POPI Act manual.

1. About this manual

The Protection of Personal Information Act 4 of 2013 (“POPIA”) gives effect to everyone’s constitutional right to privacy, including the right against the unlawful collection, retention, dissemination and use of personal information. It requires a responsible party to protect personal information when processing it, and to comply with the eight conditions for lawful processing.

This manual sets out the policies and procedures Bennett Brothers CC, trading as Bennetts for Babies, follows to comply with POPIA, including for our online shop. Our privacy policy explains, in shorter form, what the online shop does with your personal information.

Version 2026-10, updated 22 October 2026 for the online shop.

2. Our Information Officer

As a responsible party, Bennett Brothers CC must ensure that the conditions for the lawful processing of personal information are met. Bennett Brothers CC is a private body, and its Information Officer is the head of the entity, who has accepted this responsibility and the accountability that comes with it.

• Information Officer: David Bennett
• Email: info@bennettsforbabies.co.za
• Telephone: +27 11 608 3733
• Physical address: 16–18 Galaxy Avenue, Linbro Office Park, Linbro Park, Johannesburg, South Africa
• Postal address: PO Box 76005, Wendywood, 2144, South Africa

A Deputy Information Officer has also been appointed, with sufficient time and resources to deal with POPIA and the Promotion of Access to Information Act (“PAIA”). The Information Officer remains accountable for everything delegated. The Information Officer is registered with the Information Regulator, and the details will be updated if the Information Officer changes.

3. How we process personal information lawfully

We process personal information in line with POPIA’s eight conditions for lawful processing:

1. Accountability: our Information Officer is responsible for compliance.
2. Processing limitation: we process only what we need, lawfully and in a way that doesn’t unreasonably infringe privacy, and collect it from you directly wherever we can.
3. Purpose specification: we collect personal information for specific, explicitly defined and lawful purposes, and tell you what they are.
4. Further processing limitation: we only use information for another purpose if it is compatible with the purpose we collected it for, or the law allows it.
5. Information quality: we take reasonable steps to keep personal information complete, accurate and up to date.
6. Openness: we tell you what we process, in this manual and our privacy policy.
7. Security safeguards: we protect personal information with appropriate technical and organisational measures.
8. Data subject participation: you can ask to see, correct or delete your personal information.

4. Whose personal information we process

Our personal information impact assessment identified these groups of people (data subjects):

• Prospective employees and employees
• Customers (including trade customers, their data protection officers and trade references)
• Suppliers
• The company’s own records
• People who receive our product samples and mail marketing
• COVID screening records
• Online shop customers, account holders, newsletter subscribers, and website visitors and people who contact us through the website

What the online shop collects:

5. Special personal information and children

We process special personal information only for employees (for employment equity purposes) and for COVID screening, and only where POPIA allows it, for example with consent or where the law requires it. The online shop does not collect special personal information.

We do not process the personal information of children. Our online shop is for adults, including parents and caregivers buying for babies and children, and we do not knowingly invite anyone under 18 to open an account or subscribe to our newsletter.

Bennett Brothers CC has obtained prior authorisation from the Information Regulator to process customer financial information for credit reporting, to provide credit facilities to trade customers. The online shop does not offer credit or do credit reporting.

6. Why we process it, and on what grounds

We only process personal information where at least one of these applies:

• you (or a competent person, for a child) have consented;
• it is necessary to conclude or perform a contract with you;
• the law requires it;
• it protects your legitimate interest; or
• it is necessary for our legitimate interests, or those of a third party we supply it to.

In the online shop, orders and accounts are processed to perform our contract with you; tax invoices and order records because tax law requires them; the newsletter only with your consent; and visit counts, security and fraud prevention in our legitimate interest. The full list of purposes is in section 3 of our privacy policy.

You may withdraw your consent, or object to processing, at any time: online with the unsubscribe link in any marketing email or the marketing preference in your account, or on Form 1 (objection to the processing of personal information), which we can send you. Where processing isn’t needed for a contract or required by law, we stop as soon as you object. Where information is needed to fulfil an order or comply with the law, not providing it may mean we can’t complete the order.

7. How long we keep it

We keep personal information only as long as we need it for the purpose it was collected for, unless the law requires or allows us to keep it longer, a contract requires it, or you have agreed. Our general policy is to keep records for up to ten years after the agreement or service ends, where the person concerned has agreed; otherwise records are kept for the period the law prescribes, and other personal information is destroyed after five years.

Online shop customers are not asked to agree to the ten-year period, so online shop information is kept as follows:

Some records, such as company and VAT registration numbers in our accounting system and employees’ employment and payroll history, are kept beyond these periods because the law requires or allows it. When personal information is no longer needed, we delete, destroy or de-identify it.

