POPIA & PAIA Notice

1. Responsible party & Information Officer (POPIA s. 1 & s. 56)

Responsible party (Die Verantwoordelike Party):

• Name: DK Brands (Pty) Ltd ("DK Brands" / "the Responsible Party")
• Company registration number: 2023/012345/07 (private company duly incorporated in the Republic of South Africa)
• Registered address & principal place of business: 14 Cronje Rd, Harmoniesrus, Vereeniging, Gauteng, 1929, South Africa
• Industry: custom apparel, sublimation, textiles, branded corporate gifts, printing equipment and related consumables

Information Officer (IO) — appointed in terms of POPIA s. 56(1):

• Full name: K. van der Merwe
• Title: Company Secretary / Information Officer of DK Brands (Pty) Ltd
• Designation: registered with the Information Regulator (SA)
• Direct email: privacy@dkbrands.co.za
• Direct telephone: 076 230 9169 · 08:00–17:00 SAST, Monday–Friday
• Physical address for service of PAIA / POPIA notices: 14 Cronje Rd, Harmoniesrus, Vereeniging, 1929

Deputy Information Officer: designated within the Internal Audit function; email audit@dkbrands.co.za for escalation only.

2. The eight POPIA conditions for lawful processing

DK Brands has implemented, documented and periodically reviews the eight conditions for lawful processing of personal information (POPIA Chapter 4, sections 12 to 20):

#	Condition (POPIA section)	How DK Brands demonstrates compliance
1	Accountability (s. 12)	Written Information Officer appointment; data register (RACI) maintained; annual POPIA audit; documented SOPs and training records.
2	Processing limitation (s. 13)	Data minimisation; lawful basis always recorded (contract / consent / legitimate interest / statutory); no special personal information unless POPIA ss 26–32 met.
3	Purpose specification (s. 14)	Purpose statements on every intake form; data not further processed incompatibly; record of processing activities (RoPA) maintained by the IO.
4	Further processing limitation (s. 15)	Marketing opt-in / soft opt-in (POPIA s. 69) rules enforced; no re-use outside disclosed purpose without fresh lawful basis.
5	Information quality (s. 16)	Customer self-service portal for corrections; data validation on intake; annual customer-data confirmation sweep for active accounts.
6	Openness (s. 17)	This notice + full Privacy Policy published; data subject advised of collection purpose at or before collection; PAIA manual available.
7	Security safeguards (s. 18)	See clause 6 below — encryption, RBAC, TLS, backups, quarterly vulnerability scans, annual pen test, documented breach response.
8	Data subject participation (s. 19)	Rights requests handled per clause 8 below; 30-working-day response window; documented appeal / escalation process to Regulator.

3. Categories of information we process

The following table summarises the categories of data subjects and the personal information typically processed for each, per section 17(4) of POPIA:

Data subject	Typical personal information processed	Lawful basis(es) used
Customers / account holders	Names, company, email, phone, delivery address, order history, tax invoice data	Contract performance (s. 13(2)(d)), legitimate interest
Prospects / enquirers	Name, company, email, phone, message content from contact form	Consent (s. 13(2)(a)), legitimate interest (response)
Resellers & distributors (SADC & SA)	Account application info, directors' names, VAT / tax info, credit references, banking details	Contract, statutory, legitimate interest
Suppliers & vendors	Contact person name, company, email, banking details, B-BBEE affidavits, tax clearance	Contract, statutory (tax / Companies Act)
Employees, candidates and temps	ID number, contact details, CV, qualifications, banking details, tax (IRP5), next of kin	Contract, BCEA, EEA, statutory obligations
Visitors to our websites & portals	IP address (log only), timestamp, User-Agent, referral URL; no tracking cookies (see Privacy Policy)	Legitimate interest (security & uptime)

4. Direct marketing & POPIA section 69

DK Brands respects the restrictions on unsolicited electronic communications in POPIA section 69 and ECT Act section 45. Specifically:

• We send direct marketing (newsletters, reseller offers, product launches, tenders) only where: (a) we obtained your explicit opt-in, or (b) you are an existing customer of DK Brands and the marketing relates to our own similar products or services (soft opt-in), and you have not objected.
• Every electronic marketing communication we send contains a functional, free, single-click unsubscribe mechanism that takes effect immediately.
• If we obtain your details from a third-party list, it will be a POPIA-compliant list provider that has recorded your explicit opt-in to receive marketing from similar businesses. We retain proof of opt-in.
• We do not use automated decision-making or profiling for marketing purposes.

