Privacy Policy

Last updated: August 4, 2026
Responsible party: DK Brands (Pty) Ltd ("DK Brands", "we", "us" or "our")
Address: 14 Cronje Rd, Harmoniesrus, Vereeniging, South Africa
Information Officer contact: privacy@dkbrands.co.za · 076 230 9169

By visiting dkbrandsweb.yourapps.co.za or dkbrands.yourapps.co.za, or by engaging with DK Brands as a customer, reseller, supplier or job applicant, you acknowledge that you have read and understood this Privacy Policy.

1. Information we collect

We only collect personal information that is reasonably necessary for our legitimate business purposes and the fulfilment of any contract between us. Depending on how you interact with DK Brands, this may include:

Category	Examples of data collected	Purpose & lawful basis
Contact details	Full name, company name, email address, telephone number, postal / delivery address	Contract performance · legitimate interest (customer relationship)
Account & login	ERP username, password hash, assigned role, client account number	Contract performance · POPIA condition (security)
Transactional	Order history, product specifications, quantities, pricing, quotations, invoices, payments, proof of delivery	Contract performance · tax / statutory obligations
Enquiry & form data	Content of the message you send us via Contact Us / product inquiry / reseller forms	Consent · legitimate interest (responding to you)
Employment & vendor	CVs, ID numbers (last 4 digits only preferred), tax information, banking details (for payments only)	Contract performance · statutory compliance
Website usage	IP address (log files only, not linked to individuals), referral URL, browser User-Agent, timestamp, pages requested	Legitimate interest (security and site reliability)

We do not collect special personal information (race, religion, health, biometrics, political beliefs) unless it is a lawful requirement of a specific tender or engagement and we have obtained your explicit written consent.

2. How we use your information

We use the personal information above for strictly limited purposes, including to:

• Respond to Contact Us, reseller and product inquiry forms.
• Quote, manufacture, fulfil and deliver custom apparel, textile and sublimation orders.
• Issue invoices, statements, receipts and support debt collection in line with the National Credit Act.
• Provide after-sales service, warranty support and product recalls.
• Administer your DK Brands client portal account, including authentication and access rights.
• Send marketing communications (newsletters, new product launches, reseller promotions) only where you have given explicit opt-in consent or we have an existing customer relationship with you in terms of section 69 of POPIA. You can opt out at any time.
• Maintain the security, integrity and availability of our websites and ERP systems, and detect fraud or misuse.
• Meet legal and statutory obligations (SARS, Customs, the Companies Act, POPIA, PAIA, etc.).

3. Cookies and similar technologies

Our public-facing websites (dkbrandsweb.yourapps.co.za) currently use only essential, first-party session cookies to preserve navigation state (for example remembering a product search). We do not use third-party tracking, advertising pixels or Google Analytics advertising identifiers on the public marketing site. The admin ERP at dkbrands.yourapps.co.za uses session cookies required for authenticated login, role-based access and form submission protection (CSRF tokens). You can disable cookies in your browser, but doing so will prevent client portal login and may break form submissions.

4. Sharing your information

DK Brands does not sell personal information. We only share personal information with trusted third parties under one of the following conditions, and only to the minimum extent required:

• Transporters and couriers (e.g. freight companies delivering to your nominated address) — name, phone, delivery address only.
• Accounting and legal advisors — only to the extent necessary for audit, tax or legal advice, and bound by professional confidentiality.
• Banks and payment processors — to process customer payments (EFT proof-of-receipts, card settlement).
• Law enforcement / regulators — only where we are legally compelled to do so by court order, statute or regulator. We will notify you of any such request where we are legally permitted to.
• Cloud hosting providers — we use a reputable regional hosting provider located within South Africa. All shared infrastructure is protected by data-processing agreements compliant with POPIA Chapter 8.

5. Cross-border transfers

Where any personal information is transferred outside of South Africa (for example when a SADC reseller receives an emailed quote or PDF invoice) we rely on POPIA section 72 conditions — either (a) the recipient country has adequate legislation, (b) the transfer is necessary for performance of the contract between you and us, or (c) you have consented after being informed of the risks. All email attachments with sensitive customer data are sent with password protection where appropriate.

