1. Responsible party
GAB Computers is the responsible party for personal information where it determines the purpose and means of processing. Privacy enquiries: georgebotten@gabcomputers.co.za; WhatsApp text: 076 946 4060.
2. Information we may collect
- name, surname, company/organisation and contact details;
- billing, delivery and service addresses;
- quotation, order, invoice, PayFast reference, refund and warranty records;
- products purchased, support history, device models and serial numbers;
- messages, photos, screenshots and documents voluntarily supplied for support;
- supplier/courier fulfilment information;
- IP address, device/browser information, timestamps, requested pages and security events;
- information needed to prevent fraud, resolve disputes or comply with law.
GAB does not request full payment-card details through its own checkout; PayFast processes payment credentials in its environment.
3. Why information is processed
- respond to enquiries and quotations;
- diagnose, repair, configure and support technology;
- manage appointments, remote/on-site work and after-sales support;
- create, fulfil, deliver and administer online orders;
- verify PayFast payment notifications and process refunds;
- maintain accounting, warranty and transaction records;
- prevent fraud, spam, abuse and cyberattacks;
- exercise legal rights or comply with lawful obligations;
- send lawful direct marketing where permitted and provide an opt-out.
4. POPIA processing grounds and principles
Depending on the circumstances, GAB may process information on the basis of consent, contractual necessity, legal obligation, protection of a legitimate interest of the data subject, or legitimate interests of GAB or a third party where POPIA permits it.
GAB applies lawfulness, minimality, purpose specification, compatible further processing, information quality, openness, security safeguards and data-subject participation.
5. E-commerce, PayFast, suppliers and couriers
For an online order GAB processes customer, address, cart and transaction information needed to create the order, calculate delivery, send the payment request to PayFast, validate payment and fulfil the purchase. GAB stores a payment reference/status, not full card numbers.
Where The Courier Guy is used, delivery-address details and parcel information such as dimensions, weight and declared order value may be transmitted securely to The Courier Guy and the Shiplogic technology platform used to calculate courier rates, create or administer shipments and provide delivery services. Contact details may also be provided where needed for collection or delivery communication.
Relevant information may be shared with a product supplier where necessary for fulfilment. Supplier, courier and payment-service credentials, together with other confidential commercial system information, are kept securely on the server and are not disclosed through the public website.
6. Devices submitted for repair
Computers and phones can contain extensive personal or confidential information. GAB does not treat possession of a device as consent to browse unrelated content. Access is limited to what is reasonably necessary for the authorised diagnostic, repair, backup, recovery, malware-removal or configuration task.
8. Cross-border processing
Some technology providers may process information outside South Africa. Where POPIA section 72 applies, GAB will rely on an applicable lawful mechanism for the transfer, such as adequate protection, binding arrangements, consent where appropriate, or another statutory basis.
9. Security safeguards
GAB applies reasonable technical and organisational measures appropriate to foreseeable risks. Website controls include HTTPS, private server-side credential storage, Cloudflare Turnstile, rate limiting and server-side input validation. E-commerce price calculations are performed server-side, payment is not marked complete until validated by PayFast, and order records are stored outside the public web directory.
10. Security compromises
If GAB has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person, GAB will investigate and take the steps required by POPIA, which may include notifying the Information Regulator and affected data subjects as soon as reasonably possible, subject to lawful delay.
11. Retention
Information is retained only for as long as reasonably necessary for the purpose collected, a compatible lawful purpose, warranty/support, statutory accounting/tax records, dispute resolution or legal claims. Information no longer required will be deleted, destroyed or de-identified where appropriate.
12. Direct marketing
GAB will send electronic direct marketing only where POPIA permits it. Where consent is required, consent will be requested; where the existing-customer exception lawfully applies, marketing will be limited to GAB's similar products/services and an uncomplicated opt-out will be provided.
13. Data-subject rights
Subject to POPIA and other law, a person may request confirmation/access, correction or deletion, object to certain processing, withdraw consent where consent is the basis, object to direct marketing and complain to the Information Regulator. GAB may verify the identity and authority of a requester.
15. Privacy contact and regulator
Privacy requests: georgebotten@gabcomputers.co.za. A person may also complain to South Africa's Information Regulator through the current channels published at inforegulator.org.za.
GAB should maintain its Information Officer registration and PAIA manual as required by applicable law.