Legal

POPIA Notice

Protection of Personal Information Act 4 of 2013, Compliance Notice

Effective date: 1 July 2021 (date of full POPIA commencement) | Last reviewed: 1 January 2025

POPIA Compliance Commitment: iStore Business is committed to full compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). This notice describes how we fulfil our obligations as a Responsible Party and the rights available to you as a data subject.

1. Responsible Party Details

The Responsible Party (as defined in POPIA) for personal information processed in connection with the iStore Business website and services is:

Core Peripherals (Pty) Ltd
Registration number: 1996/010298/07
VAT number: 4190160756
Physical Address: 1 Sandton Drive, Sandton, 2191

Information Officer

Our designated Information Officer, as required by POPIA Section 55, is responsible for ensuring compliance with POPIA conditions for lawful processing.

Information Officer: iStore Business Compliance Team
Email: privacy@istorebusiness.co.za
Physical address: 1 Sandton Drive, Sandton, 2191
Telephone: Available on request

Our Information Officer is registered with the Information Regulator of South Africa in accordance with POPIA Section 55(1).

2. Purpose of Processing

iStore Business processes personal information for the following purposes:

Responding to and managing business enquiries and service requests
Providing Apple device procurement, deployment, and managed services
Communicating about our products, services, and updates
Processing and fulfilling transactions and service agreements
Complying with legal and regulatory obligations
Improving our website, products, and service delivery
Fraud prevention and information security

3. Categories of Personal Information Processed

We process the following categories of personal information:

Identifying information: name, job title, employee number (for service engagements)
Contact information: email address, telephone number, business address
Organisational information: company name, department, fleet details
Transactional information: purchase history, service records, support tickets
Technical information: IP address, browser data, website usage data
Communication records: email and written correspondence

4. Lawful Basis for Processing

We process personal information only where one of the following conditions for lawful processing (POPIA Section 11) is satisfied:

Consent: the data subject has given consent for their personal information to be processed for a specific purpose
Contractual necessity: processing is necessary for the performance of a contract with the data subject
Legal obligation: processing is necessary to comply with a legal obligation
Legitimate interest: processing is necessary for our legitimate business interests, where these are not overridden by the data subject's rights
Public interest: processing is necessary for the proper performance of a public law duty

5. Data Subject Rights

As a data subject under POPIA, you have the following rights, which you may exercise by contacting our Information Officer:

Right of Access (Section 23)
Request confirmation and a copy of personal information we hold about you, along with information about how it is being processed.
Right to Correction (Section 24)
Request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, or misleading personal information.
Right to Object (Section 11(3))
Object at any time to the processing of personal information, on reasonable grounds. You may opt out of direct marketing at any time.
Right to Complain (Section 74)
Lodge a complaint with the Information Regulator if you believe your personal information rights have been violated.

6. Direct Marketing

We may use your personal information to send you marketing communications about our products and services where:

You have given us explicit consent to do so, or
You are an existing customer and we are communicating about similar products/services (legitimate interest), with opt-out available

You may opt out of direct marketing at any time by clicking "unsubscribe" in any marketing email or by contacting us at privacy@istorebusiness.co.za. We will process opt-out requests within 5 business days.

7. Cross-Border Transfers

Where personal information is transferred to a third party in a foreign country (POPIA Section 72), we ensure that the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection substantially similar to POPIA, or that you have consented to the transfer.

8. Security Safeguards

As required by POPIA Section 19, we maintain appropriate technical and organisational measures to secure the integrity and confidentiality of personal information in our possession or under our control. These measures include:

Encryption of data in transit (TLS 1.2+) and at rest
Access controls and role-based permissions
Regular security assessments and penetration testing
Employee privacy and security training
Data breach response procedures

9. Notification of Breach

In the event of a breach of security involving personal information, we will notify the Information Regulator and affected data subjects as required by POPIA Section 22, in the prescribed form and within a reasonable time of becoming aware of the compromise.

10. Information Regulator

If you are not satisfied with our response to a privacy-related complaint, you have the right to contact the Information Regulator of South Africa:

The Information Regulator (South Africa)
Website: inforegulator.org.za
Email: PAIAComplaints@inforegulator.org.za
Physical: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

11. PAIA Manual

In accordance with the Promotion of Access to Information Act 2 of 2000 (PAIA), iStore Business maintains a PAIA Manual. This manual describes the types of records held by iStore Business and how to request access to those records. A copy of our PAIA Manual is available on request from our Information Officer.