6. Security measures

We apply appropriate technical and organisational safeguards in line with POPIA section 19 and the General Cyber Security Best Practices Guideline from the Cyber Security Institute. These include:

• Hashed and salted password storage (bcrypt / Argon2 family) for all authenticated users.
• Role-based access control (RBAC) in the ERP — only users with a business need can access a specific data class.
• TLS 1.2+ encryption of all in-transit website, portal and API traffic.
• Encrypted-at-rest storage for the production database and daily backups.
• Quarterly vulnerability scans and an annual external penetration test.
• Ongoing staff awareness training covering POPIA, phishing and secure handling of customer documents.
• Documented data breach response plan; mandatory notification to the Information Regulator and affected data subjects within legislated timelines if a breach is assessed as having a reasonable likelihood of resulting in harm.

7. Retention periods

We do not retain personal information for longer than is necessary for the purpose for which it was collected, or as required by law. Our standard retention schedule is:

• Contact / reseller inquiries — 24 months from last meaningful interaction, after which anonymised or destroyed.
• Customer orders & invoices — 5 years from date of closure (required by the Companies Act 71 of 2008 and SARS Tax Administration Act).
• Client portal accounts — retained while the relationship is active; securely deleted (anonymised) 36 months after account closure.
• Supplier / vendor records — 7 years for tax and audit.
• Employment records — 30 years (per BCEA and POPIA requirements).
• Website access logs — 90 days, then aggregated and anonymised.

8. Your rights (POPIA Chapter 3 + 6)

As a data subject, you are entitled to the following rights in relation to your personal information held by DK Brands. All requests can be made to our Information Officer (details above) and will be responded to within the 30 working-day window prescribed by POPIA, extendable by a further 30 working days where justified.

8.1 Right of access (section 23)

You may request a written record confirming whether or not we hold personal information about you, plus a description of the information concerned, the identity of all third parties it has been shared with (where recordable), and the source of the information where known. A reasonable administrative fee may apply where POPIA permits.

8.2 Right to correction / deletion (sections 24–25)

You may request that we correct or destroy any of your personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully. We will honour the request unless we are legally obliged to retain the specific record.

8.3 Right to object and restrict processing (section 11)

Where processing is based on our legitimate interest, you may object on reasonable grounds relating to your particular situation. If you object to direct marketing, we will stop immediately at no cost to you.

8.4 Right to opt out of marketing

Every marketing communication we send contains a clear, single-click unsubscribe mechanism. You may also notify privacy@dkbrands.co.za and we will remove your details within 5 working days.

8.5 Right to lodge a complaint

If you are dissatisfied with our response to a rights request or the handling of your personal information, you may complain to our Information Officer in the first instance, and thereafter to the:

• Information Regulator (SA)
  Email: enquiries@inforegulator.org.za
  Tel: 010 003 2000 / 012 406 3400
  Website: www.justice.gov.za/inforeg

9. Children (section 34 POPIA)

DK Brands does not knowingly collect or solicit personal information from children (natural persons under the age of 18). Our websites and services are directed at businesses and adult decision-makers. If you believe a child has provided us with personal information, please contact the Information Officer and we will delete the information as soon as practically possible.

10. Data subject requests — how to submit

Please submit all POPIA rights requests, access requests, correction requests and opt-outs in writing via email to privacy@dkbrands.co.za or via registered post to:

• Attn: Information Officer — DK Brands (Pty) Ltd
  14 Cronje Rd, Harmoniesrus
  Vereeniging, 1929
  Gauteng, South Africa

To protect your information we will verify your identity before processing any access or correction request — this may include requesting a certified copy of your SA ID document (the last 4 digits of which we redact after verification where possible).

11. Policy updates

We review this Privacy Policy at least once per annum and whenever there is a material change to our processing activities. Updates are published on this page with a revised "Last updated" date at the top. Where a change is material (affecting the scope of processing or the lawful bases you agreed to) we will also notify you by email or by a prominent notice on the home page.

12. Contacting the Information Officer

Email: privacy@dkbrands.co.za
Telephone: 076 230 9169 · Mon–Fri, 08:00–17:00 SAST
Registered office: 14 Cronje Rd, Harmoniesrus, Vereeniging, 1929, Gauteng, South Africa