Correspondence with us, product reviews, return requests and messages sent to the chat assistant on our website.

Technical and usage information

Device and browser information, pages visited and interactions, collected through cookies in accordance with section 12.

Google sign-in information

If you choose to sign in with Google, your name, email address and profile picture as shared by Google.

04 Purpose and lawful basis for processing

We process personal information only for specific, explicitly defined and lawful purposes, on the grounds permitted by section 11 of POPIA:

Performance of a contract

To create and manage your account, process and deliver orders, prepare made-to-measure quotations, handle returns, refunds and warranty claims, and respond to enquiries.

Compliance with law

To keep accounting and tax records and to meet other legal and regulatory obligations.

Legitimate interests

To secure our website, prevent fraud and abuse, moderate product reviews, and improve our products and services, where these interests are not overridden by your rights.

Consent

To send direct marketing and to use optional personalisation and analytics cookies.

Existing customer

To send marketing about our own similar products and services after you order from us, unless you objected when ordering or have unsubscribed since (section 69(3) of POPIA).

1. 4.1We will not process personal information for a purpose that is incompatible with the purpose for which it was collected, unless permitted by section 15 of POPIA.

05 Direct marketing

1. 5.1We send direct marketing by electronic communication only to persons who have given their consent, for example by ticking the box when creating an account or by subscribing on our website, as required by section 69 of POPIA, or to existing customers in respect of our own similar products and services, as permitted by section 69(3) of POPIA.
2. 5.2When you place an order, we give you the opportunity to object to marketing, free of charge, before we use your contact details for it. If you object, we keep a record of your objection so that we do not send you marketing or ask you again.
3. 5.3Every marketing message identifies Covergard and includes a link to unsubscribe. You may also withdraw consent or object at any time under Preferences in your account.
4. 5.4Our marketing is our own. We do not share or sell personal information for anyone else's marketing, we do not use advertising cookies, and our marketing emails do not record whether you open them or which links you click.
5. 5.5Order confirmations, delivery updates and other service messages are not direct marketing and will continue to be sent while you have an active order or account.

06 Disclosure to operators and third parties

1. 6.1We do not sell, rent or trade personal information.
2. 6.2We disclose personal information to operators who process it on our behalf, only to the extent necessary for the services they provide, and under written agreements that require them to maintain appropriate security safeguards in accordance with sections 20 and 21 of POPIA.

1. 6.3We may also disclose personal information where required by law, by a court order, or to protect our legal rights, and to a successor in the event of a sale or restructuring of our business, subject to equivalent protection.

07 Google sign-in

What we receive

If you choose to sign in with Google, Google shares your name, email address and profile picture with us. We request no other Google data: we never access your Gmail, contacts, calendar, Drive files or any other Google service.

How we use it

That information is used solely to create your Covergard account, sign you in, and show your name and profile picture in your account area. Your email address is also used to send order confirmations and account notices.

How we store and share it

Your account details are stored in our authentication database, protected in transit and at rest. We do not sell your Google account data, and we do not share it with third parties for advertising or any purpose unrelated to running your Covergard account.

Withdrawing access

You can disconnect Covergard at any time from your Google Account permissions page, and you can ask us to delete your Covergard account and the data held against it by contacting us.

08 Transfers outside South Africa

1. 8.1Some operators store or process personal information outside the Republic of South Africa. We transfer personal information across borders only where section 72 of POPIA permits it, including where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or where you have consented to the transfer.

09 Security safeguards

1. 9.1We secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures, as required by section 19 of POPIA, including encryption in transit, access controls limited by role, and regular review of our safeguards.
2. 9.2Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA.
3. 9.3No method of transmission over the internet is entirely secure. We are not liable for unauthorised access that occurs despite our compliance with this section, or for events beyond our reasonable control.

10 Retention of personal information

1. 10.1We retain personal information only for as long as necessary to achieve the purpose for which it was collected, unless a longer period is required or authorised by law, as provided in section 14 of POPIA.
2. 10.2Order, payment and invoicing records are retained for at least five years, as required by South African tax legislation.
3. 10.3Account information is retained while your account is active. When you delete your account, your personal details are erased or de-identified, except where we are required by law to retain records.
4. 10.4Analytics data is retained for no longer than 12 months.

11 Your rights

Subject to POPIA and PAIA, you have the right to:

Access

Ask whether we hold personal information about you and request a record or description of it (section 23).

Correction and deletion

Request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24).

Objection

Object, on reasonable grounds, to processing based on legitimate interests, and object at any time to direct marketing (section 11(3)).

Withdrawal of consent

Withdraw consent you have given, without affecting the lawfulness of processing before the withdrawal.

Automated decisions

Not be subject to a decision based solely on automated processing that has legal consequences for you (section 71).

Complaint

Lodge a complaint with the Information Regulator (section 74).

1. 11.1To exercise these rights, contact the Information Officer using the details in section 2. We may ask you to verify your identity before acting on a request.
2. 11.2We will respond within 30 days of receiving a complete request. Correction, deletion and objection requests are free of charge. Requests for copies of records are dealt with in terms of PAIA and our PAIA manual, which may prescribe a fee.

12 Cookies

We use essential cookies required for the website to function, and optional personalisation and analytics cookies only with your consent. We do not use advertising cookies, and no third party tracks you on our website for advertising. PostHog processes analytics data within the European Union.

13 Children

1. 13.1Our website and accounts are intended for persons aged 18 years or older. POPIA defines a child as a natural person under the age of 18.
2. 13.2We do not knowingly process the personal information of children, and we do not collect dates of birth. Users confirm that they are 18 or older when creating an account.
3. 13.3If you are a parent or guardian and believe that a child has provided personal information to us, please contact the Information Officer. We will delete that information without undue delay.

14 Complaints to the Information Regulator

1. 14.1We encourage you to contact our Information Officer first so that we can try to resolve your concern.
2. 14.2You are entitled to lodge a complaint with the Information Regulator (South Africa), whose current contact details and complaint forms are published at www.inforegulator.org.za.

15 Changes to this policy

1. 15.1We may amend this policy from time to time. The date at the top of this page shows when it was last updated, and a notice will be displayed on our website for 30 days after any material change.
2. 15.2Where a change materially affects how we process personal information that we already hold, we will notify you directly and, where required, ask for your consent.