Privacy Policy
Effective date: 5 October 2026
1. Who we are
Afriplex (Pty) Ltd (‘Afriplex’, ‘we’, ‘us’) runs afriplex.com and is responsible for the personal information described in this policy. Under POPIA we are the responsible party; under the GDPR and UK GDPR we are the controller.
- Company: Afriplex (Pty) Ltd, a private company registered in South Africa
- Address: 10 De Vreugde Crescent, Dal Josaphat, Paarl, 7646, Western Cape, South Africa
- Privacy contact: privacy@afriplex.co.za · +27 (0)21 872 4976
- Information Officer: appointed and registered with the Information Regulator; contact through privacy@afriplex.co.za
This policy applies wherever you are in the world. Section 10 sets out the extra rights you have in some regions.
Our website is for business customers: brand owners, product developers, manufacturers and distributors. It is not directed at children, and we do not knowingly collect information about anyone under 18.
2. What we collect
Information you give us
- Enquiries: name, company, job title, email address, telephone number, country and the content of your message, when you use our contact form or email us.
- Job applications: the information in your CV and covering note, when you email careers@afriplex.com. Please leave out identity numbers, health information and other sensitive information unless we ask for it later in a recruitment process.
- Business relationships: contact, company, VAT and order details of the people we deal with at customers, suppliers and partners, and information we need to verify a business’s identity.
- Events: details you give us at trade shows and events, such as a business card or badge scan.
Information collected automatically
- Device and usage data: IP address, approximate location (country or city, from your IP address), browser, device type, pages visited, links clicked, time on site, and the website or advert that referred you.
- Cookie and advertising identifiers: identifiers set by cookies, pixels and tags from us and our analytics provider. See section 4 and our Cookie Policy.
Information from others
- Reports from platforms we use, such as Google and LinkedIn, about how our website and posts perform, and professional information you make public, for example on LinkedIn.
- Business contact details from trade directories and from our group company, ImpiloVest.
We do not use personal information to make automated decisions that have legal or similarly significant effects on you.
3. Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Answering enquiries, samples and quotation requests | Steps you ask for before a contract; our legitimate interest in answering business enquiries |
| Supplying products and services, and managing accounts | Performing a contract |
| Recruitment | Steps you ask for before a contract; your consent to keep your CV on file |
| Website analytics | Consent where the law requires it; otherwise our legitimate interest in understanding how the site is used |
| Advertising and remarketing (section 4) | Consent where the law requires it; otherwise legitimate interest, with a right to opt out |
| Business marketing by email | Existing customers: legitimate interest, with an opt-out in every message. Everyone else: consent (POPIA section 69; EU and UK e-privacy rules) |
| Events and trade shows | Legitimate interest in following up business contacts |
| Security, fraud prevention and keeping our systems working | Legitimate interest; legal obligation |
| Legal, tax, regulatory, quality and export obligations (including SAHPRA) | Legal obligation |
Where we rely on legitimate interest, we have weighed it against your rights. You can object at any time (section 9).
4. Analytics, advertising and remarketing
We use these tools to measure how the site is used:
- Google Tag Manager and Google Analytics 4, to measure visits, traffic sources and how pages are used.
Google Analytics uses cookies and identifiers to measure visits. Google acts as our operator (processor) for this measurement.
We do not currently use advertising or remarketing tags on afriplex.com. If we add them (for example Google Ads or the LinkedIn Insight Tag), we will update this policy and our Cookie Policy first, and ask for your consent where the law requires it.
We use Google Consent Mode. Where you have not consented, or have opted out, Google tags do not set advertising or analytics cookies and send only cookieless signals that cannot identify you.
We may also share hashed (encrypted) email addresses of existing business contacts with Google or LinkedIn to show them relevant adverts or exclude them from ads. The platforms match and then delete the hashed data. You can opt out by emailing privacy@afriplex.co.za.
Your choices: use Cookie settings (or Your Privacy Choices) in the footer of every page, turn on Global Privacy Control in your browser, or use each platform’s ad settings.
