Privacy notice
How KLAUT handles personal information under the Protection of Personal Information Act (POPIA), section 18.
Who is responsible
KLAUT (Pty) Ltd, TO CONFIRM. Information Officer: TO CONFIRM (owner, D11), hello@klaut.example, TO CONFIRM.
What we collect, and why
- Orders and quotes: your name, email, phone, organisation, billing and delivery address, VAT number (if any), what you order, and the artwork you upload — to quote, make, deliver and invoice your order (contract, and our legal duties to keep records).
- Payments: PayFast processes card and EFT payments. We receive the payment result and amount, never your card details.
- Your account: your email address and sign-in codes, to let you see your orders and proofs.
- Marketing: only if you tick the (unticked) opt-in box. We record when, where and the wording you agreed to. You can opt out at any time with the link in every message.
- Security logs: IP address and time of sign-ins, order acceptance and payments, to protect your account and prove agreements.
Team rosters and children's information
For team kit, schools and clubs may give us roster details (the name to print, number and size). For school and club uploads the school or club is the responsible party and KLAUT processes the information as its operator under a written operator agreement; the school or club confirms it holds parental consent. In team stores, a parent or guardian completes or consents to orders for anyone under 18. We collect only what the order needs (no ID numbers or dates of birth), never show learners' names on public pages, and delete or reduce roster details to size and number 90 days after the order is completed, unless you ask us to keep them for reorders.
Who we share it with (operators)
- PayFast — payment processing (South Africa).
- Our courier — delivery name, address and phone.
- Our email provider — sending order and account emails (Amazon Web Services, Cape Town region).
- Our hosting provider — Amazon Web Services, Cape Town region (af-south-1), where our database and files are stored in South Africa.
- Our bookkeeper and auditors, and authorities where the law requires it (for example SARS).
We have written agreements with our operators requiring them to protect your information (POPIA s20–21). We do not plan to send personal information outside South Africa; if a provider ever processes it elsewhere, we will rely on an agreement giving adequate protection (s72), and children's information will stay in South Africa.
How long we keep it
Invoices and financial records: 5 years (Tax Administration Act). Roster details: as above. Quotes that do not become orders: 2 years. Marketing consent: until you withdraw it.
How we protect it
Encryption in transit and at rest, staff access limited by role with multi-factor sign-in for finance and administration, and audit logs. If a breach affects your information we will tell you and the Information Regulator as soon as reasonably possible (s22).
Your rights
You may ask what information we hold about you and get a copy, ask us to correct or delete it, object to processing, and withdraw marketing consent at any time. Contact the Information Officer. You may also complain to the Information Regulator (South Africa): inforegulator.org.za.
See also our PAIA manual and cookie notice.
Other policies: Business information · Terms · Returns · Privacy · PAIA manual · Cookies