CAPE BAG GROUP

1.1 This Privacy Policy explains how Cape Bag (Pty) Ltd (Registration No. 1961/001447/07) and its divisions, including Cape Twines & Packaging and Cape Bulk Bags ("Cape Bag Group", "the Company", "we", "us" or "our"), collect, use, share and protect your personal information when you visit www.capebaggroup.com (the "Site"), purchase goods from us, apply for credit, or otherwise communicate with us (collectively, the "Services").

1.2 We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, the Electronic Communications and Transactions Act 25 of 2002 and the Consumer Protection Act 68 of 2008.

1.3 For the purposes of POPIA, Cape Bag (Pty) Ltd is the "responsible party". Our Information Officer can be contacted at hello@capebag.co.za or +27 (0)21 447 4352, or in writing at 177 Albert Road, Woodstock, Cape Town, 7925.

1.4 By using the Services you acknowledge that you have read and understood this Privacy Policy. Where the law requires your consent for a particular kind of processing (for example, certain direct marketing), we will ask for it separately, and you may withdraw it at any time.

2.1 "Personal information" means information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person (company or other entity), as defined in section 1 of POPIA.

2.2 "Processing" means any operation concerning personal information, including collection, storage, use, disclosure and destruction.

2.3 "Data subject" means the person to whom personal information relates — including customers, website visitors, credit applicants, sureties and supplier or business contacts.

2.4 "Operator" means a third party who processes personal information on our behalf, such as our website platform, payment processors and couriers.

3.1 Information you provide directly:

• Contact details — name, postal and physical address, phone number and email address.
• Order information — name, billing address, shipping address, payment confirmation, email address and phone number.
• Account information — username, password, security questions and other information used for account security.
• Credit application information — where you apply for a credit account: company registration and VAT numbers, financial and bank details, trade references, and the identity and contact details of directors, members and sureties.
• Customer support information — the content of your communications with us.

3.2 You may choose not to provide certain information, but this may prevent us from providing some features of the Services (for example, we cannot fulfil an order without a delivery address, or open a credit account without a completed credit application).

3.3 Information collected automatically: when you use the Site we may automatically collect usage data through cookies, pixels and similar technologies ("Cookies"), including device and browser information, network information, IP address and how you interact with the Services. See clause 6 (Cookies).

3.4 Information from third parties: we may receive information about you from service providers who support the Site and Services (such as Shopify, our e-commerce platform), from our payment processors (who collect payment card or bank details to process your payment — we do not store your full card details), and from credit bureaus and trade references where you apply for credit. Information obtained from third parties is treated in accordance with this Privacy Policy.

4.1 POPIA requires that we process personal information lawfully and only where a recognised justification exists. We process your personal information for the following purposes:

• Providing products and services — to process payments, fulfil orders, arrange delivery, manage returns and exchanges, and create and manage your account. Justification: the processing is necessary to perform our contract with you.
• Credit assessment and account management — to assess credit applications, verify information with credit bureaus and trade references, and administer credit accounts and suretyships. Justification: performance of a contract, your consent given in the credit application, and our legitimate interests.
• Communication and service improvement — to respond to enquiries, provide customer support and improve our Services. Justification: our legitimate interests in serving you effectively.
• Marketing — to send you marketing communications and show you relevant advertising, subject to clause 5. Justification: your consent, or the limited existing-customer basis permitted by section 69 of POPIA.
• Security and fraud prevention — to detect, investigate and act on fraudulent, illegal or malicious activity. Justification: our legitimate interests and compliance with law.
• Legal compliance — to comply with tax, accounting, consumer protection and other legal obligations, and to establish, exercise or defend legal claims.

4.2 We do not process special personal information (such as health, religious or biometric information) or personal information of children in the ordinary course of business, and will do so only with consent or as otherwise permitted by POPIA.

4.3 If you register an account, you are responsible for keeping your login credentials confidential. Please contact us immediately if you believe your account has been compromised.

5.1 We will only send you direct marketing by electronic means (email or SMS) if you have consented, or if you are an existing customer, in which case we may market our own similar goods and services to you as permitted by section 69 of POPIA, provided you were given an opportunity to object when your details were collected.

5.2 Every marketing communication we send will identify us and include a simple way to opt out (unsubscribe). You may opt out at any time, free of charge, and we will stop marketing to you. Opting out does not affect service communications about your account or orders.

5.3 You may also register a pre-emptive block against direct marketing as contemplated in section 11 of the Consumer Protection Act.

6.1 We use Cookies to operate and improve the Site (including remembering your actions and preferences), to run analytics, and to support advertising. Our store is powered by Shopify; information about Shopify’s cookies is available at www.shopify.com/legal/cookies.