5. Cross-border transfers (POPIA s. 72)

DK Brands is a South African manufacturer and the overwhelming majority of personal information remains processed inside the Republic of South Africa. Where cross-border transfer is required (for example SADC-based reseller information being forwarded via email to our export department using a cloud email provider, or a European customer receiving a PDF invoice) we rely on one of the following POPIA section 72 conditions, with preference in the order listed:

1. The transfer is necessary for the performance of a contract between us and the data subject (s. 72(1)(b)).
2. The transfer is necessary for the performance of a contract between DK Brands and a third party which is in the data subject's interest (s. 72(1)(c)).
3. The recipient is bound by a legally binding data processing agreement that substantially replicates POPIA Chapter 8 safeguards (s. 72(2)).
4. The data subject has consented in writing after being informed of the specific risks of the transfer (s. 72(1)(a)).

We do not transfer personal information to territories that have been publicly flagged by the Information Regulator as inadequate without an approved contractual framework and explicit data-subject consent.

6. Security of personal information (POPIA s. 18 & S. 19)

DK Brands applies the following documented technical and organisational safeguards against reasonably foreseeable risks:

• All data in transit protected by TLS 1.2+ for web, portal, email (TLS-opportunistic enforced with domain partners) and SFTP file transfers.
• Production database and secure file shares encrypted at rest; daily incremental offsite backups encrypted with AES-256, rotated off-site within South Africa and restore-tested monthly.
• Role-based access control (RBAC) enforced in the ERP; least-privilege onboarding; quarterly access recertification; immediate revocation on termination.
• Passwords stored with modern password hashing (bcrypt / Argon2 family) and MFA is enforced for all ERP administrative roles by end of Q3 2025.
• Network perimeter protected by a next-generation firewall with intrusion detection; DMZ segmentation between public web tier and internal business systems.
• All staff and temporary staff complete annual POPIA awareness + cyber hygiene training; agency and contractor staff sign NDAs and acknowledge POPIA SOPs.
• External penetration test conducted annually; automated vulnerability scanning every 90 days against external-facing assets.

6.1 Incident management & breach notifications

DK Brands maintains a documented Data Breach Response Plan that aligns with POPIA sections 19(3)–19(6) and the Information Regulator's Guidance Note 1 of 2022 on Compulsory Notification of Data Breaches. The plan includes:

• Rapid triage, containment, eradication and recovery steps.
• A mandatory legal assessment of "reasonable likelihood of the breach having a serious effect on a data subject" within 72 hours of identification.
• If the threshold is met: written notification to the Information Regulator and affected data subjects in the form, manner and timeline required by the Act.
• Lessons-learned review within 30 days of containment, with any required corrective actions tracked to closure by the Information Officer.

7. Retention & destruction / de-identification (POPIA s. 14(d) and s. 15 read with s. 3 of PAIA)

Personal information is retained only for as long as necessary to achieve the stated purpose, or as required by a statute or other law. Records scheduled for deletion are securely destroyed via cross-cut shredding (paper) or NIST SP 800-88-compliant cryptographic erasure + re-writing (digital). Where a legal hold, active dispute or ongoing investigation applies, a retention hold is logged and the record is excluded from routine destruction until the hold is lifted.

8. Data subject rights (POPIA Chapter 6)

8.1 Right of access (s. 23)

You may request a record confirming whether or not DK Brands holds personal information about you, the categories, sources, recipients, and purpose. Contact the Information Officer at privacy@dkbrands.co.za with the subject line "POPIA ACCESS REQUEST". Access requests are responded to within 30 working days, extendable by a further 30 working days where justified and communicated to you. A reasonable administrative fee, permitted by the Regulations, may apply if you request a second copy.

8.2 Right to correction or deletion of personal information (s. 24, s. 25)

You may request that DK Brands correct, destroy or delete your personal information where it is inaccurate, out of date, incomplete, irrelevant, misleading, excessive, or obtained unlawfully. If the specific record is one we are legally required to retain (e.g. a SARS-relevant tax invoice) we will not delete it, but we will append your correction request as metadata to the record and explain our decision in writing.

8.3 Right to object (s. 11, s. 69)

Where processing is based on our legitimate interest you may object on reasonable grounds relating to your particular situation; we will suspend processing pending assessment of the objection and either (a) stop the processing or (b) provide you with written reasons why we are obliged to continue. You may object to direct marketing at any time — we will stop immediately and for free.

