Privacy Policy

ALL-QUIP INDUSTRIAL & HARDWARE CC

POPIA  ·  ECT Act  ·  B2C and B2B  ·  International

 

Item	Detail
Responsible party	All-Quip Industrial & Hardware CC, Reg. No. 2008/026004/23
Physical address	38 Russell Street, Ashley, Pinetown, KwaZulu-Natal, 3605, South Africa
Postal address	PO Box 2263, Pinetown, 3600
Information Officer	Chris Govender, General Manager  ·  info@all-quip.co.za  ·  +27 31 701 0090
Information Regulator registration	Registration in progress — this policy will be updated once the number is issued
Version	v2.1 — supersedes Privacy Policy v2.0
Effective date	22 September 2026
Governing law	POPIA (Act 4 of 2013)  ·  ECT Act 25 of 2002  ·  CPA 68 of 2008

All-Quip Industrial & Hardware CC is a KwaZulu-Natal based supplier of personal protective equipment, industrial workwear, safety footwear, and corporate and promotional products. We supply individual customers, SMEs, corporates, government entities, mining and construction companies, and international buyers.

This policy explains how we collect, use, store, share and protect your personal information. It applies to individual consumers buying through www.all-quip.co.za; business customers, procurement officers and safety managers ordering on behalf of their organisations; wholesale and reseller account holders; visitors to our website and recipients of our communications; and employees and contact persons of our business customers, in South Africa and internationally.

By using our website, placing an order, creating an account or providing us with personal information, you acknowledge that you have read and understood this policy. If you do not agree with it, please do not use our services.

POPIA requires every responsible party to have an Information Officer accountable for compliance. All-Quip has designated the following person to act in that role.

Role	Details
Information Officer	Chris Govender
Designation	General Manager, All-Quip Industrial & Hardware CC — duly designated by the members in terms of POPIA
Email	info@all-quip.co.za
Postal address	38 Russell Street, Ashley, Pinetown, KwaZulu-Natal, 3605, South Africa
Telephone	+27 31 701 0090  (Mon–Fri 08:00–17:00)
Information Regulator registration	Registration in progress — number to be inserted once issued

 

All data subject access requests, objections, correction requests and privacy complaints should be sent to the Information Officer. We respond within 30 days.

Information Regulator · inforegulator.org.za · enquiries@inforegulator.org.za · +27 10 023 5200 · JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

3.1  Individual customers

Category	What we collect	When
Identity	Full name	Registration, checkout
Contact	Email, telephone or mobile number, delivery address	Registration, checkout, returns
Order	Order history, product selections, basket contents, payment status	Every transaction
Payment	Transaction reference and payment method type. We do not store card numbers — these are held by our payment gateway	Checkout
Account	Username, encrypted password, preferences, saved addresses	Account creation
Communications	Emails, chat messages and support tickets you send us	Customer service
Marketing preferences	Opt-in and opt-out status	Registration or on request
Technical	IP address, browser and device type, pages visited, session duration, referral URL	Automatically on visit
Cookies	Session, preference, analytics and marketing cookies	Automatically on visit

 

3.2  Business, wholesale and reseller accounts

When you represent a business, we collect personal information about you as an individual, not only about the entity.

Category	What we collect	When
Business identity	Registered name, registration number, VAT number, trading name, addresses	Account application
Contact person	Name, job title, work email, telephone and mobile number	Application and orders
Delivery contacts	Name and number of the site safety officer, stores manager or authorised receiver	Per order, for site deliveries
Verification documents	Company registration documents, VAT certificate, proof of address, certified identity documents of members and directors	Account application — see clause 3.3
Procurement data	Purchase orders, approved supplier status, credit limit, payment terms	Account setup and ongoing
B-BBEE information	B-BBEE certificate where required for your procurement compliance	On request
OHS contacts	Name and contact of your Health and Safety Officer, for PPE compliance documentation	Where provided
Branded order details	Employee names, departments and sizes submitted for branded uniform orders	When ordering branded goods
Financial	Bank details for EFT refunds; credit application information	Credit accounts and refunds

3.3  Verification documents on business accounts

When you apply for a wholesale, reseller or credit account we ask you to upload verification documents, which may include identity documents of members or directors.

Why we ask, and on what basis. All-Quip is not an accountable institution under the Financial Intelligence Centre Act, and we do not carry out FICA verification. We collect these documents for a narrower purpose: to confirm that the business exists, that the person applying is authorised to bind it, and — where credit or a suretyship is involved — to assess credit risk. The lawful basis is our legitimate interest under section 11(1)(f) of POPIA, and for credit accounts, performance of the contract between us. Supplying them is voluntary, but we cannot open a trade account without them.

Verification documents are stored in our platform’s secure document storage, access is restricted to staff who need it to assess the application, and they are retained in accordance with clause 10.

