Privacy Policy.

1. Who we are

Jbay Hout en Ys (Pty) Ltd (“we”, “us”, “our”) is the responsible party for the purposes of POPIA in respect of the personal information collected through themancave.africa and the customer portal.

• Registered name: Jbay Hout en Ys (Pty) Ltd
• Trading as: The Man Cave
• Company registration: 2021/318092/07
• VAT number: —
• Address: Port Elizabeth (Gqeberha), South Africa
• Contact: lew@themancave.africa

2. Information Officer

The Information Officer responsible for compliance with POPIA is the Managing Director of Jbay Hout en Ys (Pty) Ltd. Queries, requests, and complaints relating to personal information processing may be sent to lew@themancave.africa marked “Information Officer”.

3. Information we collect

We collect only the personal information needed to operate as a B2B supplier. This includes:

3.1 Account & trading information

• Business name, trading address, registration number, VAT number
• Contact person name, role, phone, email
• Delivery addresses and any access notes you provide
• Banking details where you provide them for invoicing or refunds

3.2 Transactional information

• Orders, invoices, payments, statements, credit notes
• Delivery records including proof-of-delivery photos and signatures
• Support tickets and the messages exchanged on them

3.3 Technical information

• IP address, browser user-agent and referring page when submitting a form (for spam prevention)
• Login session timestamps via Supabase Auth
• Email delivery telemetry (open / bounce events) via Resend

We do not use behavioural advertising trackers, and we do not sell or rent personal information.

4. Why we collect it (purpose)

Personal information is processed strictly to:

• Provide and manage your trading account, orders and deliveries
• Issue tax invoices, statements and credit notes as required by SARS
• Communicate with you about your orders, account, deliveries and compliance documents
• Detect and prevent fraud, abuse, or unauthorised access
• Meet legal obligations including those under the Companies Act, Tax Administration Act, and POPIA itself

5. Lawful basis for processing

We process personal information on one or more of the following lawful bases under POPIA s11:

• Contract — to perform our supply contract with you
• Legal obligation — to comply with tax, accounting and consumer-protection law
• Legitimate interest — for fraud prevention and business operation, balanced against your privacy
• Consent — for any optional communications you opt into

6. Who we share it with

We share personal information only with the operators (data processors) needed to run the business:

• Supabase — managed PostgreSQL database, authentication and file storage (Singapore region)
• Vercel — application hosting (US/EU regions)
• Resend — transactional email delivery (US region)
• Your bank and ours — when you make or receive payments
• SARS, regulators, and courts — when required by law
• Our auditors and accountants — under confidentiality agreements

Each operator is bound by a written agreement to process personal information only on our instructions and to maintain technical and organisational safeguards. We do not share your information with marketing partners or data brokers.

7. Cross-border processing

Some operators above (Vercel, Resend) store personal information outside South Africa, primarily in the European Economic Area and the United States. POPIA s72 permits cross-border transfers where the recipient is subject to comparable data protection law or a binding contractual undertaking. Our operator agreements meet that standard.

8. How long we keep it

We keep personal information only as long as we need it for the purposes above, or as required by law:

• Active customer account information: while you have an active account, plus 5 years thereafter
• Tax records (invoices, credit notes, payment records): 5 years after the relevant tax period, per the Tax Administration Act
• Email delivery logs: 12 months
• Lead enquiries that do not convert: 12 months, then deleted
• Support ticket records: while account is active, then anonymised after 24 months

9. Your rights under POPIA

You have the right to:

• Request access to the personal information we hold about you (POPIA s23)
• Request correction or deletion where it is inaccurate, irrelevant, out of date, or unlawfully obtained (s24)
• Object to processing for direct marketing (s11(3))
• Withdraw consent at any time where consent is the basis for processing
• Lodge a complaint with the Information Regulator at inforegulator.org.za

To exercise any of these rights, write to us at lew@themancave.africa. We will respond within 30 days. Requests are free except where excessive, in which case we may charge a reasonable administrative fee.

10. How we protect it

We maintain technical and organisational safeguards including:

• TLS encryption on all data in transit
• Encryption at rest on database and storage
• Multi-tenant row-level isolation enforced at the database
• Role-based access controls for staff users
• Audit logs of access to personal information
• Secure password storage (hashed) and time-limited sessions
• Vetting of operators handling personal information

If a security incident affects your personal information, we will notify you and the Information Regulator without undue delay, per POPIA s22.

11. Cookies

We use only essential session cookies required for the customer portal to function (Supabase auth). We do not use marketing or analytics cookies that track you across sites.

12. Children

Our services are intended for businesses. We do not knowingly collect personal information from children under 18. If you believe we have, please contact us and we will delete it.

13. Changes to this policy

We may update this policy when our practices change. Material changes will be notified to active customers by email and posted here. Continued use after the effective date constitutes acceptance.

14. Contact

Questions, requests or complaints relating to this policy may be sent to lew@themancave.africa or to Jbay Hout en Ys (Pty) Ltd at Port Elizabeth (Gqeberha), South Africa.