5. Who we share it with
We do not sell personal information for money. We share it only where needed for the purposes above:
- Service providers (operators/processors): website hosting (Cloudways on Amazon Web Services, Frankfurt, Germany), Cloudflare (security and content delivery), CookieYes (consent records), Microsoft 365 (email and office systems), Google Workspace (sending email from our website forms), HubSpot (customer relationship management: form enquiries and business contacts), and the analytics provider in section 4. They act on our instructions under written agreements.
- ImpiloVest, our group company, where needed to handle your enquiry.
- Professional advisers, auditors, insurers, regulators, courts and law enforcement, where the law requires or allows it.
- A buyer or successor, if all or part of our business is sold or restructured.
We do not pass enquiries to distributors or agents.
6. International transfers
We are based in South Africa, and our providers process information in other countries, including the United States, the European Union and the United Kingdom.
- From South Africa: we transfer personal information only where section 72 of POPIA allows it, for example under binding contracts giving protection substantially similar to POPIA.
- From the EU, UK and Switzerland: South Africa does not have an adequacy decision. We rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent Swiss safeguards, or on adequacy decisions (including the EU–US Data Privacy Framework) where a provider is certified.
You can ask for a copy of the relevant safeguards by emailing privacy@afriplex.co.za.
7. How long we keep it
| Information | Kept for |
|---|---|
| Enquiries that do not lead to business | Up to 2 years after our last contact |
| Customer and supplier records | For the relationship, then as tax, company and regulatory law requires (generally 5 to 7 years) |
| CVs sent to careers@ | Up to 12 months, unless you ask us to delete them sooner |
| Google Analytics data | 14 months |
| Advertising audience lists | Up to 540 days after your last visit, set in each platform |
| Website security logs | Up to 90 days |
| Consent records | For as long as needed to show your choice, up to 2 years |
After that, we delete or anonymise it.
8. How we protect it
We use encrypted connections (HTTPS), a web application firewall, two-factor authentication and activity logging for site administrators, access controls, regular backups and confidentiality obligations for staff and providers. If a security compromise affects your personal information, we will notify you and the relevant regulator where the law requires it.
9. Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you, and get a copy;
- have it corrected or completed;
- have it deleted;
- restrict how we use it;
- receive it in a portable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- opt out of targeted advertising and the ‘sharing’ of personal information for it;
- withdraw consent, without affecting processing before you withdrew it;
- complain to a data protection authority.
Email privacy@afriplex.co.za or call +27 (0)21 872 4976. We will reply within 30 days (45 days where US state law allows) and may need to verify your identity. We will not treat you differently for using your rights. You may use an authorised agent, and if we decline your request you may ask us to review that decision. Formal requests for records under South African law are handled under our PAIA Manual.
10. Regional information
South Africa. You may complain to the Information Regulator: inforegulator.org.za, enquiries@inforegulator.org.za, 010 023 5200.
European Economic Area, United Kingdom and Switzerland. Our lawful bases are listed in section 3 (GDPR Article 6). You may complain to the data protection authority where you live or work, such as the UK Information Commissioner’s Office.
United States. Residents of California and other states with privacy laws have the rights in section 9. In the last 12 months we collected identifiers (such as name, email, IP address and cookie IDs), professional information, commercial information, internet activity and approximate location, from the sources and for the purposes in sections 2 to 4. We do not sell personal information for money, but using advertising cookies may count as ‘sharing’ or ‘targeted advertising’ under these laws. To opt out, use Your Privacy Choices in the footer or turn on Global Privacy Control, which we honour. We do not collect sensitive personal information to infer characteristics about you.
Other countries. If local law (for example in Brazil, Canada or Australia) gives you further rights, contact us and we will honour them.
11. Changes to this policy
We update this policy when our practices or the law change. The effective date at the top shows the latest version. We will highlight significant changes on this page.
12. Contact
privacy@afriplex.co.za · +27 (0)21 872 4976 · Information Officer, Afriplex (Pty) Ltd, 10 De Vreugde Crescent, Dal Josaphat, Paarl, 7646, South Africa