SpotON Packaging Privacy Policy

Last Updated: July 11, 2025

SpotON Packaging (Pty) Ltd ("SpotON Packaging," "we," "us," or "our") is committed to protecting your privacy and ensuring that your personal information is processed lawfully and in a reasonable manner, in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA").

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you interact with us, whether through our website, services, or other means.

1. Definitions

"Personal Information": Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including (but not limited to) names, contact details, identification numbers, financial information, and any other information that can identify you.
"Processing": Any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; dissemination by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of information.
"Data Subject": The person to whom personal information relates. This includes individuals and juristic persons (like companies).
"Responsible Party": SpotON Packaging, who determines the purpose and means for processing personal information.
"Operator": A person or entity who processes personal information on behalf of the Responsible Party without coming under the direct authority of the Responsible Party.
"POPIA": The Protection of Personal Information Act, 4 of 2013, of South Africa.

2. Principles of Lawful Processing (The 8 Conditions)

SpotON Packaging adheres to the eight conditions for the lawful processing of personal information as set out in POPIA:

2.1. Accountability

We, as the Responsible Party, are accountable for ensuring that the conditions for the lawful processing of personal information are complied with. We have implemented appropriate measures to demonstrate our compliance with POPIA.

2.2. Processing Limitation

Lawfulness: We will only process your personal information lawfully and in a reasonable manner that does not infringe on your privacy.
Minimality: We will only collect personal information that is adequate, relevant, and not excessive for the purpose for which it is collected.
Consent, Justification & Objection: We will process your personal information based on one of the following justifications:
- Your explicit consent.
- It is necessary for the conclusion or performance of a contract to which you are a party.
- It is required by law.
- It protects a legitimate interest of yours.
- It is necessary for the proper performance of a public law duty by a public body.
- It is necessary for pursuing the legitimate interests of SpotON Packaging or of a third party to whom the information is supplied. You have the right to object, on reasonable grounds, to the processing of your personal information.

2.3. Purpose Specification

Collection for Specific Purpose: We collect personal information for specific, explicitly defined, and lawful purposes related to our business activities. We will not process your personal information for a purpose other than that for which it was collected, unless it is compatible with that purpose.
Retention and Restriction of Records: We will not retain personal information for longer than is necessary to achieve the purpose for which it was collected, unless:
- Retention is required or authorised by law.
- We reasonably require the record for lawful purposes related to our functions or activities.
- Retention is required by a contract between you and us.
- You consent to the retention of the record. We will destroy or de-identify records of personal information as soon as reasonably practicable after the purpose for which it was collected has been achieved.

2.4. Further Processing Limitation

Further processing of personal information by SpotON Packaging will be in accordance with or compatible with the purpose for which it was initially collected. If the further processing is not compatible, we will seek your consent or rely on another lawful justification.

2.5. Information Quality

We will take reasonably practicable steps to ensure that the personal information we collect and process is complete, accurate, not misleading, and updated where necessary, having regard to the purpose for which the information is collected or further processed.

2.6. Openness

We will maintain documentation of all processing operations under our responsibility. When collecting personal information directly from you, we will take reasonably practicable steps to ensure you are aware of:

The information being collected.
The name and address of SpotON Packaging (the Responsible Party).
The purpose for which the information is being collected.
Whether the supply of the information is voluntary or mandatory.
The consequences of failure to provide the information.
Any particular law authorising or requiring the collection of the information.
Your right to access and rectify the information collected.
Your right to object to the processing of personal information.
Your right to lodge a complaint with the Information Regulator.

2.7. Security Safeguards

We are committed to securing the integrity and confidentiality of personal information in our possession or under our control by taking appropriate, reasonable technical and organisational measures to prevent:

Loss of, damage to, or unauthorised destruction of personal information.
Unlawful access to or processing of personal information.

We will take reasonable steps to identify all reasonably foreseeable internal and external risks to personal information and establish and maintain appropriate safeguards against these risks. Where we use an Operator to process personal information on our behalf, we will ensure that the Operator also implements appropriate security safeguards.

In the event of a security compromise (data breach) that affects your personal information, we will notify you and the Information Regulator as soon as reasonably practicable, unless the identity of the data subject cannot be established.

2.8. Data Subject Participation

You, as the Data Subject, have the right to:

Request confirmation from us, free of charge, whether or not we hold personal information about you.
Request access to the record or a description of the personal information about you held by us, including information about the identity of all third parties, or categories of third parties, who have, or have had, access to the information. We may charge a prescribed fee for this.
Request us to correct or delete personal information about you that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
Request us to destroy or delete a record of personal information about you that we are no longer authorised to retain.
Object to the processing of your personal information on reasonable grounds relating to your particular situation, unless legislation provides for such processing.
Object to the processing of your personal information for purposes of direct marketing.
Lodge a complaint with the Information Regulator.

