Privacy Policy & Data Protection Notice

1. Responsible Party & Information Officer

DK Brands (Pty) Ltd (Registration No: ) operates as the "Responsible Party" as defined under Section 1 of the South African Protection of Personal Information Act (POPIA). We are committed to protecting the privacy, confidentiality, and integrity of all Personal Information collected through our custom manufacturing production system, order portals, public tracking portals, and school uniform stores.

2. Categories of Personal Information Collected

In facilitating custom garment manufacturing, sublimation printing, school uniform orders, and proof approvals, we collect and process:

• Customer Identity & Contact: Company name, full names of contact representatives, email addresses, phone numbers, delivery and billing addresses.
• Order Personalization & Garment Specifications: Surnames, individual player/student names, squad numbers, sizing data, custom collar, lining, and fabric choices.
• Digital Artwork & Intellectual Property: Vector logos, high-resolution crests, design mockups, and customer-uploaded artwork files.
• Signatures & Approvals: Digital audit signatures captured during Customer Design Approval and Delivery/Collection hand-offs.
• Financial & Invoicing Telemetry: Purchase order numbers, VAT numbers, PayFast payment tokens, and reconciliation records (card credentials are processed exclusively by PayFast, PCI-DSS Level 1 certified).

3. Purpose of Processing & Lawful Basis

All personal information is processed strictly in accordance with Section 11 of POPIA for the following legitimate business purposes:

• Performance of custom manufacturing agreements and production order fulfillment.
• Tracking production stage progression across factory terminals (Design, Print, Press, Cut, Stitch, Floor, Dispatch).
• Automated proof sign-offs, email notifications, and delivery confirmations.
• Statutory tax compliance (Value-Added Tax Act 89 of 1991).
• Maintaining immutable production audit logs and warranty tracking.

4. Operator Disclosures & Third-Party Transfers

We never sell, rent, or commercialize your personal information. Information is shared only with verified Operators under written POPIA Section 21 agreements:

• Payment Gateway: PayFast (Pty) Ltd (payment tokenization and 3D-Secure clearing).
• Logistics & Couriers: Authorized delivery couriers and freight handlers for order transit.
• Hosting & Infrastructure: Encrypted data centers situated within South Africa adhering to ISO/IEC 27001 standards.

5. Security Safeguards (POPIA Section 19)

We maintain appropriate, reasonable technical and organizational measures to prevent loss of, damage to, or unauthorized destruction of personal information, including:

• Cryptographically secure 48-character unguessable tracking tokens for unauthenticated customer portal views.
• Active masking of customer contact numbers and emails on public progress tracking screens.
• Role-based access control (RBAC) isolating factory terminal operators strictly to relevant job operations.
• SSL/TLS 256-bit encryption in transit and salted `bcrypt` password hashing (`PASSWORD_DEFAULT`).
• Daily automated encrypted database snapshots and restricted directory permissions.

6. Data Subject Rights (Sections 23 & 24)

As a Data Subject, you have the right to:

• Access: Request confirmation of personal information held by us and obtain a record thereof.
• Correction: Request correction or deletion of personal information that is inaccurate, irrelevant, or out of date.
• Objection: Object to processing on reasonable grounds (Section 11(3)).
• Complaints: Lodge a complaint with the South African Information Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 • Email: enquiries@inforegulator.org.za