Privacy notice
This notice covers shirt.hbufc.co.za, the Legacy 500 kit campaign. It explains what we collect when you claim a square, why, who else sees it, and what you can ask us to do about it. The responsible party under POPIA is HBUFC Trading (Pty) Ltd.
What we collect
Only what claiming a square actually requires. There is no account to create, and nothing that watches you is loaded unless you have said yes to it. See cookies and measurement below.
We do not ask for your name, your address or your date of birth, and we never see or store your card details. Those go straight to Netcash and never touch our server.
What other people can see
Your artwork becomes public once your payment is confirmed. That is the point of the campaign. Nothing else does.
The endpoint the shirt reads is deliberately built so it cannot leak the rest: the database view behind it does not contain the email or mobile columns at all, so no future change to that endpoint can accidentally publish them. Artwork from a checkout that was started but never paid for is never shown to anyone.
Who else we give it to
Because Resend sends from infrastructure in the United States, your email address leaves South Africa when we email you. POPIA allows this where the recipient is bound to comparable protections, which their data processing terms provide.
This notice used to say that the site loads its typeface from Google Fonts, so Google received your IP address on every page load. That turned out not to be true: it is measurably not what happens, because the font never reaches the browser at all. Checked while writing this, a visit to this site before you answer the cookie bar contacts no third party of any kind.
Cookies and measurement
On your first visit a bar along the bottom asks whether we may load two measurement tools. Until you answer, and unless you say yes, none of them load at all: no third party script, no cookie, no request to anybody else's server. That is enforced in the code rather than promised in this paragraph, which is the only version of it worth anything.
Nothing optional is ticked for you. We would rather you pressed “Allow all” knowingly than found a box already ticked on your behalf, and a pre-ticked box is not consent under the European rules that cover the roughly one buyer in four here who is not in South Africa.
You can change your mind at any time: clear this site's data in your browser, or press the button below, and the bar comes back. One honest caveat. Turning something off stops it loading the next time; it cannot reach back and undo a page view that has already been recorded, and we are not going to pretend otherwise.
Our web server keeps ordinary access logs, which include IP addresses, for troubleshooting and abuse handling. Those are ours, they are not optional, and they are not shared.
Where it is kept, and for how long
On our own server in South Africa. The database accepts connections only from the machine itself, so it is not reachable from the internet at all. Staff access to order details is behind a password.
We keep your order for as long as the shirt exists as a record, because the square is meant to be permanent and we may need to prove who claimed it. We keep your artwork because it has to be printed. If you ask us to delete your personal details after your shirt has been delivered, we will, and we will keep only what we are legally required to keep for tax and accounting purposes.
Your rights
Under POPIA you can ask us to:
- tell you what we hold about you
- correct anything that is wrong
- delete anything we no longer have a good reason to keep
- stop contacting you, which we will do without argument
Email info@hbufc.co.za and we will answer. If you are not satisfied with how we handle it, you can complain to the Information Regulator of South Africa at inforegulator.org.za.
Children
The Legacy 500 is sold to adults. If you are under 18, ask a parent or guardian to claim the square instead. If you believe a child has given us personal information, tell us and we will remove it.
Changes
If we change how any of this works we will change this page and move the date at the top. We will not quietly start doing something with your information that this page does not describe.
Who you are dealing with
This is the information a supplier must give you under section 43 of the Electronic Communications and Transactions Act.
The Legacy 500 is sold by HBUFC Trading (Pty) Ltd, the trading company owned by Hout Bay United Football Community (HBUFC) Trust. Your contract is with the trading company, because that is who receives your payment. The proceeds fund the club.