Data Subject Request & Access Policy

01. Purpose of This Policy

This Data Subject Request and Access Policy describes the procedures used by T-Shirts South Africa when a person wishes to exercise rights relating to personal information that we process.

The policy should be read together with our:

• Privacy Policy
• Terms of Service
• Any applicable PAIA Manual maintained by the business

02. Who Is a Data Subject?

A data subject is the person to whom personal information relates. Depending on the circumstances and applicable law, this may include an identifiable individual or juristic person whose personal information is being processed.

Examples may include:

• Customers
• Prospective customers
• Website visitors
• Suppliers
• Business contacts
• Representatives of customers or suppliers
• Other persons whose personal information we process

03. Your POPIA Rights

Depending on the circumstances, you may have rights including the following:

04. Request for Confirmation

You may request confirmation of whether T-Shirts South Africa holds personal information about you.

Where permitted by POPIA, confirmation as to whether we hold personal information about you may be provided free of charge.

Before providing information, we may require reasonable evidence to verify that the requester is the relevant data subject or is properly authorised to act on behalf of that data subject.

05. Request for Access to Personal Information

A data subject may request access to personal information held by T-Shirts South Africa, subject to the requirements, procedures and grounds for refusal provided by POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA").

An access request should clearly identify:

• The requester
• The relevant data subject
• The information or records requested
• The period to which the request relates, where applicable
• The preferred method of communication
• Any information that may assist us in locating the records

06. Correction of Personal Information

You may request correction of personal information about you that is:

• Inaccurate
• Irrelevant
• Excessive
• Out of date
• Incomplete
• Misleading
• Obtained unlawfully

We may ask you to provide appropriate evidence demonstrating what information should be corrected and why.

Where a correction is made and it is reasonably practicable to do so, relevant recipients of the incorrect information may also need to be informed where required by POPIA.

07. Deletion or Destruction Requests

You may request the deletion or destruction of personal information or records where T-Shirts South Africa is no longer authorised to retain that information under applicable law.

A deletion request does not automatically require information to be deleted in every case.

We may lawfully retain information where retention is necessary or authorised for purposes such as:

• Compliance with legislation
• Tax or accounting requirements
• Contractual obligations
• Legal claims or dispute resolution
• Fraud prevention
• Record-keeping requirements
• Other lawful purposes recognised by POPIA

08. Objecting to Processing

In circumstances recognised by POPIA, a data subject may object to the processing of personal information on reasonable grounds relating to their particular situation.

An objection should explain:

• The processing activity being objected to
• The personal information concerned
• The reason for the objection
• Any supporting information relevant to the request

Where a valid objection is upheld, we will deal with the affected processing in accordance with POPIA.

09. Direct Marketing Objections

You may request that we stop sending certain direct marketing communications.

Where an electronic marketing communication includes an unsubscribe or opt-out mechanism, you may also use that mechanism directly.

An objection to marketing does not necessarily prevent us from sending communications required to:

• Respond to an enquiry
• Process an order
• Provide a quotation
• Send invoices or payment information
• Communicate about an existing transaction
• Comply with legal obligations

10. Prescribed POPIA Forms

Certain POPIA requests are made using prescribed forms.

The applicable prescribed forms may be obtained from the Information Regulator or other authorised South African government sources.

11. How to Submit a Request

12. Information to Include

To help us process your request efficiently, please provide:

• Your full name
• Your company name, where relevant
• Email address
• Telephone number
• Order, quotation or invoice number where applicable
• Description of the personal information concerned
• Description of the right you wish to exercise
• Reason for the request where relevant
• Preferred response method
• Supporting documents where appropriate

Please do not send unnecessary personal information or identity documents unless they are reasonably required for verification.

13. Identity Verification

Protecting personal information from unauthorised access is an important part of our POPIA obligations.

We may therefore require reasonable proof of identity before responding to an access, correction, deletion or other data subject request.

