Privacy Policy

Responsible Party Details

• Responsible Party: Pexpacks Supplies (Pty) Ltd / Pexpacks Trading
• Trading Names: Pexpacks / Pexcover
• Last Updated: October 2025
• Jurisdiction: Republic of South Africa
• Website: www.pexpacks.co.za
• General Enquiries: privacy@pexpacks.co.za
• Privacy & POPIA Office: privacy@pexpacks.co.za
• Telephone: 0780036048
• Information Officer: Designated Information Officer, Pexpacks Supplies

Pexpacks Supplies is committed to safeguarding personal information in accordance with South African law. This Privacy Policy is formulated pursuant to:

• Protection of Personal Information Act, 4 of 2013 (POPIA)
• Promotion of Access to Information Act, 2 of 2000 (PAIA)
• Electronic Communications and Transactions Act, 25 of 2002 (ECTA)
• Consumer Protection Act, 68 of 2008 (CPA)

This policy applies to all personal information collected via our website, web app, checkout workflows, quote request forms, contact channels, social media channels, delivery dispatch workflows, and customer support platforms.

It applies to all data subjects interacting with Pexpacks, including parents, legal guardians, learners (via parent/guardian consent), school administrators, corporate SME procurement clients, suppliers, and website visitors.

In accordance with Chapter 3 of POPIA, Pexpacks processes personal information subject to the following 8 conditions:

1. Accountability: We ensure that all processing measures comply with POPIA under the oversight of our Information Officer.
2. Processing Limitation: We process data lawfully, minimally, and transparently based on explicit consent, contractual necessity, or legal duty.
3. Purpose Specification: Personal information is collected for explicit, defined, and lawful business operations (e.g. stationery pack order fulfillment, Pexcover services, invoicing).
4. Further Processing Limitation: Subsequent data processing is strictly compatible with the original collection purpose.
5. Information Quality: We take reasonable steps to ensure data is accurate, complete, and updated.
6. Openness: We maintain complete transparency regarding why and how data is collected and processed.
7. Security Safeguards: We enforce technical and organizational safeguards to prevent loss, damage, or unauthorized access.
8. Data Subject Participation: Data subjects may access, correct, or request deletion of their personal information at any time.

1. Customer & Parent/Guardian Data

Full name, email address, mobile contact number, physical and delivery addresses, preferred contact method (WhatsApp, Phone, Email), payment confirmation status, and billing details.

2. Learner & School Pack Data

Where necessary to assemble school stationery packs or perform Pexcover book-covering services, we collect limited learner-related details (learner full name, school name, grade, stationery subject options, and bag-tag instructions).

POPIA Special Notice on Children (Sections 26–35): Learner information is categorized under POPIA as information relating to children. Pexpacks processes children's information strictly with the consent of a competent parent or legal guardian, or pursuant to an authorized school procurement agreement, solely for order assembly, tagging, and fulfillment.

3. Corporate & School Partner Information

School/institution name, official registration details, procurement representative details, institutional billing address, and quotation histories.

4. Technical & Metadata

IP addresses, browser type, device identifiers, session cookies, and form audit logs required to secure checkout transactions and audit form submissions.

Pexpacks processes personal information for the following specific purposes:

• To assemble, pack, custom-label, and fulfill school stationery orders
• To execute Pexcover book-covering and custom protective book services
• To coordinate doorstep courier delivery or school-handover distribution
• To process online payment confirmations via authorized payment gateways
• To communicate order status updates, delivery schedules, and Happy Pay BNPL instalment details
• To respond to customer enquiries, quotations, and support requests
• To comply with statutory accounting, tax (SARS), and regulatory record-keeping duties

Lawful Basis: Processing is conducted pursuant to Section 11(1) of POPIA: (a) with data subject consent; (b) for the performance of a contract; (c) to comply with an obligation imposed by law; or (d) to pursue legitimate business interests.

Authorized Operators

Pexpacks engages vetted third-party service providers (“Operators”) to perform essential operational services. Operators process data strictly under written operator agreements pursuant to Section 20 & 21 of POPIA:

• Payment Gateways: Authorized payment processors for secure payment processing.
• Logistics Partners: Contracted courier services for doorstep delivery.
• Infrastructure & Hosting: Vercel Inc. and Supabase Inc. for secure cloud hosting, web app operation, and database maintenance.

Transborder Data Transfers (POPIA Section 72)

Where cloud hosting or database infrastructure is hosted outside South Africa, Pexpacks ensures compliance with Section 72 of POPIA. Transfers occur only to recipients bound by laws, binding corporate rules, or agreements providing an adequate level of data protection substantially similar to POPIA.

Commercial Selling Guarantee: Pexpacks will never sell, trade, or rent personal information to third parties for independent commercial marketing.

Technical & Organizational Security (POPIA Section 19)

We enforce strict security safeguards including SSL/TLS encryption, secure database access tokens, restricted administrative controls, and regular vulnerability checks to prevent unauthorized access, loss, or damage to personal data.

Data Retention (POPIA Section 14)

Personal information is retained only for as long as necessary to achieve the collection purpose or satisfy legal retention periods. Transactional records and tax invoices are retained for 5 years as required by the Tax Administration Act 28 of 2011 and Companies Act 71 of 2008.

Data Breach Notification Protocol (POPIA Section 22)

In the event of a reasonable belief that personal information has been accessed or acquired by an unauthorized person, Pexpacks will notify the Information Regulator and affected data subjects as soon as reasonably possible, detailing the nature of the breach, potential consequences, and corrective measures taken.

Under POPIA, data subjects enjoy statutory rights to:

• Right of Access (Section 23): Request confirmation of whether we hold personal information and request a record thereof.
• Right to Correction/Deletion (Section 24): Request the correction, destruction, or deletion of inaccurate, irrelevant, or excessive personal information (using prescribed Form 2).
• Right to Object (Section 11(3)): Object on reasonable grounds to processing based on legitimate interest.
• Direct Marketing Opt-Out (Section 69): Unsubscribe from direct electronic marketing communications at any time.

Submitting a Privacy Request

To submit an access, correction, or objection request, please contact our Information Officer at privacy@pexpacks.co.za.

Lodging a Complaint with the Information Regulator

If you are unsatisfied with how Pexpacks handles your privacy request, you have the statutory right to lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• POPIA Complaints Email: POPIAComplaints@inforegulator.org.za
• General Enquiries Email: enquiries@inforegulator.org.za