Data Subject Request & Access Policy

Purpose of This Policy

This Data Subject Request and Access Policy describes the procedures used by T-Shirts Durban when a person wishes to exercise rights relating to personal information processed by the business.

This policy should be read together with the applicable:

• Privacy Policy.
• Cookie Policy.
• PAIA Manual / Access to Information Policy.
• Terms of Service.
• Other applicable privacy notices.

Who Is a Data Subject?

A data subject is a person to whom personal information relates.

Depending on the circumstances and applicable law, data subjects whose information may be processed by T-Shirts Durban can include:

• Customers.
• Prospective customers.
• Website visitors.
• Suppliers.
• Service providers.
• Business contacts.
• Employees and job applicants where applicable.
• Representatives of organisations.
• Other persons whose personal information we process.

Your POPIA Rights

Depending on the circumstances, POPIA may provide you with rights relating to your personal information.

Request for Confirmation

You may request confirmation of whether T-Shirts Durban holds personal information about you.

Where applicable under POPIA, confirmation as to whether personal information is held may be provided without charge.

Before releasing information, we may require reasonable evidence to confirm that the requester is the data subject or is properly authorised to act for the data subject.

Access to Personal Information

A data subject may request access to personal information held by T-Shirts Durban subject to POPIA, the Promotion of Access to Information Act 2 of 2000 ("PAIA") and other applicable requirements.

An access request should identify:

• The requester.
• The relevant data subject.
• The personal information or record requested.
• The relevant period, where applicable.
• The preferred response method.
• Other information reasonably required to locate the record.

Correction of Personal Information

You may ask T-Shirts Durban to correct personal information where the information is:

• Inaccurate.
• Irrelevant.
• Excessive.
• Out of date.
• Incomplete.
• Misleading.
• Obtained unlawfully.

You may be asked to provide reasonable supporting evidence showing why a correction is required.

Deletion or Destruction Requests

A data subject may request deletion or destruction of personal information where T-Shirts Durban is no longer authorised to retain the relevant information.

A deletion request does not mean information must automatically be removed in every case.

Information may need to be retained where retention is permitted or required for purposes such as:

• Compliance with legislation.
• Tax and accounting obligations.
• Contractual obligations.
• Resolving disputes.
• Establishing or defending legal claims.
• Fraud prevention.
• Record-keeping obligations.
• Other lawful purposes recognised under POPIA.

Objecting to Processing

In circumstances recognised under POPIA, a data subject may object to certain processing of personal information.

An objection should identify:

• The processing activity concerned.
• The personal information involved.
• The reason for the objection.
• Relevant supporting information where appropriate.

Where a valid objection is accepted, the relevant processing will be dealt with in accordance with POPIA.

Direct Marketing Objections

You may ask T-Shirts Durban to stop sending certain direct marketing communications.

Where an electronic marketing message contains an unsubscribe or opt-out facility, you may use that facility directly.

A marketing objection will not normally prevent us from sending communications that are reasonably necessary to:

• Respond to an enquiry.
• Provide a quotation.
• Process an order.
• Send an invoice or payment information.
• Provide order-status updates.
• Arrange delivery or collection.
• Deal with an existing transaction.
• Comply with legal obligations.

Prescribed POPIA Forms

The Information Regulator publishes prescribed forms for certain POPIA rights.

How to Submit a Data Subject Request

Information to Include

To help us identify and process your request, please provide information reasonably relevant to the request, such as:

• Your full name.
• Your company name where relevant.
• Your email address.
• Your telephone number.
• An order number where applicable.
• A quotation or invoice number where applicable.
• A description of the personal information concerned.
• A description of the privacy right you wish to exercise.
• The reason for the request where relevant.
• Your preferred response method.
• Supporting documents where reasonably required.

Identity Verification

Protecting personal information against unauthorised access is an important part of T-Shirts Durban's privacy obligations.

We may therefore require reasonable verification before responding to an access, correction, deletion or other data subject request.

Verification requirements may vary depending on the nature, sensitivity and circumstances of the information involved.

We aim not to request more personal information than is reasonably necessary to verify the requester.

Requests Made by Representatives

If a request is submitted on behalf of another data subject, T-Shirts Durban may require evidence showing that the person submitting the request is authorised to act on behalf of the data subject.

This helps prevent unauthorised disclosure, alteration or deletion of personal information.

Processing and Responding to Requests

Once a request has been received, T-Shirts Durban may:

• Verify the identity or authority of the requester.
• Clarify the scope of the request where necessary.
• Search for relevant records.
• Assess the request under POPIA and PAIA.
• Consider applicable exemptions or grounds for refusal.
• Implement a correction or deletion where legally required.
• Communicate the outcome to the requester.

Fees

Certain confirmation requests may be provided without charge where required by POPIA.

Access to records may nevertheless be subject to fees prescribed under PAIA where those fees lawfully apply.

Where a prescribed fee is payable, the requester may be informed before access is provided.

Limitations on Requests

Data subject rights are subject to applicable South African law and are not necessarily absolute.

T-Shirts Durban may be required or permitted to refuse, restrict or delay a request where, for example:

• Retention of information is legally required.
• Disclosure would improperly affect another person's rights.
• Information is subject to legal privilege.
• A PAIA ground for refusal applies.
• The request cannot reasonably be verified.
• The requested record cannot be located or does not exist.
• Another lawful basis justifies continued processing.

Third-Party Information

A record may contain personal information relating to another person or confidential information belonging to another individual or organisation.

Where this occurs, access may need to be restricted, redacted, delayed or handled under applicable PAIA procedures.

Information Retention

Personal information is not necessarily deleted immediately merely because a commercial relationship or transaction has ended.

Information may be retained for a period reasonably required for:

• Legal compliance.
• Tax and accounting purposes.
• Contract administration.
• Warranty or product-related matters.
• Dispute resolution.
• Fraud prevention.
• Legal claims.
• Other lawful business purposes.

Security of Data Subject Requests

Information submitted as part of a privacy request will itself be treated as personal information where applicable.

T-Shirts Durban aims to use reasonable organisational and technical safeguards when receiving, processing and storing data subject request information.

Privacy Complaints

If you believe that T-Shirts Durban has processed your personal information unlawfully or has not appropriately dealt with a privacy request, you may first contact us so that the matter can be reviewed.

You may also have the right to lodge a complaint with the Information Regulator of South Africa.

Information about complaints, prescribed forms and POPIA procedures is available directly from the Information Regulator.

Updates to This Policy

T-Shirts Durban may update this policy when reasonably necessary to reflect changes in legislation, regulatory guidance, business operations, technology, contact information or privacy practices.

The version published on the T-Shirts Durban website should be regarded as the current website version unless otherwise stated.

Submit a POPIA Request

Data subject requests and privacy enquiries may be submitted using the T-Shirts Durban contact details below.