1. Purpose and Scope

This Policy establishes the legal and regulatory framework for the operation of the website zukisa360asset.co.za. It is designed to ensure compliance with South African law, protect the rights of users ("Data Subjects" or "Consumers"), and mitigate legal risk for the business ("Responsible Party" / "Supplier").

This policy applies to all personal and non‑personal data processing activities, commercial transactions, and content management conducted via the website.

2. Data Protection and Privacy (POPIA)

2.1. Legal Basis

The website and its associated services are subject to the Protection of Personal Information Act 4 of 2013 (POPIA). As a Responsible Party, we are mandated to process personal information lawfully and transparently.

2.2. Conditions for Lawful Processing

All processing of personal information must adhere to the eight conditions for lawful processing, including accountability, processing limitation, purpose specification, and information quality.

2.3. Consent and Direct Marketing

• Opt‑in Consent: Prior consent must be obtained from data subjects for the processing of their personal information for direct marketing purposes.
• Electronic Communications: Direct marketing via email or SMS will only be sent with explicit, voluntary consent, compliant with the amended POPIA Regulations (April 2025) regarding telemarketing records and objection mechanisms.

2.4. Privacy and Cookie Policy

• The website must feature a publicly accessible Privacy Policy detailing the categories of information collected (e.g., names, contact details, cookies), the purpose of collection, and the rights of the data subject.
• Cookies: A cookie consent banner must be implemented to obtain permission for placing non‑essential cookies, as South African law requires that users opt‑in to tracking cookies.

2.5. Cross‑Border Data Transfers

Personal information will not be transferred to a third party in a foreign country unless:

• The recipient is subject to a law or agreement that upholds POPIA principles; or
• The data subject consents to the transfer; or
• The transfer is necessary for the performance of a contract.

2.6. Information Officer

The business must appoint an Information Officer and Deputy Information Officer. This role is responsible for compliance with POPIA, handling Data Subject Access Requests (DSARs), and maintaining the PAIA manual.

2.7. Security Breach Notification

In the event of a security compromise, we will:

• Notify the Information Regulator immediately via the mandatory eServices portal (mandatory since 1 April 2025).
• Notify affected data subjects as soon as reasonably possible where there is a reasonable likelihood of harm.
• All breaches must be reported to the SAPS within 72 hours if the incident constitutes an offence under the Cybercrimes Act.

3. Consumer Protection (CPA)

3.1. Legal Basis

The operation of zukisa360asset.co.za is governed by the Consumer Protection Act 68 of 2008 (CPA). This Act grants consumers extensive rights regarding returns, refunds, and the quality of goods and services.

3.2. Return, Refund, and Warranty Policy

• Mandatory Warranty: Consumers are entitled to a statutory warranty for a period of 6 months from delivery. If a product is defective, the supplier must, at the consumer's direction, repair, replace, or refund the product at the supplier's risk and expense.
• Returns: "No Returns" or "No Refunds" policies are misleading and prohibited. A clear, plain‑language return policy must be displayed on the website.
• Proof of Purchase: A written sales record (receipt) must be provided for every transaction, detailing the supplier’s name, address, date, description, and price.

3.3. Plain Language and Transparency

All terms and conditions, descriptions, and prices on the website must be drafted in plain and understandable language. Complex legal jargon is prohibited and may render clauses unenforceable.

3.4. Direct Marketing Conduct

Telemarketing or promotional communications must comply with the times and mechanisms prescribed by the CPA and POPIA. Consumers must have the right to opt‑out.

4. Electronic Communications and Cybercrimes (ECT Act & Cybercrimes Act)

4.1. Supplier Information (ECT Act)

In compliance with the Electronic Communications and Transactions Act 25 of 2002 (ECT Act), the website must clearly display the following:

• Full name and legal status (e.g., (Pty) Ltd, Sole Proprietor).
• Physical address and telephone number.
• Registration number (if applicable).
• Email address and website address.
• Sufficient description of the main characteristics of goods/services.

4.2. Prohibited Content (Harmful Data Messages)

The website and its user‑generated content areas (if any) must not host content that:

• Incites violence or damage to property.
• Contains intimate images without consent.
• Constitutes hate speech or defamation.

Such content is criminalised under the Cybercrimes Act 19 of 2020.

5. Compliance Roles and Responsibilities

Role	Responsibility
Information Officer	Liaise with the Information Regulator; manage data subject requests; oversee POPIA compliance.
Marketing Team	Ensure all marketing campaigns have valid consent; maintain call records if telemarketing is used.
Customer Service	Manage complaints and returns in line with the CPA; maintain records of resolutions.
IT / Security	Ensure encryption of payment data; manage breach detection and reporting protocols.

6. Enforcement and Penalties

Non‑compliance with these policies can result in severe penalties, including:

7. Review and Updates

This policy will be reviewed annually or as necessary upon changes to legislation (e.g., PAIA amendments expected by the Regulator in 2026).