Privacy Policy — Bafana Vault

1. Who we are

Bafana Vault is a registered South African private company that designs and sells premium matchday and supporter apparel — including hoodies, caps, mugs, drinkware, and fan accessories — branded with our embroidered gold crest. We operate online only and ship across South Africa.

For the purposes of POPIA, the Responsible Party is:

Registered name: Bafana Vault (Pty) Ltd
Trading name: Bafana Vault
CIPC registration no.: K2026450857 (2026/450857/07)
Director / Information Officer: Marko Werkman
Registered address: 73 Kingfisher, Potchefstroom, North West, 2520, South Africa
Email: bafanavault@gmail.com
Phone: +27 71 600 7823
Website: https://bafanavault.co.za

2. What personal information we collect

We only collect the minimum information needed to fulfil your order, respond to your enquiry, and run our business. Specifically:

Information you give us directly

Order info: full name, email address, phone number, shipping address, billing address, items ordered, sizes, and colour preferences.
Affiliate applications: name, email, phone, social-media handles, audience details, and any free-form notes you provide via our affiliate form.
Support enquiries: any information you include in messages sent to bafanavault@gmail.com or via the support chat.

Information collected automatically

Device & usage data: IP address, browser type, operating system, device identifiers, referring URL, pages visited, and timestamps.
Cookies and similar technologies: see section 6 — Cookies & tracking.

Information we do NOT collect

We do not store credit-card or debit-card numbers. Card data is handled exclusively by our payment gateway (iKhokha) on their secure infrastructure.
We do not collect special personal information (race, religion, health, sexual orientation, biometric data, etc.).

3. Why we collect your information (purpose)

We process your personal information only for clearly defined, lawful purposes:

Order fulfilment: to process orders, arrange delivery, communicate dispatch/tracking, and handle returns or refunds.
Customer support: to respond to your enquiries, complaints, and warranty requests.
Payment processing: to securely pass payment information to iKhokha for authorisation and settlement.
Marketing (only with consent): to send transactional emails and, where you have opted in, marketing communications about new drops and promotions. You may unsubscribe at any time.
Analytics & advertising: to understand how visitors use our website, measure ad performance, and improve our products. Includes use of the Meta Pixel (see section 6).
Legal & compliance: to meet our obligations under POPIA, the Consumer Protection Act, the Financial Intelligence Centre Act (FICA), tax law, and similar legislation.
Fraud prevention: to verify orders, detect fraudulent activity, and protect our business and customers.

4. How we collect your information

Directly from you, when you place an order, apply to be an affiliate, or contact our support team.
Automatically, via cookies and similar technologies when you browse our website.
From our service providers — for example, payment confirmations from iKhokha or delivery confirmations from couriers.

5. Who we share your information with

We do not sell your personal information. We share it only with the third-party processors we need to run the business, all bound by their own data-protection obligations:

iKhokha (Pty) Ltd, RSA — for payment processing. iKhokha privacy policy.
Netlify, Inc. (USA) — for website hosting and form submissions (affiliate forms). Netlify privacy policy.
Meta Platforms Ireland Ltd. — for our Meta Pixel (Facebook + Instagram advertising). Meta privacy policy.
Google LLC — for fonts (Google Fonts). No personal information is shared beyond standard IP-based delivery.
Couriers and fulfilment partners — e.g. The Courier Guy, Pudo, Aramex — to deliver your order. Only your name, address, and phone number are shared with them, for the sole purpose of delivery.
Professional advisors — accountants, lawyers, and our bank — only where strictly necessary for legal, tax, or compliance purposes.
Law enforcement or regulators — only where required by South African law or a valid court order.

6. Cookies and tracking technologies

We use cookies and similar technologies to keep the site working, to remember your preferences, and to measure how our marketing is performing. The main ones are:

Strictly necessary cookies — for cart and checkout. These cannot be disabled without breaking the site.
Analytics & advertising cookies (Meta Pixel) — to track page views, content views, and purchase events so we can measure ad performance and show you more relevant ads on Facebook and Instagram. The Meta Pixel ID is 27015885914688835.

You can disable cookies in your browser settings, but some parts of the site (notably checkout) may not work correctly. You can opt out of personalised Meta ads via your Meta Ad Preferences.

7. How long we keep your information

We keep your personal information only as long as we need it:

Order & invoice records: five (5) years, as required by the South African Revenue Service (SARS) and the Companies Act.
Lead captures: until you ask us to delete them, or 12 months after your last interaction — whichever is sooner.
Affiliate applications: 24 months from the date of application, unless extended by an active affiliate agreement.
Support correspondence: 24 months from the date of the last message.
Marketing consent records: until you withdraw consent, plus a short retention to prove the withdrawal occurred.
Website analytics & pixel data: retained on Meta's servers under their own retention policies.

8. How we protect your information

Our website is served exclusively over HTTPS (TLS encryption in transit).
Payment card data never reaches our servers — it is processed directly by iKhokha on their PCI-DSS compliant infrastructure.
Access to customer data is limited to our director and to service providers acting under written instructions.
Passwords and sensitive credentials are stored using industry-standard hashing where applicable.
We regularly review our security practices and patch dependencies as updates are released.

No method of transmission or storage over the internet is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security.

9. Cross-border transfers of information

Some of our service providers — including Netlify (USA), Meta (Ireland/USA), and Google (USA/Ireland) — may process your personal information outside South Africa. Where this happens, we rely on contractual safeguards (such as the European Standard Contractual Clauses or the providers' own POPIA-compliant terms) to ensure your information continues to receive a similar level of protection.

10. Your rights under POPIA

You have the following rights regarding your personal information:

Right of access: to know what information we hold about you.
Right to correction: to ask us to correct any information that is inaccurate, irrelevant, outdated, incomplete, or misleading.
Right to deletion: to ask us to delete information we no longer need (subject to legal retention obligations).
Right to object: to object to the processing of your personal information for direct marketing purposes at any time.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time — though this does not affect the lawfulness of past processing.
Right to lodge a complaint: with the Information Regulator (see section 13).

To exercise any of these rights, email bafanavault@gmail.com with the subject "POPIA request". We will respond within a reasonable period and at most within 30 days. We may need to verify your identity before processing the request.

11. Children

Our products are not directed at children under the age of 18. We do not knowingly collect personal information from anyone under 18 without the consent of a parent or legal guardian. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

12. Changes to this policy

We may update this policy from time to time — for example, when we add new services, change service providers, or to reflect changes in the law. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated via email or a notice on our website.

13. Contact & complaints

For any questions, concerns, or POPIA requests, please contact our Information Officer:

Information Officer: Marko Werkman
Email: bafanavault@gmail.com
Phone: +27 71 600 7823
Postal address: Bafana Vault (Pty) Ltd, 73 Kingfisher, Potchefstroom, North West, 2520, South Africa

Complaints to the Regulator

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

Website: inforegulator.org.za
Complaints email: POPIAComplaints@inforegulator.org.za
Phone: +27 (0) 10 023 5200
Postal address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001