8. Keeping it accurate

You can ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, using Form 2 (request for correction or deletion of personal information) or by emailing info@bennettsforbabies.co.za. While we check, we restrict the use of that information. As soon as reasonably possible we will correct or delete it, or show you credible evidence for it (and, if you ask, note that a correction was requested); tell anyone we shared it with; and tell you the outcome.

Online, you can correct your own name, email address, saved addresses and marketing preference in your account at any time. To correct an order’s details, such as the delivery address, contact us before it’s sent.

9. Who processes it for us

We never sell personal information. These operators process personal information on our behalf:

Each operator is bound by a service agreement (for the online shop’s providers, their terms of service and data processing terms) to keep the information confidential and secure, to the same standard as we do, and to tell us immediately if it may have been accessed by someone unauthorised. Bennett Brothers CC does not act as an operator for anyone else.

10. Information sent outside South Africa

We only transfer personal information to a third party in another country if that party is bound by law, binding corporate rules or a binding agreement giving an adequate level of protection; or you consent; or the transfer is necessary to perform a contract with you or in your interest, as section 72 of POPIA allows.

11. How we keep it safe

We secure the integrity and confidentiality of personal information with appropriate, reasonable technical and organisational measures, to prevent its loss, damage or unauthorised destruction, and unlawful access to or processing of it. Our risk assessment identified the risks of data loss, unauthorised access or theft of data or devices, unauthorised sharing, and inaccurate or outdated data. Our safeguards include internal policies, antivirus, firewalls, access controls and remote destruction, which we monitor and update regularly.

In the online shop:

• the whole website uses an encrypted (https) connection;
• card details are entered on Stitch’s secure payment page and never reach our systems;
• passwords are stored only as one-way hashes, so nobody, including our staff, can see or recover them;
• repeated failed sign-ins are paused for 15 minutes, and password reset links work once and expire after an hour;
• the sign-in cookie can’t be read by scripts on the page and is only sent over https;
• customers can see only their own orders, addresses and subscriptions;
• the keys to our database, payment, delivery and email services are kept in our hosting provider’s protected settings, not in the website’s code.

12. If personal information is compromised

If there are reasonable grounds to believe that someone’s personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected (unless they can’t be identified) as soon as reasonably possible, taking into account the needs of law enforcement and the steps needed to find out what happened and secure our systems. We will only delay if a public body investigating offences, or the Regulator, decides that notifying would impede a criminal investigation.

We will tell you in writing, by email, post, a notice on our website or as the Regulator directs, and explain the possible consequences, what we have done or will do about it, what you can do to protect yourself, and, if known, who may have accessed the information.

13. Direct marketing

We only send electronic direct marketing to people who have given their consent, or to existing customers about our own similar products where POPIA’s conditions are met, including a free and easy chance to object when we collect their details and in every message. Consent must be a positive choice, never just the absence of an objection, and we only ask for it once.

On the website, you join our newsletter yourself, on the sign-up form or by ticking the box (which starts unticked) when you open an account, and we record when, where and the exact words you agreed to. Online shop customers aren’t added to marketing just because they placed an order or opened an account; they still receive the emails their order needs, such as the confirmation, tax invoice and delivery updates. Every marketing email identifies Bennetts for Babies and has an unsubscribe link, and anyone who unsubscribes is kept on an unsubscribe list so they never receive marketing from us again. We do not make our customer directories available to the public.

14. Training

New employees receive POPIA awareness training when they join, existing employees at least once a year, and the Information Officer and Deputy Information Officers formal training for their roles. Staff who handle online orders and website messages are made aware of the online shop’s procedures in this manual.

15. Your rights and how to make a request

Under POPIA you have the right to:

• be told when your personal information is collected, or has been accessed or acquired by an unauthorised person;
• ask whether we hold your personal information, and to see it;
• ask us to correct, destroy or delete it, where appropriate;
• object, on reasonable grounds, to its processing, and object at any time to direct marketing;
• not receive unsolicited electronic direct marketing, except as POPIA allows;
• not be subject, in certain circumstances, to a decision based solely on automated processing that profiles you;
• complain to the Information Regulator, and to institute civil proceedings.

To find out whether we hold your personal information, and who has had access to it, please send a request with proof of your identity to info@bennettsforbabies.co.za, on Form C (request for access to a record of a private body) under PAIA. Corrections and deletions use Form 2, and objections Form 1; we can send you any of these forms, and they are also available from the Information Regulator. A fee may apply to access requests, as set by PAIA, and if it does we will give you a written estimate first.

If you’re unhappy with how we’ve handled your personal information, please talk to us first. You can also complain to the Information Regulator (on Form 5) through inforegulator.org.za.