POPIA Notice

The Protection of Personal Information Act 4 of 2013 (“POPIA”) gives effect to the right to privacy in section 14 of the Constitution. It sets the conditions under which a business may collect and use personal information, gives people rights over their own information, and created the Information Regulator to enforce it.

Its main provisions commenced on 1 July 2020 and became fully enforceable a year later.

Uju Cakes is a “responsible party” under the Act, because we decide why and how your information is processed. This page sets out what that obliges us to do.

• Data subject: you, the person the information is about.
• Responsible party: us. We decide the purpose and the means of processing.
• Operator: someone who processes information on our behalf under contract, such as our email or order-form provider.
• Processing: anything done with information, such as collecting, storing, using, sharing and deleting.
• Personal information: information about an identifiable living person, and in South Africa also about an identifiable existing company or other juristic person.
• Special personal information: a protected category including health, religion, race, political persuasion, trade union membership and biometrics. An allergy is health information, so it falls here.

POPIA sets eight conditions for lawful processing. In plain terms, and what each one means for a bakery:

• Accountability: we are responsible for meeting all eight, even where it was an operator who slipped up.
• Processing limitation: we collect only what an order actually needs, we collect it from you directly, and we do not take more because it might be useful later.
• Purpose specification: we collect for a stated purpose, which is to quote, bake and deliver your order. We tell you that purpose at the point we ask.
• Further processing limitation: we do not later use your information for something incompatible with why you gave it. Your allergy note is used to bake safely, and for nothing else.
• Information quality: we keep your details accurate and current, and we correct them when you tell us they are wrong.
• Openness: we say what we hold and why. That is what our Privacy Policy and our PAIA Manual are for.
• Security safeguards: we take reasonable measures to keep your information safe, and we require our operators to do the same in writing.
• Data subject participation: you may see what we hold, correct it, and ask us to delete it.

Sections 23 to 25 give you the right to:

• Ask whether we hold personal information about you.
• Ask for a copy of it, and be told where we got it.
• Ask us to correct or complete anything inaccurate, irrelevant, misleading or out of date.
• Ask us to delete or destroy information we are no longer entitled to keep.
• Object, on reasonable grounds, to processing we do on the basis of legitimate interest.
• Withdraw consent at any time, where consent is what we relied on.
• Not be subject to a decision made solely by automated processing.
• Complain to the Information Regulator, and to go to court.

Exercise any of these by emailing uju.cakes@gmail.com. We answer within 30 days, and we do not charge for it.

Section 69 prohibits direct marketing by electronic means (email, SMS, automated calls) unless you have consented, or unless you are an existing customer and the marketing relates to something similar to what you bought from us.

We rely on that existing-customer basis, and only for cakes. Every message carries a free and immediate way to stop, and we act on it the first time you ask.

The Consumer Protection Act also has its own opt-out registry for direct marketers. It does not replace POPIA; it is a separate obligation sitting alongside it.

Section 22 requires us to notify both you and the Information Regulator where there are reasonable grounds to believe your personal information has been accessed or acquired by someone who should not have it. In practice this is expected within 72 hours.

Our notice would tell you what happened, what it is likely to mean for you, what we have done about it, what you should do, and who the unauthorised person was if we know.

We may only delay telling you if the Regulator, or a body investigating the matter, says that telling you would impede a criminal investigation.

Section 72 restricts sending personal information to another country. It is permitted where the recipient is bound by law or by binding agreement to standards comparable to POPIA, where you have consented, or where the transfer is necessary to perform our contract with you.

Some of the everyday services we use, such as email and the form provider that delivers your order enquiry to us, store data on servers outside South Africa. Those are the grounds we rely on when that happens.

The Information Regulator can investigate complaints, summon people, enter and search premises under warrant, and issue enforcement notices.

Failing to comply with an enforcement notice is an offence. Penalties run to a fine or imprisonment for the most serious offences, and the Regulator may impose administrative fines. A data subject may also sue for damages.

We would rather simply comply, which is what this page and our Privacy Policy are about.

Our Information Officer can be reached at uju.cakes@gmail.com or [CONTACT NUMBER]. Send POPIA requests and complaints there first. Most things are resolved quickly and directly.

If you are not satisfied, the Information Regulator can be reached at:

• Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za

For what we specifically collect, why, and how long we keep it, see our Privacy Policy. For asking us for a record, see our PAIA Manual.