8.4 Right to opt out of electronic directories (s. 26)

DK Brands does not sell, share or list personal information in commercial electronic directories.

8.5 Right to lodge a complaint (s. 91)

If you are dissatisfied with the outcome of a rights request or with our handling of your personal information, you may:

1. First escalate to our Information Officer in writing — we will respond within 10 working days.
2. Thereafter lodge a formal complaint with the Information Regulator of South Africa:

• Website: justice.gov.za/inforeg
• Complaints portal: complaints.justice.gov.za
• Switchboard: 012 406 3400 / 010 003 2000
• Email: enquiries@inforegulator.org.za

9. PAIA: Promotion of Access to Information Act 2 of 2000

DK Brands is a private body for the purposes of PAIA. Section 14 of PAIA requires that private bodies compile and maintain a manual. The DK Brands PAIA Manual is prepared in line with the latest SAHRC / Information Regulator-prescribed form and is available to any person on request, free of charge in electronic format. A hard copy may be requested and will be charged at the Information Regulator's prescribed fees (available on request via a fee quote).

9.1 Requesting access to records (PAIA Part 3)

Any person (or a person acting on behalf of another) may request access to a record held by DK Brands. Personal information about the requester will also normally be processed under the POPIA data subject access regime in clause 8.1 above, which provides a simpler and faster route. For non-personal commercial records, please submit a formal PAIA Part 3 request with the following mandatory particulars:

• Full name, postal address and contact telephone number and email address of the requester.
• Any capacity in which the requester is acting (self, on behalf of a natural person, or on behalf of a juristic person — please provide proof of authority).
• Adequate particulars of the record(s) sought so that DK Brands can identify and locate them with reasonable effort (type of record, date range, customer / project reference if applicable).
• An indication of the preferred form of access (inspection on site, certified hard copy, digital copy on DVD / secure link / email — subject to size limitations).
• Where a request is made on behalf of a person (or body), a certified copy of the written power of attorney, resolution or other authority sufficient to satisfy DK Brands of the requester's right to do so.

Submit PAIA requests by email to privacy@dkbrands.co.za with the subject line "PAIA REQUEST", or by registered post to 14 Cronje Rd, Harmoniesrus, Vereeniging, 1929, Gauteng, marked for the attention of the Information Officer. If DK Brands is not in a position to provide access, we will give written reasons as required by PAIA.

9.2 Categories of records automatically available (PAIA s. 51(1)(c)(iii))

The following categories of records are routinely maintained and (subject to the grounds for refusal and / or payment of any prescribed fee) may be requested:

• Company registration, CIPC annual returns, B-BBEE affidavit / certificate, tax clearance, VAT registration, letter of good standing (COID).
• Published product catalogues, pricing lists (published version only), data sheets and technical manuals.
• Standard Terms of Service, standard Quotation / Order Form templates.
• Quality policy and POPIA / PAIA related compliance notices (this page plus the PAIA Manual).
• Environmental health & safety policies relevant to the Vereeniging facility, where not commercially sensitive.
• Records that are in any event accessible to the public under another law.

10. Request-handling turnaround times

Request type	Acknowledgement	Substantive response
POPIA access / correction / deletion	3 working days	30 working days (extendable by up to 30 if notified)
Marketing / direct-marketing objection	Same-day / next working day	Opt-out confirmed within 5 working days
PAIA manual copy (electronic)	3 working days	10 working days
PAIA access to records request	Within 14 days with a PAIA prescribed request number	30 days (s. 25), extendable by up to 30 days with notice
Breach complaint / incident notification	Acknowledged within 24 hours	Regulator timelines apply where mandatory

11. Updates to this notice

This POPIA / PAIA notice is reviewed annually, or earlier if there is a material change in our processing, a regulatory amendment or a directive from the Information Regulator. Material amendments are published on this page with a revised "Last updated" date; in cases affecting the scope of lawful bases relied upon we will also provide direct notice to active account holders (email or in-ERP banner).

12. Contacting the Information Officer

Email: privacy@dkbrands.co.za
Telephone: 076 230 9169 · Mon–Fri 08:00–17:00 SAST
Physical / postal address: 14 Cronje Rd, Harmoniesrus, Vereeniging, 1929, Gauteng, South Africa