1. Introduction
TAPDX Tags respects the privacy of the people who visit our website, buy our products, participate in our promotions, communicate with us or otherwise interact with TAPDX.
This Privacy Policy explains what personal information we collect, why we collect it, how we use it, when it may be shared, how long we keep it, how we protect it and the rights available to you in relation to your personal information.
This Privacy Policy also serves as a privacy notice under the Protection of Personal Information Act 4 of 2013 (POPIA).
Privacy is not treated as blanket consent. Different information is processed for different purposes and on the basis appropriate to the particular activity.
This Privacy Policy should be read together with the other TAPDX policies and terms that apply to the particular service, order, promotion or interaction.
2. Who is responsible for your personal information
TAPDX Tags is operated by Iconic Connex (Pty) Ltd, which is the responsible party for personal information processed for the purposes described in this Privacy Policy where POPIA requires a responsible party to be identified.
Our business address is 9 Pebble Lake, Florin Road, Strubensvallei, Roodepoort, 1724.
Privacy and personal-information enquiries may be sent to hello@tapdxtags.com.
Throughout this Privacy Policy, references to TAPDX, TAPDX Tags, we, us or our refer to Iconic Connex (Pty) Ltd operating the TAPDX Tags business, where appropriate.
3. Who this Privacy Policy applies to
This Privacy Policy applies to personal information processed through or in connection with the TAPDX website and TAPDX business activities.
This includes information relating to people who browse the website, create or use an account, place an order, request or approve a custom or bulk order, join a waitlist, participate in a pre-order, join a limited release or activation, use a referral, receive or use a promotional benefit, submit a review, communicate with customer support, raise a complaint or dispute, attend or participate in a TAPDX event or workshop, or otherwise interact with TAPDX.
It may also apply to information relating to business contacts, suppliers, service providers and other people with whom TAPDX has a legitimate business relationship.
4. The personal information we may collect
The personal information TAPDX collects depends on how you interact with us.
When you place an order, create an account or communicate with TAPDX, we may collect information such as your name, email address, telephone number, billing or delivery details, order information, account information and communications with us.
Where a transaction requires payment, TAPDX may process information relating to the payment, including the amount, transaction status, payment reference and other information needed to identify and reconcile the transaction. Where payment credentials are submitted directly to a payment service provider, TAPDX does not necessarily receive the full card or account information provided to that service provider.
For custom, bulk or personalised orders, we may process information provided as part of the order, including design instructions, artwork, wording, destination web addresses, specifications, approvals, quantities, product selections, delivery information and communications relating to the order.
Where you participate in a waitlist, pre-order, collection, limited release, promotional campaign, activation, workshop, event, referral programme or other TAPDX initiative, we may process the information reasonably required to administer that activity.
If you submit a review, photograph, video, testimonial or other customer content, we may process the content you provide together with information reasonably required to associate it with the relevant customer interaction, order or campaign.
If you contact customer support, make a complaint or raise a dispute, we may keep the correspondence, supporting information, order details, internal notes and resolution history reasonably required to investigate and manage the matter.
We may also process technical information generated when the TAPDX website is used. Depending on the website function involved, this can include browser or session identifiers, device type, page path, source or referral information, campaign information, timestamps, security logs and other information required to operate, secure and improve the website.
5. How we collect personal information
Most personal information is collected directly from you when you provide it to TAPDX.
Information may also be generated when you use our website, place an order, make a payment, use a referral link, communicate with us or interact with a particular TAPDX feature.
In some circumstances we may receive information from service providers involved in a transaction or service, such as payment providers, delivery providers, technology providers or other businesses assisting TAPDX with the service requested.
Where a TAPDX promotion or activation is conducted with another business or partner, information may also be received through that interaction where this is appropriate to the particular offer and permitted by law.
If information is obtained from a source other than directly from you, TAPDX will handle that information in accordance with POPIA and the purpose for which it was obtained.
6. Why we process personal information
TAPDX processes personal information for legitimate and specific business purposes connected with operating TAPDX and providing products and services to customers.
These purposes include processing and fulfilling orders; administering accounts; processing and reconciling payments; arranging delivery; communicating about an order; handling pre-orders, custom orders and bulk orders; managing returns, Store Credit and other financial adjustments; administering referrals, rewards and promotions; managing waitlists, collections and launches; responding to customer enquiries; investigating complaints and disputes; providing customer support; protecting accounts and transactions; detecting technical problems or misuse; maintaining business and financial records; meeting legal and regulatory obligations; and improving the TAPDX website, products and customer experience.
