Privacy Policy
This policy explains what personal information Diving Magnets (Pty) Ltd collects, why we collect it, how long we keep it, who we share it with, and the rights you have over it. It is written to meet the Protection of Personal Information Act (POPIA) in South Africa and the General Data Protection Regulation (GDPR) for customers in the UK and the European Economic Area.
We are the responsible party (POPIA) and data controller (GDPR) for this information. Our Information Officer is Albertus Brummer, contactable at orders@divingmagnets.com.
1. What we collect
- Identity and contact details — your name, company name, email address, telephone number.
- Delivery and billing addresses, and the name and phone number of anyone you nominate to receive a delivery.
- Order information — what you bought, when, the price, your order and invoice numbers, and any notes or purchase-order reference you give us.
- Correspondence — emails, WhatsApp messages, contact-form submissions and quote requests.
- Payment confirmation — the payment method, provider reference and whether payment succeeded. We never see or store your full card number.
- Technical information — IP address, browser type and pages visited, collected in server logs for security and troubleshooting.
We do not collect special categories of personal information, and our website is not intended for children.
2. Why we use it, and our lawful basis
We only use your information where the law allows. Our purposes and the basis for each are:
- To take and fulfil your order, arrange delivery, and provide support — because it is necessary to perform our contract with you.
- To send order confirmations, banking details, shipping notifications and tracking — necessary to perform our contract with you.
- To issue invoices and keep accounting records — necessary to comply with our legal obligations under tax and companies legislation.
- To prevent fraud, secure the website, and keep our records accurate — our legitimate interests in running the business safely, balanced against your rights.
- To respond to your enquiries and quote requests — our legitimate interests in answering people who contact us, or steps taken at your request before entering a contract.
- To send an abandoned-cart reminder where you gave us your details but did not complete the order — our legitimate interests; you can opt out at any time.
Newsletter. If you subscribe on our Contact page, we use your email address (and name, if given) only to send occasional product updates and offers from Diving Magnets. We only send these with your consent. Every email includes an unsubscribe link, and you can also ask us at orders@divingmagnets.com. When you unsubscribe we stop sending straight away and keep only your email address on a do-not-contact list so you are not added again. Subscriber details are kept until you unsubscribe. Emails are sent through Google (Gmail).
We do not sell, rent or trade your personal information, and we do not use it for automated decision-making or profiling.
3. Cookies and similar technologies
We use only cookies and browser storage that the website needs to work. We do not use analytics, advertising or tracking cookies.
Strictly necessary cookies. These are set by us, and the site cannot work without them, so they do not require your consent:
- cart-session — keeps your shopping basket associated with you. Expires at the end of your session.
- admin-session — signs our staff in to the admin area. Staff only; ends on sign-out.
- warehouse_staff — signs our warehouse staff in to the warehouse area. Staff only; 30 days.
- dm_staff — marks a staff member's browser so that our own visits are excluded from our site statistics. Staff only; 2 years, and cleared on sign-out.
- dm_geo_hint — your approximate country, so prices show in the right currency. 1 hour.
Browser storage. We also keep a few preferences in your browser's local storage. These stay on your device:
- cart_session_id — the identifier that links your basket to you as you move between pages.
- dm_country_code and dm_country_name — your delivery country, so prices show in the right currency.
- i18nextLng — the language you chose.
- adminTheme — light or dark mode in the admin area. Staff only.
You can clear or block cookies and storage at any time in your browser settings. The site will not work properly without the necessary ones — in particular your basket will not be remembered.
4. Who we share it with
We share only what each provider needs to do its job. They act on our instructions and may not use your information for their own purposes.
- Payment providers — Yoco Technologies (Pty) Ltd for card payments in ZAR, and PayPal for payments in USD. They collect your payment details directly and handle them under their own policies and PCI-DSS.
- Delivery partners — The Courier Guy (via Shiplogic) for South African deliveries, and FedEx (via TUNL) for international deliveries. They receive the recipient's name, address and contact number.
- Hosting and database — Diploi for application hosting, and Supabase for our database and document storage, hosted in the European Union (eu-west-1).
- Email — Google (Gmail) for sending order and shipping emails.
- Address lookup — Google Maps Places, if you use the address suggestion feature while typing your address.
- Professional advisors, accountants and auditors, where required.
- Law enforcement, regulators or courts, where we are legally required to disclose.
5. Sending information outside your country
We operate from South Africa, our database is hosted in the European Union, and some of our providers — including Google and PayPal — are in the United States. This means your information may be transferred across borders.
Where we transfer personal information out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider. Where we transfer information out of South Africa, we do so on the basis permitted by section 72 of POPIA — the recipient is bound by rules providing an adequate level of protection, or the transfer is necessary to perform our contract with you.
6. How long we keep it
- Order, invoice and payment records — 7 years from the end of the tax year they relate to, because the Companies Act requires it.
- Customer account and contact details — for as long as you remain a customer, and then 7 years alongside the order records they relate to.
- Quote requests and enquiries that do not become orders — 2 years.
- Abandoned-cart contact details — 12 months, or until you ask us to remove them.
- Server and security logs — 12 months.
When a retention period ends we delete the information or anonymise it so it can no longer identify you.
7. Your rights
You may exercise any of the following free of charge:
- Access — ask what personal information we hold about you and get a copy.
- Correction — have inaccurate or incomplete information put right.
- Deletion — ask us to erase information we no longer have a lawful reason to keep.
- Objection — object to processing based on our legitimate interests, including abandoned-cart reminders.
- Restriction — ask us to pause processing while a query is resolved.
- Portability — receive the information you gave us in a structured, machine-readable format, or have it sent to another provider.
- Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect anything done before you withdrew.
- Object to direct marketing — at any time, and we will stop.
To exercise any right, email orders@divingmagnets.com. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not disclose your information to someone else.
8. Complaints
If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. You also have the right to complain to a regulator:
- South Africa — the Information Regulator (South Africa), inforegulator.org.za.
- United Kingdom — the Information Commissioner's Office, ico.org.uk.
- European Economic Area — the data protection supervisory authority in the country where you live or work.
9. How we protect your information
- All traffic to and from this website is encrypted with TLS.
- Card details are handled entirely by our PCI-DSS compliant payment providers and never reach our systems.
- Access to customer data is limited to staff who need it, and is protected by individual sign-in.
- Our database is hosted by a managed provider with encryption at rest and regular backups.
No system is completely secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant regulator as the law requires.
10. Changes to this policy
We may update this policy. The version number and effective date at the top of this page tell you which version applies. If we make a material change we will bring it to your attention — we will not quietly reduce your rights.
11. Contact us
- Diving Magnets (Pty) Ltd (Reg. 2015/050552/07)
- Information Officer: Albertus Brummer
- 127 Lancaster Road, Gordons Bay, Western Cape, 7140, South Africa
- Email: orders@divingmagnets.com
- Telephone: +27 71 628 6430