boan.BOAN-POL-PRIV-01
boan.
Privacy Policy
- Document
- BOAN-POL-PRIV-01
- Version
- 1.0
- Effective from
- 09 August 2026
- Applies to
- Website visitors, store customers, clients and applicants
- Published by
- Bonang M Investments (Pty) Ltd t/a BOAN, Reg. No. 2026/036723/07
This policy explains how Bonang M Investments (Pty) Ltd, trading as BOAN, collects, uses, shares and protects personal information. It is published in accordance with the Protection of Personal Information Act 4 of 2013, which we refer to as POPIA.
In short: we collect the information we need to quote for work, to do the work, to sell and deliver products, and to run the business. We do not sell your information. We keep it only as long as we need it or the law requires. You can ask us what we hold, ask us to correct it, and object to its use.
Personal information, processing, responsible party, operator and data subject bear the meanings given to them in POPIA.
1Who is responsible for your information
1.1Bonang M Investments (Pty) Ltd, registration number 2026/036723/07, trading as BOAN, is the responsible party for the personal information described in this policy, except where clause 9 applies.
1.2Our information officer is registered with the Information Regulator and may be contacted at the address in the contact block below.
2What we collect
2.1From website visitors. Your name, email address, telephone number, company name and whatever you choose to tell us in an enquiry or quote request. Technical information about your visit is dealt with in our Cookie Policy.
2.2From store customers. Your name, delivery and billing address, email address, telephone number, order history and delivery details. Card details are entered directly with our payment provider and are never received or stored by us.
2.3From clients. Contact details of your staff, your company registration and VAT details, banking details for refunds, and any material you send us for the work, which may itself contain personal information.
2.4From applicants for employment. Your curriculum vitae, portfolio, identity number, qualifications, references and anything else you send in support of an application.
2.5We do not knowingly collect the personal information of children under 18 without the consent of a competent person. Where we learn that we have, we delete it.
2.6We do not seek special personal information as defined in POPIA, such as information about health, religion, race or trade union membership. Where you volunteer it, we process it only for the purpose for which you gave it.
3Why we process it, and on what basis
3.1To respond to an enquiry, to prepare a quotation and to negotiate an engagement. Basis: steps taken at your request before concluding a contract.
3.2To perform a contract with you: doing the work, delivering an order, invoicing and collecting payment, and supporting you afterwards. Basis: performance of a contract.
3.3To meet a legal obligation, including keeping accounting records under the Companies Act and tax records under the Tax Administration Act. Basis: compliance with an obligation imposed by law.
3.4To protect our legitimate interests: preventing fraud, securing our systems, recovering amounts owed to us, and defending or bringing legal claims. Basis: legitimate interests.
3.5To send you marketing about our own similar services where you are an existing client, and otherwise only where you have consented. Basis: consent, or section 69 of POPIA. Every marketing message carries an unsubscribe option and we act on it.
3.6To consider you for a position you have applied for. Basis: steps taken at your request before concluding a contract.
4Who we share it with
4.1We share personal information only where it is necessary, and only with: our payment providers; our couriers and delivery partners, who receive your name, address and telephone number in order to deliver; our printers, manufacturers and photographic suppliers, where the work requires it; our accountants, auditors and attorneys; and our software and hosting providers.
4.2Every operator that processes personal information on our behalf is required by written contract to process it only on our instructions, to keep it confidential, and to secure it as required by section 21 of POPIA.
4.3We may disclose personal information where the law requires it, where a court orders it, or where it is necessary to establish, exercise or defend a legal claim.
4.4We do not sell personal information, and we do not share it with third parties for their own marketing.
5Information sent outside South Africa
5.1Some of the services we use to run the business, including cloud storage, email, hosting, file transfer and creative software, store information on servers outside the Republic of South Africa.
5.2Where personal information is transferred out of the Republic, we do so in accordance with section 72 of POPIA: either the recipient is subject to a law or binding agreement giving effect to principles substantially similar to POPIA, or the transfer is necessary to perform a contract with you, or you have consented.
6How we protect it
6.1We take appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in our possession, as required by section 19 of POPIA. These include access control, encryption in transit, multi-factor authentication on business accounts, and restricting access to those who need it.
6.2No system is perfectly secure. Where we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires.
7How long we keep it
7.1Enquiries that do not become work: two years from the last contact, so that we can pick up a conversation you return to.
7.2Client and project records, including contracts and correspondence: five years after the engagement ends, which matches the period in which a contractual claim may still be brought.
7.3Accounting records, invoices and tax records: five years from the end of the relevant tax period, as the Companies Act and the Tax Administration Act require.
7.4Store orders and delivery records: five years, for warranty, returns and accounting purposes.
7.5Unsuccessful job applications: twelve months, unless you ask us to keep your details on file for longer.
7.6When a retention period ends we delete the information or de-identify it so that it can no longer be linked to you.
8Your rights
8.1You have the right to be told whether we hold personal information about you, and to be given a record of it. A request of this kind is made under the Promotion of Access to Information Act 2 of 2000 and is dealt with in our PAIA Manual. A prescribed fee may apply.
8.2You have the right to ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
8.3You have the right to object, on reasonable grounds, to our processing of your information where we rely on legitimate interests, and to withdraw consent where we rely on consent. Withdrawing consent does not affect processing that took place before it was withdrawn.
8.4You have the right not to receive direct marketing from us, and to require us to stop.
8.5You have the right to complain to the Information Regulator. We would prefer that you raise it with us first, and we will respond within a reasonable time.
8.6We will not charge you for exercising a right except where POPIA or PAIA permits a fee, and we will tell you the amount before we act.
9When we act for a client rather than for ourselves
9.1Where a client sends us personal information to use in the work, for example a customer list for a mailer or photographs of identifiable people, that client is the responsible party and we act as its operator.
9.2In that role we process the information only on the client's documented instructions, we do not use it for our own purposes, and we return or delete it when the engagement ends.
9.3Questions about information processed in that capacity should be directed to the client concerned. We will tell you who that is if you ask.
10Changes to this policy
10.1We may update this policy. The version in force is the one published on our website, and its effective date appears at the head of this document.
10.2Where a change materially affects how we use information we already hold about you, we will tell you before it takes effect.
How to contact us
- Company
- Bonang M Investments (Pty) Ltd
- Trading as
- BOAN
- Information officer
- AM Maile, Director
- Postal address
- PO Box 4471, Parklands, Johannesburg, 2121
- privacy@boan.co.za
- Telephone
- +27 11 447 0140
- Information Regulator
- complaints.IR@justice.gov.za, inforegulator.org.za