POPIA Compliance

The Protection of Personal Information Act (POPIA) is South Africa's data protection law that regulates how organisations collect, store, process, and share personal information. POPIA came into full effect on 1 July 2021 and applies to all organisations that process the personal information of South African data subjects.

POPIA establishes eight conditions for the lawful processing of personal information:

• Accountability
• Processing limitation
• Purpose specification
• Further processing limitation
• Information quality
• Openness
• Security safeguards
• Data subject participation

OneDayOnly is committed to adhering to all eight conditions in our handling of your personal information.

Under POPIA, OneDayOnly (Pty) Ltd is the “responsible party” for the processing of your personal information. This means we determine the purpose and means of processing your data.

Our Information Officer is responsible for ensuring compliance with POPIA and for handling all requests related to personal information.

We process your personal information for specific, explicitly defined, and legitimate purposes. These include:

• Order processing: To process, fulfil, and deliver your purchases
• Account management: To create and manage your OneDayOnly account
• Customer communication: To respond to your enquiries and provide customer support
• Marketing: To send you deal alerts and promotional content (only with your explicit consent)
• Legal compliance: To comply with applicable laws, regulations, and legal processes
• Fraud prevention: To detect, prevent, and investigate fraudulent transactions
• Website improvement: To analyse usage patterns and improve our platform

We will not process your personal information for purposes incompatible with those listed above without your consent, unless permitted by law.

Under POPIA, we must have a lawful basis for processing your personal information. We rely on the following grounds:

• Consent: You have given us explicit consent to process your information (e.g., subscribing to our newsletter)
• Contract: Processing is necessary to fulfil a contract with you (e.g., processing your order)
• Legal obligation: Processing is required to comply with the law (e.g., tax records for SARS)
• Legitimate interest: Processing is necessary for our legitimate business interests, provided your rights are not overridden (e.g., fraud prevention, website security)

POPIA grants you the following rights regarding your personal information:

• Right to be notified: You have the right to be informed that your personal information is being collected and the purpose for which it is being processed
• Right of access: You may request confirmation of whether we hold personal information about you and request access to that information
• Right to correction: You may request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, or misleading
• Right to deletion: You may request the destruction or deletion of your personal information, subject to legal retention requirements
• Right to object: You may object to the processing of your personal information, including for direct marketing purposes
• Right not to be subject to automated decisions: You have the right not to be subject to a decision based solely on automated processing that significantly affects you
• Right to lodge a complaint: You may submit a complaint to the Information Regulator if you believe your rights have been infringed

To exercise any of your rights under POPIA, you may contact our Information Officer:

• Email: privacy@onedayonly.co.za
• Phone: 021 555 1234
• Post: OneDayOnly (Pty) Ltd, Information Officer, Cape Town, South Africa

When submitting a request, please provide sufficient information to verify your identity and specify which right you wish to exercise. We will respond to your request within 30 days, as required by POPIA.

There is no fee for submitting a request unless the request is manifestly unfounded or excessive, in which case a reasonable fee may be charged.

In accordance with POPIA's security safeguard requirements, we implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or damage. These measures include:

• SSL/TLS encryption for all data transmitted to and from our website
• PCI-DSS compliant payment processing
• Regular security assessments and penetration testing
• Strict access controls and role-based permissions for staff
• Secure data storage with encryption at rest
• Employee training on data protection and information security
• Incident response procedures for data breaches

In the event of a data breach that poses a risk to your rights, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by Section 22 of POPIA.

The Information Regulator is the independent body established under POPIA to monitor and enforce compliance with data protection legislation in South Africa. If you are not satisfied with how we have handled your personal information or a request you have made, you have the right to lodge a complaint with the Information Regulator.