1. About this policy and who we are

This Privacy Policy explains how the South African Booksellers Association (“SABA”, “we”, “us” or “our”) collects and processes personal information through sabooksellers.com (the “Website”), related communications and services. “Personal information” includes “personal data” where the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies.

SABA is the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”) for processing for which it determines the purpose and means, and is the controller under the GDPR where that law applies.

SA Booksellers Association an operating affiliate of Book Tokens of Southern Africa,

Registration number 1955/001763/07

Information Officer / privacy contact: Melvin Kaabwe, National Office Project Manager,email: saba@sabooksellers.com, telephone: 0114313838, physically situated at Office 6 Rand Club, 33 Loveday Street, Marshalltown, Johannesburg 2001.

2. Member Responsibilities

The Website is an industry and member platform through which SABA members may submit and maintain their own business profiles, contact details, product listings, service descriptions, images, links and related information (“Member Content”).

SABA is responsible for personal information it collects for operating the Website, administering membership-facing website functions, responding to enquiries, securing the service, measuring use and communicating about SABA. Each member remains responsible for the lawfulness, accuracy, currency and authority to publish the Member Content it supplies. A member may also be an independent responsible party or controller for personal information it collects directly through its listing, linked website or subsequent dealings with users. Members must not upload unnecessary personal information, special personal information, children’s information or third-party information without an appropriate lawful basis and required notices or permissions.

No endorsement: The appearance, ordering or availability of any member, business, product, service, event, link or other Member Content on the Website is for information and discovery only. It does not constitute SABA’s endorsement, recommendation, certification, warranty or verification. Users should conduct their own enquiries before dealing with a member or purchasing any product or service.

3. Laws and Application

This policy is intended to support compliance with POPIA and applicable South African law, including the Promotion of Access to Information Act 2 of 2000 (“PAIA”), the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”), the Consumer Protection Act 68 of 2008 (“CPA”) and applicable direct-marketing rules. The GDPR applies only where its territorial scope is met, for example where SABA offers goods or services to, or monitors the behavior of, individuals in the European Economic Area (“EEA”). If South Africa is party to another applicable law that gives you stronger rights, SABA will apply that law to the relevant processing.

4. Personal information we collect

Depending on how you use the Website, we may process:

  • Identity and contact information: names, job titles, business names, addresses, telephone numbers, email addresses and communication preferences.
  • Member and profile information: membership identifiers and status, account credentials, authorized representatives, profile text, logos, photographs, catalogue or listing information, website and social-media links, locations and other Member Content.
  • Enquiry and correspondence information: messages, support requests, feedback, complaints and records of our responses.
  • Technical and usage information: IP address, device and browser information, identifiers, pages viewed, referring pages, timestamps, approximate location derived from IP, security events and diagnostic logs.
  • Marketing and consent information: subscriptions, consent records, opt-outs and campaign interactions.
  • Transaction information: if the Website later supports payments or paid services, billing and transaction records. SABA should not receive full payment-card details unless expressly implemented and disclosed.
  • Other information: information you choose to provide via engagement in published print or on publicly available social media and any information required by law.

Please do not provide special personal information, criminal-behavior information or children’s information unless SABA specifically requests it, explains why it is required and has a lawful basis to process it.

5. How we collect information

We collect information directly from you when you contact us, submit a form, subscribe, receive an invoice, participate or engage in SABA member official events, apply for SABA membership,create or update a member profile, or otherwise interact with the Website. We may also receive information from a SABA member or authorized representatives, service providers, publicly available and lawful sources, Customer Relationship Management (CRM) tools, social media and automatically through server logs and consent-based technologies such as analytics cookies.

If you provide another person’s information, you must be authorized to do so and must direct that person to this policy where required.

6. Purposes and Lawful grounds

We process personal information only where a lawful ground applies. Under POPIA, this may include consent, performance of a contract, compliance with a legal obligation, protection of a legitimate interest of the data subject, performance of a public-law duty where applicable, or pursuit of our or a third party’s legitimate interests where your rights do not override them. Under the GDPR, the corresponding bases include consent, contract, legal obligation and legitimate interests.

We may process information to:

  • provide, operate, host, maintain and improve the Website;
  • verify, publish and administer member profiles and Member Content;
  • authenticate authorized users and manage access;
  • respond to enquiries, requests, complaints and support needs;
  • communicate service, governance, industry and membership information;
  • send direct marketing where permitted and record consent or objections;
  • analyse Website performance and usage, subject to required cookie choices;
  • detect, investigate and prevent misuse, fraud, security incidents and unlawful activity;
  • establish, exercise or defend legal claims, enforce terms and meet legal, regulatory, audit and reporting duties; and
  • protect the rights, safety and property of SABA, members, users and others.

Where we rely on legitimate interests, those interests include operating a secure and useful industry platform, maintaining accurate directory information, answering stakeholders, improving services, protecting systems and supporting SABA’s lawful objectives. You may ask for information about the balancing assessment relevant to you.

Where information is necessary to enter into or perform a contract, provide a requested service, secure the Website or comply with law, failure to provide it may prevent SABA from providing the relevant feature or responding fully.

7. Cookies and Similar technologies

We may use strictly necessary technologies such as tracking technology (cookies) to provide core functions, maintain security and remember privacy choices. Without your consent where required, we may use preferences, audience-measurement, analytics or advertising technologies. Non-essential technologies will not be activated before the required consent is obtained.

8. Sharing and Public disclosure

Member Content intended for publication will be visible to the public and may be copied, indexed or cached by search engines and third parties. Members should publish business contact details rather than private contact details wherever possible.

