Privacy policy

What we collect

When you buy

Your name, email address, mobile number, and — for print orders only — your delivery address.

When you pay

Nothing. Card and banking details go directly to PayFast and never reach us. We receive only a reference and a confirmation of the amount.

When you make a speaking enquiry

Your name, organisation, email, mobile, and whatever you tell us about the event.

When you create an account

Your email address and a password, which is stored only as a cryptographic hash and cannot be read by us.

Automatically

Your IP address and browser type when you submit a form. We use it to block automated abuse, and for nothing else.

Why we process it, and on what basis

To fulfil your order

Necessary to carry out the contract you entered into with us.

To email you a confirmation, download links or a despatch notice

Necessary to carry out that same contract. These are transactional messages, not marketing, and you cannot unsubscribe from them while an order is live.

To keep tax records

Required by law. The Tax Administration Act obliges us to retain records of a transaction for five years.

To answer a speaking enquiry

Your consent, given by submitting the form.

To prevent fraud and abuse

Our legitimate interest in not being defrauded.

We do not sell your information, and we do not send marketing email unless you have specifically asked for it.

Who else sees it

We use a small number of service providers — operators, in POPIA's language — each of which sees only what it needs to do its job:

PayFast

Takes your payment. Sees your name, email and the amount.

Supabase

Stores the database and the book files.

Vercel

Runs the website itself.

Resend

Sends the emails. Sees your email address and the message.

The Courier Guy — Economy Road service

Delivers print orders. Sees your name, address and mobile number.

Each is bound to process your information only on our instructions and to keep it secure. We share information with anyone else only where the law requires it.

Information sent outside South Africa

Some of the providers above host data outside South Africa. Section 72 of POPIA permits this where the receiving country has comparable protection, or where the provider is bound by contract to a comparable standard. Our providers are bound by such terms.

How long we keep it

Order and invoice records

Five years, as tax law requires.

Your account

Until you delete it.

Speaking enquiries

[[CLIENT: how long should enquiries be retained?]]

Form IP addresses

Kept only as long as needed to detect abuse.

When you delete your account we remove your name, email and contact details and unlink you from your past orders. The order records themselves survive in anonymised form, because we are legally obliged to keep them. Any live download links stop working at the same moment.

Your rights

POPIA gives you the right to:

• ask what personal information we hold about you, and get a copy of it
• have information that is wrong corrected
• have information deleted where we no longer have grounds to keep it
• object to processing based on our legitimate interest
• withdraw consent where consent was the basis, without affecting what we did before you withdrew it
• complain to the Information Regulator

If you have an account, the first two and the third are self-service: your account page will export everything we hold about you and will delete your account without you having to ask anyone. Otherwise, write to the information officer above.

The Information Regulator of South Africa can be reached at enquiries@inforegulator.org.za, or through inforegulator.org.za.

Cookies

We use as few cookies as we can, and none of them track you across other websites.

Essential

Your basket, your sign-in session, and your answer to the cookie banner itself. The site cannot work without these, so they are set without asking.

Everything else

Off unless you switch it on. The banner defaults to declining, and declining is a single click — the same click as accepting.

We do not currently run analytics or advertising cookies at all. If that ever changes, the banner will ask you first.

Security

The site is served over HTTPS. Passwords are hashed, never stored in a readable form. Book files are held in private storage that is not reachable by URL — a download always goes through a link issued to you, which expires. Database access is restricted per-user at the database itself rather than only in application code, so a mistake in the application cannot expose another customer's orders.

If a breach affects your personal information, POPIA requires us to notify you and the Information Regulator, and we will.

Children

This site is not aimed at children, and we do not knowingly collect information about anyone under 18 without the consent of a parent or guardian. If you believe we have, tell the information officer and we will delete it.

Changes to this policy

If we change how we handle your information we will update this page and change the date at the top. Where the change is significant, we will tell you directly.