3. Types of Personal Information We Collect

We may collect various types of personal information, depending on your interaction with SpotON Packaging, including but not limited to:

Identity Information: Name, surname, company name, registration number, VAT number, ID number (where legally required).
Contact Information: Email address, postal address, physical address, telephone numbers.
Financial Information: Bank account details (for payments or refunds), payment card details (processed securely by third-party payment gateways).
Transactional Information: Details about products and services you have purchased from us, payment history.
Technical Information: IP address, browser type and version, operating system, device information, website usage data (via cookies and analytics).
Communication Information: Records of your correspondence and communications with us.
Marketing and Communication Preferences: Your preferences in receiving marketing from us and our third parties.

4. How We Collect Personal Information

We collect personal information through various methods, including:

Directly from you: When you fill out forms on our website, register for an account, place an order, subscribe to our newsletter, communicate with us via email, phone, or in person.
From third parties: We may receive personal information about you from third parties, such as payment service providers, business partners, or publicly available sources, where lawful to do so.
Automatically: As you interact with our website, we may automatically collect technical data about your equipment, browsing actions, and patterns using cookies and similar technologies.

5. Purpose of Collecting Personal Information

We collect and process your personal information for the following purposes:

To provide and manage our products and services to you.
To process your orders, payments, and deliver products.
To communicate with you regarding your orders, inquiries, and provide customer support.
To manage our relationship with you, including notifying you about changes to our terms or privacy policy.
To improve our products, services, and website based on your feedback and usage.
To send you marketing and promotional communications about our products and services that may be of interest to you (where you have consented or where permitted by law).
To comply with legal and regulatory obligations.
To detect and prevent fraud, money laundering, and other illegal activities.
For internal record keeping, administrative purposes, and statistical analysis.

6. Disclosure of Personal Information

We may disclose your personal information to the following categories of recipients, where necessary and lawful:

Our employees and authorised representatives: Who require the information to perform their duties.
Service providers: Third-party service providers who assist us in operating our business (e.g., payment processors, delivery companies, IT service providers, marketing agencies). These operators are bound by confidentiality agreements and POPIA compliance requirements.
Business partners: With whom we collaborate on certain products or services, provided you have consented or it is necessary for the performance of a contract.
Legal and regulatory authorities: When required by law, court order, or to protect our rights, property, or safety, or the rights, property, or safety of others.
Professional advisors: Such as lawyers, auditors, and insurers.
In the event of a business transfer: If we sell or transfer all or a portion of our business or assets, your personal information may be transferred as part of that transaction.

We will only share your personal information with third parties who agree to protect it in accordance with POPIA and this Privacy Policy.

7. Security Measures

We have implemented appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

Physical security: Protecting our premises and equipment.
Technical security: Firewalls, encryption, access controls, secure networks, and regular security assessments.
Organisational measures: Employee training, strict internal policies, and procedures for handling personal information.
Data minimisation: Only collecting and retaining information that is necessary for our stated purposes.

While we strive to protect your personal information, we cannot guarantee the absolute security of information transmitted over the internet.

8. Direct Marketing

We may send you marketing communications about our products and services if you have consented to receive them or if we have a legitimate interest to do so, as permitted by POPIA.

Electronic Communications: We will only send you direct marketing by means of unsolicited electronic communications (e.g., email, SMS) if you have given your prior consent, or if you are an existing customer and the marketing relates to similar products or services that you have previously purchased from us, and you have been given an opportunity to object.
Opt-Out: You have the right to object to the processing of your personal information for direct marketing purposes at any time. You can opt-out by following the unsubscribe instructions in our marketing communications or by contacting our Information Officer.

9. Trans-border Flow of Personal Information

We may transfer your personal information to recipients in other countries if necessary for the purposes outlined in this Privacy Policy. This may occur if our service providers or partners are located outside of South Africa.

We will only transfer your personal information to a foreign country if:

The recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection for your personal information, similar to POPIA.
You consent to the transfer.
The transfer is necessary for the performance of a contract between you and us.
The transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party.
The transfer is for your benefit and it is not reasonably practicable to obtain your consent, and if it were practicable, you would likely give your consent.

10. Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

Right to be Informed: To be notified that your personal information is being collected or that a security compromise has occurred.
Right of Access: To request confirmation whether we hold personal information about you and to request access to that information.
Right to Correction/Deletion: To request the correction, destruction, or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.
Right to Object: To object, on reasonable grounds, to the processing of your personal information.
Right to Object to Direct Marketing: To object to the processing of your personal information for direct marketing purposes.
Right to Complain: To lodge a complaint with the Information Regulator regarding our processing of your personal information.
Right to Institute Civil Proceedings: To institute civil proceedings for any breach of your rights under POPIA.

To exercise any of these rights, please contact our Information Officer using the details provided below. We may require proof of your identity before responding to your request.

11. Information Officer Details

Our Information Officer is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, our data practices, or if you wish to exercise any of your rights, please contact our Information Officer:

Information Officer: Tayla Thomlison

Email: info@spotonpackaging.co.za

Telephone: 011 367 4114

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the updated policy on our website with a new "Last Updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

SpotON Packaging (Pty) Ltd

e: info@spotonpackaging.co.za

t: 011 367 4114

442 Janine Ave, The Willows, Tshwane, Gauteng, 0081

Need catering or hospitality supplies?