The verification requirements will depend on the nature and sensitivity of the information requested.

We will endeavour not to request more information than is reasonably necessary to verify the request.

14. Requests Made on Behalf of Another Person

If you submit a request on behalf of another person, we may require appropriate evidence that you are legally authorised to act on their behalf.

This may include:

• Written authority
• Power of attorney
• Proof of guardianship
• Proof of executorship
• Other legally appropriate authority

We may also verify the identity of both the representative and the data subject where appropriate.

15. Response to Your Request

We will assess requests in accordance with POPIA, PAIA and other applicable law.

Depending on the request, our response may:

• Confirm whether information is held
• Provide access to information
• Correct information
• Delete or destroy information
• Explain why information must be retained
• Accept or reject an objection to processing
• Ask for additional information
• Explain any lawful basis for refusing access

Where POPIA requires notification of the action taken following a correction or deletion request, we will provide the required notification.

16. Timeframes

We aim to process valid requests as soon as reasonably practicable.

The exact timeframe may depend on:

• The nature of the request
• The amount of information involved
• Whether records need to be retrieved from different systems
• Whether identity or authority must be verified
• Whether PAIA procedures apply
• Whether third-party information is involved

Where legislation prescribes a specific period, the applicable statutory period will apply.

17. Fees

A request for confirmation of whether we hold personal information about you may be dealt with without charge where required by POPIA.

Where access to records is requested, prescribed reproduction, search, preparation or other fees may apply where permitted under POPIA or PAIA.

If a lawful fee is payable, we will advise you before providing the relevant records where required.

18. When Access May Be Refused

The right of access is not absolute.

POPIA permits or requires certain access requests to be refused where the relevant grounds for refusal under PAIA apply.

Examples may include circumstances involving:

• Protection of another person's privacy
• Confidential commercial information
• Legally privileged information
• Safety or security considerations
• Information protected by another law
• Other lawful PAIA grounds for refusal

Where only part of a record may lawfully be withheld, the remaining part will be dealt with in accordance with applicable law.

19. Information We Are Required to Retain

A request for deletion will not necessarily result in immediate deletion where another legal obligation requires us to retain the information.

For example, records may need to be retained for:

• Tax purposes
• Accounting records
• Contract administration
• Legal disputes
• Fraud prevention
• Compliance with regulatory obligations

Where possible, information that no longer needs to be actively used may be appropriately restricted, archived, destroyed or de-identified in accordance with applicable law.

20. Third-Party Information

Some records may contain personal information relating to another person or confidential information belonging to a third party.

Where applicable, access may need to be limited, redacted or refused in accordance with POPIA and PAIA.

We will not disclose another person's personal information merely because it appears in a record requested by a data subject.

21. Correction Disputes

Where a data subject requests correction of information and agreement cannot be reached regarding the accuracy of the information, POPIA provides mechanisms for addressing the disputed information.

Where applicable and requested by the data subject, reasonable steps may be taken so that the information reflects that a correction has been requested but has not been made.

22. Security of Request Information

Information supplied in connection with a data subject request will itself be treated as personal information.

We will take reasonable measures designed to protect request records, identity verification documents and correspondence from unauthorised access, loss or disclosure.

23. Contact Details for POPIA Requests

Requests relating to personal information may be submitted to:

24. Complaints to the Information Regulator

If you believe that your personal information has been processed in a manner that infringes POPIA, you may raise the matter with us so that we can investigate it.

You also have the right, where applicable, to lodge a complaint with the Information Regulator (South Africa).

25. Changes to This Policy

We may update this policy where necessary to reflect changes to:

• POPIA or PAIA
• Regulations or regulatory guidance
• Our business operations
• Our privacy procedures
• Our website or information systems

The latest version will be published on this website together with the applicable revision date.

26. Related Privacy Documents

For additional information about how T-Shirts South Africa handles personal information, please review:

• Privacy Policy
• Terms of Service