Privacy notice
This notice covers shirt.hbufc.co.za, the Legacy 500 kit campaign. It explains what we collect when you claim a square, why, who else sees it, and what you can ask us to do about it. The responsible party under POPIA is HBUFC Trading (Pty) Ltd.
What we collect
Only what claiming a square actually requires. There is no account to create, and nothing that watches you is loaded unless you have said yes to it. See cookies and measurement below.
We do not ask for your name, your address or your date of birth, and we never see or store your card details. Those go straight to Netcash and never touch our server.
If you leave a message, tip or sign up
You can leave the club a message, add a tip to it if you like, or leave your email for the next campaign. A message records what you wrote, your name if you give it and your email so we can reply; it is emailed to the club and shown to nobody else. A tip also records the amount and the payment reference; card details go to Netcash as they do for a square. Under the button is a tick box, ticked to start with, that also puts that address on the list for the next campaign; untick it and we use it to reply or thank you and nothing else. A sign-up records your email and name, and we use them for one thing: telling you when the next Hout Bay United campaign opens. Neither is shared with anyone else, and you can ask us to delete either at any time using the contact below.
What other people can see
Your artwork becomes public once your payment is confirmed. That is the point of the campaign. Nothing else does.
The endpoint the shirt reads is deliberately built so it cannot leak the rest: the database view behind it does not contain the email or mobile columns at all, so no future change to that endpoint can accidentally publish them. Artwork from a checkout that was started but never paid for is never shown to anyone.
Who else we give it to
Because Resend sends from infrastructure in the United States, your email address leaves South Africa when we email you. POPIA allows this where the recipient is bound to comparable protections, which their data processing terms provide.
This notice used to say that the site loads its typeface from Google Fonts, so Google received your IP address on every page load. That turned out not to be true: it is measurably not what happens, because the font never reaches the browser at all. Checked while writing this, a visit to this site before you answer the cookie bar contacts no third party of any kind.
Cookies and measurement
On your first visit a bar along the bottom asks whether we may load three measurement tools, under two switches: one for understanding how the site is used, one for measuring our adverts. Until you answer, and unless you say yes, none of them load at all: no third party script, no cookie, no request to anybody else's server. That is enforced in the code rather than promised in this paragraph, which is the only version of it worth anything.
One thing sits outside that promise and we would rather say so plainly than let the paragraph above imply otherwise. Buying a square is reported to Meta by our server, not by your browser, so it happens whatever you chose on the bar. It carries the amount and a hashed form of your name, email address and mobile number, it happens once, only when a payment actually succeeds, and it is the one thing that lets us tell whether the advertising is paying for the kit or wasting the club's money. Nothing about simply looking around the site is sent that way.
Nothing optional is ticked for you. We would rather you pressed “Allow all” knowingly than found a box already ticked on your behalf, and a pre-ticked box is not consent under the European rules that cover the roughly one buyer in four here who is not in South Africa.
You can change your mind at any time: clear this site's data in your browser, or press the button below, and the bar comes back. One honest caveat. Turning something off stops it loading the next time; it cannot reach back and undo a page view that has already been recorded, and we are not going to pretend otherwise.
Our web server keeps ordinary access logs, which include IP addresses, for troubleshooting and abuse handling. Those are ours, they are not optional, and they are not shared.
Where it is kept, and for how long
On our own server in South Africa. The database accepts connections only from the machine itself, so it is not reachable from the internet at all. Staff access to order details is behind a password.
We keep your order for as long as the shirt exists as a record, because the square is meant to be permanent and we may need to prove who claimed it. We keep your artwork because it has to be printed. If you ask us to delete your personal details after your shirt has been delivered, we will, and we will keep only what we are legally required to keep for tax and accounting purposes.
Your rights
Under POPIA you can ask us to:
- tell you what we hold about you
- correct anything that is wrong
- delete anything we no longer have a good reason to keep
- stop contacting you, which we will do without argument
Email [email protected] and we will answer. If you are not satisfied with how we handle it, you can complain to the Information Regulator of South Africa at inforegulator.org.za.
Children
The Legacy 500 is sold to adults. If you are under 18, ask a parent or guardian to claim the square instead. If you believe a child has given us personal information, tell us and we will remove it.
Changes
If we change how any of this works we will change this page and move the date at the top. We will not quietly start doing something with your information that this page does not describe.
Who you are dealing with
This is the information a supplier must give you under section 43 of the Electronic Communications and Transactions Act.
The Legacy 500 is sold by HBUFC Trading (Pty) Ltd, the trading company owned by Hout Bay United Football Community (HBUFC) Trust. Your contract is with the trading company, because that is who receives your payment. The proceeds fund the club.