We may disclose personal information only as necessary to:

  • provide hosting, cloud, cybersecurity, IT support, email, customer-support, analytics and other service providers acting under appropriate instructions and contracts;
  • SABA’s professional advisers, auditors, insurers and other authorized personnel;
  • the relevant SABA member where you direct an enquiry to that member or request contact;
  • competent courts, regulators, law-enforcement bodies and public authorities where required or lawfully requested;
  • a successor or participant in a lawful restructuring or transfer, subject to confidentiality and applicable law; or
  • other recipients where you consent or disclosure is otherwise lawfully permitted.

We do not sell personal information. A member’s own handling of information after you contact it is governed by that member’s privacy notice and practices.

9. International Transfers

Our providers or recipients may process information outside South Africa or the EEA. Before a restricted transfer, we will use a mechanism permitted by applicable law. Under POPIA this may include an adequate legal framework, a binding agreement or binding corporate rules providing an adequate level of protection, consent, contractual necessity or another statutory ground. Under the GDPR it may include an adequacy decision, approved standard contractual clauses with supplementary measures where needed, or a permitted derogation. You may contact us for information about applicable safeguards and how to obtain a copy, subject to lawful redactions.

10. Security and Security Compromises

We use reasonable and appropriate technical and organizational safeguards designed to preserve confidentiality, integrity and availability. Measures may include multi-factor authentication access (MFA) controls, least-privilege permissions, authentication, encryption where appropriate, backups, monitoring, vulnerability management, staff awareness, supplier due diligence and incident-response procedures. No internet service is completely secure.

If there are reasonable grounds to believe that unauthorized access to or acquisition of personal information has occurred, we will investigate, contain and document the incident and notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires it, subject to any lawful delay. Where the GDPR applies, we will notify the competent supervisory authority and affected individuals within the applicable thresholds and timeframes.

11. Retention

We keep personal information only for as long as necessary for the purpose collected, contractual and operational requirements, legal or regulatory retention duties, dispute resolution, security and the establishment or legal defense of any claims. Retention periods depend on the record type, membership status and applicable law. When information is no longer required, we will securely delete, destroy, de-identify or anonymize it, subject to lawful preservation holds.

Published Member Content will ordinarily remain available while the member’s listing is active and may be retained for a limited period after removal for backup, historical record, audit, dispute and legal purposes. Public copies outside SABA’s control may persist in third-party caches or archives.

12. Direct Marketing

We will send electronic direct marketing only where permitted by POPIA, the CPA and other applicable law. Where prior consent is required, we will request it in the prescribed or otherwise valid manner. Where permitted to market to an existing customer, we will limit communications to SABA’s own similar services and provide an opportunity to object via written objection to SABA’s nominated information officer as identified in this Policy.

Every marketing message will identify the sender and provide a simple, free method to unsubscribe or object. We will honor valid objections and withdrawals and retain a minimal suppression record to prevent further marketing. SABA will comply with any applicable national opt-out registry, registration, list-cleansing and contact-time requirements as they become operative. Service and legally required communications are not marketing.

13. Your Rights

Subject to applicable law, identity verification, lawful exceptions and the rights of others, you may:

  • ask whether we hold personal information about you and request access to it;
  • request correction, updating, deletion or destruction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information;
  • object on reasonable grounds to certain processing and object at any time to direct marketing;
  • withdraw consent at any time, without affecting the lawfulness of prior processing;
  • complain to the Information Regulator or another competent supervisory authority;
  • under the GDPR, request restriction, erasure and portability, and object to processing based on legitimate interests; and
  • under the GDPR and applicable POPIA provisions, request safeguards concerning a decision based solely on automated processing that produces legal or similarly significant effects.

SABA does not intend to use solely automated decision-making that produces legal or similarly significant effects. If that changes, we will provide the information and safeguards required by law.

To exercise a right, contact the Information Officer using the details in section 1 and describe your request. We may request proportionate proof of identity or authority. Requests are generally free, but a fee may be charged or a request refused where permitted by law, with reasons and available remedies. POPIA access or correction requests may require prescribed forms, and record-access requests may also be handled under SABA’s PAIA Manual.

14. Children

The Website is directed to businesses, professionals and general audiences and is not intended to collect personal information directly from children. Do not create an account or submit personal information if you are a child unless a competent person has authorized the processing or another lawful exception applies. If we learn that children’s information was collected without an appropriate legal basis, we will take reasonable steps to delete or otherwise lawfully address it.

15. External links and member services

The Website may link to member and third-party websites, marketplaces, payment services and social-media pages. SABA does not control those services and is not responsible for their privacy, security, content, availability or transactions. Review the relevant third party’s privacy notice and terms before providing information or transacting.

16. Complaints and Regulators

Please contact SABA’s Information Officer first so that we can try to resolve your concern.

Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; P.O. Box 31533, Braamfontein, Johannesburg, 2017; enquiries@inforegulator.org.za; complaints@inforegulator.org.za; +27 (0)10 023 5200. Verify current details before publication.

17. Changes to this Policy

We may update this policy to reflect changes in law, technology, the Website or our practices. The latest version will be published on the Website with the updated date. Where required, we will provide additional notice or seek renewed consent.

18. Contact

For privacy questions, requests or complaints, contact: SABA Information Officer, saba@sabooksellers.com, on telephone 0114313838 and physically situated at Office 6, 4th Floor, Rand Club, Marshalltown, Johannesburg 2001.