Where TAPDX conducts optional website analytics, we use those analytics to understand matters such as which pages are useful, where customers experience difficulty, how people arrive at TAPDX, how website journeys perform and which acquisition routes result in orders.
We do not need every category of personal information for every purpose. Information should be used only where reasonably relevant to the purpose for which it is being processed.
7. The basis on which we process personal information
POPIA allows personal information to be processed on a number of lawful grounds.
Depending on the particular interaction, TAPDX may process personal information because it is necessary to enter into or perform an agreement with you, because the law requires or permits the processing, because you have given consent where consent is the appropriate basis, or because the processing is necessary to pursue a legitimate interest of TAPDX, a customer or another person in circumstances where that interest does not unjustifiably interfere with your privacy.
TAPDX does not treat your acceptance of this Privacy Policy as universal consent to every possible use of your information.
Where a particular activity requires specific consent, that consent will be dealt with separately.
8. Information we need in order to provide a service
Some personal information is optional and some is necessary for TAPDX to provide the service you have requested.
For example, we may need sufficient identity and contact information to communicate with you about an order, delivery information where physical delivery is required, transaction information to process or reconcile payment, and appropriate order details to manufacture, configure or supply a product.
If information that is reasonably necessary for a transaction is not provided, TAPDX may be unable to complete that transaction or provide the requested service.
Optional website analytics are different. A customer does not have to agree to optional analytics in order to shop, sign in, place an order or contact TAPDX.
9. Accounts, orders and transaction records
Where you create an account or place an order, TAPDX may maintain records reasonably required to operate the account and administer the customer relationship.
Order records may include the products ordered, amounts charged, discounts or promotional benefits applied, Store Credit used or issued, delivery information, transaction status, referral information associated with the order, support history and other information reasonably necessary to understand and administer the transaction.
Transaction records may need to be retained after an order has been completed where this is necessary for accounting, tax, consumer protection, fraud prevention, dispute resolution, legal compliance or another legitimate record-keeping purpose.
Deleting optional website analytics does not automatically delete the underlying order or transaction record.
10. Custom and bulk orders
Custom and bulk orders may require TAPDX to process more information than an ordinary Ready-to-Order purchase.
Depending on the order, this may include customer specifications, artwork, branding, design files, requested wording, destination web addresses, proofs, approvals, quantities, delivery details, invoicing information and communications about production.
TAPDX uses that information to assess, prepare, manufacture, fulfil, deliver and support the order and to maintain an appropriate record of the customer's approved requirements.
Customers should avoid placing unnecessary personal or confidential information inside artwork, destination information or other material submitted to TAPDX.
Where an order genuinely requires personal information relating to another person, the customer remains responsible for ensuring that they are entitled to provide that information to TAPDX.
11. Referrals, rewards and promotional benefits
TAPDX may process information required to operate referral programmes, rewards, promotional credits, activations and other promotional benefits.
For referrals, this can include a referral link or code, the relationship between the referral and a qualifying transaction, the customer account receiving a benefit, and information needed to prevent duplicate or artificial rewards.
Referral information is not automatically optional website analytics. Information necessary to recognise and administer an eligible referral may continue to be processed even if a customer declines optional website analytics.
TAPDX does not prescribe one universal retention period for all referral information. Referral records are retained only for as long as reasonably required to administer the referral, the relevant transaction, any associated reward and legitimate record-keeping requirements.
Information collected for one promotion will not automatically be treated as permission to use it for an unrelated purpose.
12. Waitlists, pre-orders, drops and activations
Where you join a waitlist, pre-order, limited release, Priority Access programme, activation or similar TAPDX initiative, we may use the information you provide to administer that specific activity.
For example, we may use your contact details to tell you when the relevant product or release becomes available, manage allocation, administer access, identify a qualifying activation participant or fulfil the purpose for which you joined.
Joining one TAPDX waitlist or campaign does not automatically mean that you have agreed to receive every future TAPDX marketing communication.
Where we want to use contact information for wider direct marketing, that use will be handled in accordance with the applicable marketing rules.