6.2 We may permit third-party service providers to place Cookies on the Site to tailor services, products and advertising.

6.3 Most browsers accept Cookies by default. You can set your browser to remove or reject Cookies, but this may negatively affect your experience and some features may not work correctly.

7.1 We do not sell your personal information. We may share it in the following circumstances:

• Operators and service providers who process information on our behalf — such as IT and website hosting (including Shopify), payment processing, data analytics, customer support, cloud storage, and fulfilment and courier services (including The Courier Guy). Our operators may only process your information on our instructions and must keep it confidential and secure, as required by sections 20 and 21 of POPIA.
• Credit bureaus and trade references, where you apply for or hold a credit account.
• Our divisions and affiliates within the Cape Bag group, for the purposes described in this Policy.
• Business and marketing partners who assist us to provide services and relevant advertising, in accordance with clause 5 and applicable law.
• With your consent or at your direction — for example, delivery to an address you nominate or your use of social media integrations.
• Legal and business purposes — to comply with a legal obligation (including subpoenas and lawful requests by public authorities), to enforce our Terms and Conditions, to protect our rights and the rights of others, or in connection with a sale, merger, restructuring or similar transaction involving our business, in which case the recipient will remain bound by obligations of confidentiality.

8.1 Some of our service providers (for example, our e-commerce platform and cloud hosting providers) store or process information outside South Africa.

8.2 In accordance with section 72 of POPIA, we will only transfer your personal information outside South Africa where the recipient is subject to a law, binding corporate rules or a binding agreement providing substantially similar protection to POPIA; or you consent to the transfer; or the transfer is necessary for the performance of, or the conclusion of, a contract with or in your interest.

9.1 As required by section 19 of POPIA, we maintain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information and to prevent loss, damage, unauthorised destruction and unlawful access. These include encryption of payment transactions, access controls and secure hosting.

9.2 No security measures are perfect, and we cannot guarantee absolute security. Please do not use insecure channels to send us sensitive or confidential information.

9.3 If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, where required, you, as soon as reasonably possible, in accordance with section 22 of POPIA.

10.1 In accordance with section 14 of POPIA, we retain personal information only for as long as necessary to fulfil the purposes for which it was collected, unless a longer period is required or permitted by law (for example, tax and company records), is needed to resolve disputes or enforce agreements, or you have consented to longer retention. Thereafter records are deleted, destroyed or de-identified.

11.1 Under POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA"), you have the right to:

• Access — request confirmation that we hold personal information about you and request a copy of that information, in accordance with our PAIA Manual;
• Correction — request that we correct or update inaccurate, irrelevant, excessive, out-of-date, incomplete or misleading information;
• Deletion — request that we delete or destroy personal information that we are no longer entitled to retain;
• Objection — object, on reasonable grounds, to the processing of your personal information, including an absolute right to object to direct marketing;
• Withdraw consent — where processing is based on your consent, withdraw it at any time (without affecting processing already carried out);
• Not be subject to automated decision-making that results in legal consequences for you, except as permitted by POPIA; and
• Complain — lodge a complaint with the Information Regulator (see clause 12).

11.2 To exercise any of these rights, contact our Information Officer at hello@capebag.co.za. We may need to verify your identity before responding, and an authorised person may act on your behalf with proof of authority. We will respond within a reasonable time and in accordance with the periods prescribed by law. We will not penalise you for exercising your rights.

12.1 If you have a complaint about how we process your personal information, please contact our Information Officer first so that we can try to resolve it.

12.2 If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; website: www.inforegulator.org.za; email: enquiries@inforegulator.org.za (POPIA complaints: POPIAComplaints@inforegulator.org.za).

13.1 The Services are not intended for use by children (persons under 18). We do not knowingly process children’s personal information without the consent of a parent or guardian, as required by section 34 of POPIA. If you believe a child has provided us with personal information, please contact us and we will delete it.

14.1 If you post product reviews or other content in public areas of the Services, that content is public and accessible by anyone. We cannot control how others use information you choose to make public.

14.2 The Site may link to websites operated by third parties. We are not responsible for the privacy practices or content of those sites, and you should review their privacy policies before providing them with personal information.

15.1 We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal or regulatory reasons. The revised version will be posted on the Site with an updated "Last updated" date. Material changes affecting how we process your personal information will be brought to your attention where required by law.

Information Officer — Cape Bag (Pty) Ltd
177 Albert Road, Woodstock, Cape Town, 7925, South Africa
Tel: +27 (0)21 447 4352
Email: hello@capebag.co.za
Website: www.capebaggroup.com