3.4  What we do not collect

•   Biometric information of any kind;

•   Health or medical information — we supply PPE but do not administer workplace medical surveillance;

•   Religious, political or trade union information;

•   Information about children under 18 — our services are not directed at children;

•   Full payment card numbers — processed by our payment gateway and never held by us.

Purpose	Lawful basis (POPIA s11)
Processing, fulfilling and delivering your order	Performance of the contract
Managing your account and providing support	Performance of the contract
Issuing tax invoices and keeping financial records	Legal obligation — VAT Act, Companies Act
Verifying business accounts and assessing credit risk	Legitimate interest; consent for credit bureau checks
Preventing fraud and securing our systems	Legitimate interest
Improving our website and understanding how it is used	Legitimate interest; consent for non-essential cookies
Sending marketing communications	Consent — withdrawable at any time
Complying with customs and export requirements on international orders	Legal obligation; performance of the contract

Type	Purpose	Consent needed?	Retention
Strictly necessary	Session, basket, checkout and login — the site cannot work without these	No — essential	Session to 1 year
Functional	Remembers currency, language, saved addresses and wishlist	Yes — can decline	Up to 1 year
Analytics	Page views, session duration, traffic sources — used to improve the store	Yes — can decline	Up to 2 years
Marketing	Used to show relevant advertising after you visit	Yes — can decline	Up to 90 days

 

A cookie consent banner lets you accept all, accept only essential, or set preferences by category. You can also manage cookies through your browser. Disabling some cookies may affect functionality — your basket may not persist between sessions.

We do not sell your personal information. We share it only as set out below. Every operator we use is bound by a written agreement requiring them to process your information only on our instructions and to keep it secure.

6.1  Operators and service providers

Category	Provider	What we share	Purpose
E-commerce platform	Shopify Inc.	Name, address, order and payment method	Store operation and order processing
Payment gateway	Shopify Payments (Stripe) / PayFast / Stitch	Transaction data, tokenised card data	Secure payment — card numbers never reach us
Domestic shipping	Shiprazor	Name, delivery address, mobile number, parcel details	Carrier selection, label generation, tracking
Domestic carriers	The couriers in the Shiprazor network. The carrier is selected per shipment, so the specific recipient varies	Name, delivery address, mobile number	Collection and delivery
Supplier-direct shipments	Barron / Kevro Name, delivery address, contact number, order contents Dispatching unbranded supplier items directly to you	Name, delivery address, mobile number	Collection and delivery
International shipping	Tunl	Name, address, contact number, order contents, declared value, customs declaration data	Rating, customs documentation, duty calculation, fulfilment
International carriers	FedEx, UPS and other carriers in the Tunl network	Same as above	International carriage and clearance
Customs authorities	The customs authority of the destination country	Recipient name and address, order contents, declared value	Import clearance — legally required
Email marketing	Shopify (Shopify Email)	Email address, name, purchase history, preferences	Sending communications you have consented to
Analytics	Google Analytics	Anonymised usage data, anonymised IP address	Website analytics
Accounting	Sage Business Cloud Accounting	Invoice name, address, transaction records	Financial records and VAT compliance
Cloud storage and email	Google Workspace  ·  Shopify	Business correspondence, order records, uploaded verification documents	Secure storage and email

 

6.2  Legal and regulatory disclosures

We may disclose personal information to SARS for tax and customs compliance; to law enforcement where required by court order or statute; to the Information Regulator in connection with a POPIA investigation; and to our attorneys or debt collectors where an account is in default and recovery is necessary.

6.3  Credit bureaux

Where you apply for a trade credit account, and subject to the consents you give in Schedule 3 of our Terms of Service, we may obtain a credit report on the business and on any person who signs a deed of suretyship, and may report account conduct and payment performance to registered credit bureaux, including default listing where an account remains unpaid after written demand. Where a listed debt is subsequently settled, we notify the bureau so the record is updated.

Section 72 of POPIA restricts transfers of personal information outside South Africa unless adequate protection is in place. We transfer information across borders in three situations.

7.1  Technology providers

Some of our operators are based outside South Africa, including Shopify (Canada and USA) and Google (USA). These transfers are justified because the transfers are necessary to perform the contract between you and us — your order cannot be processed without the platform that hosts our store — and because we have concluded data processing agreements with these providers imposing obligations equivalent to POPIA, including standard contractual clauses.

7.2  International deliveries

Where you order for delivery outside South Africa, we necessarily share your name, address, contact number and information about the goods with our international shipping partner, the carrier handling the shipment, and the customs authority of the destination country. This is required by the export laws of South Africa and the import laws of the destination country, and it is necessary to perform your contract with us.

What this means in practice. We cannot ship to you internationally without transferring your delivery details across borders. Customs authorities are independent regulators, not our operators — once information is lawfully submitted to them for clearance, their own laws govern how they handle it. If you are not comfortable with that, please do not place an international order.

Data protection standards differ by destination. Where a destination country has no adequate data protection framework, we limit what we transfer to what is strictly necessary for delivery and customs clearance, and we do not share marketing data.

