POPIA

Roco (Pty) Ltd – Privacy Notice (POPIA)

1. Introduction

Roco (Pty) Ltd (“Roco”, “we”, “us”, “our”) is committed to protecting the personal information of our customers (“you”, “your”). This notice explains how we collect, use, disclose, store and secure your personal information, in compliance with the Protection of Personal Information Act, 2013 (POPIA).
By using our website www.roco.co.za, placing orders with us, or otherwise providing personal information to us, you consent to the practices described in this notice.

2. What Personal Information We Collect

We may collect the following categories of personal information from you:
Identity information: name, surname, ID number or registration number (if you are a business customer), date of birth (where required).
Contact information: postal address, delivery address, email address, telephone/mobile number.
Financial information: payment card or account details (via our payment service provider), purchase history, billing information.
Technical information: IP address, device identifiers, browser type, operating system, usage data (including cookies).
Transactional information: order details, delivery details, returns/replacement history.
Marketing preferences, if you have opted-in.
Other information as necessary to comply with our legal obligations or to deliver Products/services to you.

3. How We Collect Your Personal Information

We collect personal information in the following ways:
When you register for an account on our website or place an order.
When you contact us (for example via email, telephone, chat or enquiry form).
When you browse our website: through cookies and similar tracking technologies.
When you enter into a contract with us or when we perform services for you.
From third parties where authorised (for example courier services, payment processors, credit checking agencies, marketing service providers) and where our use is permitted by law.

4. Purposes for Processing

We process your personal information for the following purposes:
To provide, fulfil, deliver and manage your orders, including delivery and return handling.
To manage accounts, billing, payments and refunds.
To communicate with you regarding your orders, queries, service requests, warranty issues or product updates.
To comply with legal, regulatory and tax obligations.
To send you marketing and promotional communications (if you have opted in or where permitted by law).
To maintain, secure and improve our website, operations and services (including analytics, cookies, website improvements).
To prevent fraud, perform credit or identity checks and ensure the security of transactions.

5. Legal Basis for Processing

Under POPIA, we rely on one or more of the following legal bases for processing your personal information:
The processing is necessary to perform the contract between you and us (e.g., fulfilment of orders).
The processing is necessary for our legitimate interests (for example website operations, fraud prevention, business administration) provided these do not override your rights and freedoms.
The processing is necessary to comply with a legal obligation (for example tax, accounting, delivery legislation).
Where required, you have given your consent to the processing (for example marketing preferences or cookies).

6. Disclosure of Personal Information

We may share personal information with the following categories of third parties:
Courier, delivery and logistics providers (to deliver Products).
Payment processing service providers (to handle payments securely).
IT and website hosting providers, analytics or support service providers.
Credit reference and fraud prevention agencies.
Regulatory, tax or government authorities where required by law.
Our professional advisors (e.g., legal, audit, compliance).
Marketing service providers (with your consent).
We require all third parties receiving personal information to treat that information in accordance with POPIA and this notice. We do not sell your personal information to third parties.

7. International Transfers

Personal information may be transferred to or processed in countries outside South Africa if necessary (for example our hosting or analytics providers). We will take reasonable steps to ensure that any such transfer is subject to appropriate safeguards and meets the requirements of POPIA.

8. Retention of Personal Information

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, to enforce our agreements, or to resolve disputes. Once it is no longer required, we will securely delete or anonymise it.

9. Security of Your Personal Information

We implement appropriate technical and organisational measures (such as encryption, access controls, secure servers and regular security reviews) to protect your personal information from loss, unauthorised access, destruction, alteration or disclosure. However, no transmission over the internet or storage system can be guaranteed as entirely secure. We cannot guarantee absolute security.

10. Cookies, Tracking and Analytics

We use cookies and similar tracking technologies to collect technical information and usage data. These may include first-party and third-party cookies. Some cookies are essential for the functioning of our website, others are optional or for analytics/marketing purposes.
You can disable or restrict cookies through your browser settings, though this may affect your ability to use certain parts of our website.

11. Your Rights

Subject to POPIA and other applicable law, you have the following rights:
The right to be informed about the processing of your personal information.
The right to access your personal information held by us.
The right to rectify inaccurate or incomplete personal information.
The right to object to the processing of your personal information on legitimate grounds.
The right to request deletion or destruction of personal information when it is no longer necessary.
The right to request that processing be restricted in certain circumstances.
The right to complain to the Information Regulator if you believe we have violated the law (see below).
To exercise your rights, please contact us (see section 13). We may require proof of identity before fulfilling your request. We will respond to all valid requests within a reasonable period, typically within 30 calendar days unless lawfully extended.

12. Marketing Preferences & Unsubscribing

If you have opted in to receive marketing communications, you may withdraw your consent at any time by clicking “unsubscribe” or by contacting us. Even if you opt-out of marketing, we may still send you transactional or service-related communications (e.g., order confirmations, delivery notices, security alerts).

13. Contact Details & Complaints

If you have any questions about this notice, or you wish to access, correct or delete your personal information, you may contact:
Roco (Pty) Ltd
26 Eastgate Business Park
Cnr South Road and Marlboro Drive
Sandton, Johannesburg
Phone: +27 11 444 9120
Email: sheldond@roco.co.za
If you believe your data protection rights have been breached, you can also complain to:
Information Regulator
PO Box 31533, Tokai, 7966, South Africa
Email: inforeg@inforegulator.org.za
Website: www.justice.gov.za/inforeg

14. Changes to this Privacy Notice

We may update this notice from time to time. The date at the top of this document will reflect the most recent update. Please review this notice periodically. Continued use of our website or our services after changes will signify that you accept the revised terms.
15. Other Websites
Our website may include links to external websites or partner services which are not operated by Roco. This notice does not apply to those third-party sites. You are encouraged to review the privacy notices of any such sites you visit.