7.3  Marketing

We do not add international customers to our marketing lists unless they have explicitly opted in. Where a destination country lacks an adequate framework, we apply POPIA standards as our baseline regardless.

•   Our website uses TLS encryption; card data is tokenised and never held by us.

•   Access to customer and account data is restricted by role to staff who need it.

•   Verification documents uploaded for business accounts are held in restricted-access storage.

•   Operators are vetted before onboarding and are bound by written data processing agreements.

•   We maintain a record of processing activities and review our privacy practices periodically.

 

8.1  If there is a breach

Section 22 of POPIA requires us to notify affected data subjects and the Information Regulator where a security compromise is reasonably likely to prejudice your interests. If a breach occurs we will notify the Regulator as soon as reasonably possible, notify affected people in writing by email, and describe the nature of the breach, the information involved, what we have done, and what you can do to reduce any risk.

No system is completely secure. If you believe your account has been compromised, contact info@all-quip.co.za immediately.

•   To ask what personal information we hold about you and be given a copy;

•   To ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained;

•   To object, on reasonable grounds, to processing based on legitimate interest;

•   To withdraw consent at any time — including marketing consent, by using the unsubscribe link or writing to us;

•   Not to be subject to a decision based solely on automated processing that has legal consequences for you;

•   To complain to the Information Regulator.

 

Send requests to info@all-quip.co.za, subject line "Privacy Request — [Your Name]". We respond within 30 days. We may ask you to verify your identity before releasing information.

Category	Retention period	Why
Order and transaction records	5 years from the transaction	VAT Act and Companies Act record-keeping obligations
Active customer accounts	Duration of the account plus 3 years after last activity	Contract, fraud prevention, warranty support
Closed or deleted accounts	1 year after the deletion request	To resolve outstanding disputes or warranty claims
Business account verification documents	Duration of the trading relationship plus 5 years	Account administration and dispute resolution
Unsuccessful account applications	12 months, then destroyed	To handle queries about the decision
Credit account and suretyship records	5 years after the account is closed and settled, or as long as a claim may be brought	Enforcement and prescription periods
Marketing contact details	Until opt-out plus 6 months	To complete dispatched campaigns and process unsubscribes
Cookie and analytics data	Up to 2 years	Site improvement

11.1  Your employees’ information

When you place a branded uniform order and give us employee names, sizes and departments, we use that information solely to fulfil your order. We do not add those employees to marketing lists.

Branding is done in-house. All-Quip applies embroidery, printing and engraving itself rather than outsourcing to a third-party decorator. Employee names, departments and sizing submitted for a branded uniform order therefore stay within All-Quip and are not shared with any external branding partner.

If you provide employee information to us, you represent that you have the authority or consent to do so; that your employees have been informed that their details may be shared with suppliers for uniform and PPE procurement; and that you will direct any employee wishing to exercise their POPIA rights to info@all-quip.co.za.

11.2  OHS and compliance contacts

Where you give us the details of a Health and Safety Officer to receive certification documents, ATPV test reports or compliance data sheets, we process that information exclusively for that purpose. It is not used for marketing.

11.3  Wholesale and reseller platform accounts

Account details for wholesale and reseller pricing tiers are stored in our e-commerce platform and the pricing application we use, and are used exclusively for pricing tier management and order processing. Our obligations to you under POPIA are unaffected by our use of those tools.

Our website may link to manufacturer sites, certification bodies and industry resources. This policy covers only our own operations. We are not responsible for the privacy practices of third-party sites and encourage you to read their policies before sharing information with them.

Our website and services are not directed at children under 18 and we do not knowingly collect their personal information. Where a business orders branded items in children’s sizes — school uniforms or promotional items — the ordering business is the contracting party and is responsible for ensuring appropriate consents are in place. We do not process children’s information beyond what is strictly needed to fulfil the order.

We may update this policy to reflect changes in legislation, our business practices or technology providers, or guidance from the Information Regulator. We publish the updated version with a new effective date and email registered account holders where a change materially affects how we process their information.

Purpose	Contact
Privacy and data subject requests	info@all-quip.co.za  ·  subject: "Privacy Request — [Your Name]"
Information Officer	Chris Govender, General Manager  ·  info@all-quip.co.za
General customer service	info@all-quip.co.za  ·  +27 31 701 0090
Physical address	38 Russell Street, Ashley, Pinetown, KwaZulu-Natal, 3605, South Africa
Information Regulator	inforegulator.org.za  ·  enquiries@inforegulator.org.za  ·  +27 10 023 5200
Consumer Goods and Services Ombud	cgso.org.za  ·  0860 000 272

 

If you are not satisfied with our response to a privacy complaint, you may escalate to the South African Information Regulator. The Regulator may investigate and, where POPIA has been contravened, issue an enforcement notice, impose an administrative fine of up to R10 million, or refer the matter for prosecution.