13. Reviews, photographs, videos and customer content
Where customers voluntarily submit reviews, photographs, videos, testimonials or other content, TAPDX may process that content for the purpose explained when it is submitted.
If TAPDX intends to publish customer content, use it in marketing or use it outside the original context in which it was supplied, we will rely on the permission, terms or other lawful basis applicable to that use.
A customer should not submit personal information about another person in public-facing content unless they are entitled to do so.
TAPDX may retain records needed to identify the order, campaign or qualifying action associated with a rewarded review or other customer contribution.
14. Website storage and optional analytics
The TAPDX website uses limited browser storage and website information for both necessary website functions and optional first-party analytics.
Necessary functions may include maintaining a secure session, keeping a customer signed in, protecting an account or transaction, maintaining checkout integrity and recognising an applicable referral.
Optional analytics are used to understand how people use the TAPDX website and how the website can be improved.
At launch, TAPDX uses first-party website analytics. We do not currently send TAPDX website analytics events to a separate third-party analytics platform such as Amplitude.
This is a description of the current launch implementation and is not a promise that TAPDX will never use another analytics provider. Any materially different analytics model introduced in future must first be assessed and our customer-facing privacy information updated where required.
More information about website storage and analytics choices is available in the TAPDX Tags Cookies and Website Tracking Policy.
15. What optional analytics may record
Where optional analytics are active, TAPDX may record information such as page views, browser sessions, page paths, acquisition source, campaign information, device category, interactions with certain calls to action, scroll depth, video interaction and similar website events used to understand the customer journey.
Optional analytics may use a browser or session identifier.
Although these identifiers are not the same as a customer's name, TAPDX does not describe all analytics information as permanently anonymous. If an analytics identifier is associated with a subsequent order, the relevant acquisition information may become linkable to that transaction.
TAPDX therefore treats linkable analytics information as personal information where POPIA requires it to be treated that way.
Optional analytics are used for TAPDX's own measurement and improvement purposes. At launch, TAPDX does not use this information to follow customers across unrelated websites, create third-party behavioural advertising profiles or change a customer's product price because of how that person browsed the TAPDX website.
16. Your optional analytics choice
When the TAPDX website asks about optional analytics, a customer may choose “That's fine” or “No thanks”.
Under the current implementation, optional counting may begin when a person arrives at the website unless that browser has already recorded a “No thanks” choice.
If you select “No thanks”, future optional analytics from that browser stop and the applicable optional analytics identifiers stored on that device are cleared. TAPDX does not deliberately recreate those optional identifiers for the purpose of bypassing that choice.
Selecting “No thanks” does not switch off necessary account, transaction, referral or security functions.
It also does not automatically and immediately erase every record that may already have reached TAPDX systems before the choice was made.
The website remembers the choice so that TAPDX does not repeatedly ask the same question. At launch, TAPDX does not promise a separate website preference centre for changing the saved choice.
Browser controls may allow you to clear stored website information. Doing so may remove the saved choice and may cause the website to ask again.
17. Analytics retention and de-identification
Ordinary detailed website-interaction records are generally subject to an approximately 90-day retention process.
Where detailed interaction data is no longer required, TAPDX may delete it or transform information into aggregated or appropriately de-identified information that is no longer reasonably required to identify an individual customer or browser.
Aggregated or appropriately de-identified information may be retained for longer where it is useful for understanding matters such as overall website traffic, page performance, acquisition sources, campaign performance and longer-term business trends.
Information that has legitimately become part of an order, referral, accounting, security, complaint or other transaction record may be subject to the retention requirements applicable to that record rather than being treated as ordinary stand-alone website analytics.
TAPDX will not keep customer-level information indefinitely merely because it may be technically possible to do so.
18. Direct marketing
TAPDX may send marketing communications where permitted by law.
Depending on the circumstances, this may be based on your consent or another basis specifically permitted under applicable law, including circumstances that apply to an existing customer relationship.
Where required, TAPDX will provide a reasonable opportunity to opt out of direct electronic marketing.
Opting out of marketing does not prevent TAPDX from sending communications that are reasonably necessary to administer an order, payment, delivery, account, complaint, security matter or other service you have requested.
Similarly, joining a waitlist, referral programme, activation or transaction does not automatically amount to unlimited permission for unrelated marketing.
20. We do not sell customer browsing histories
TAPDX does not sell customer browsing histories or optional website analytics as a business model.
We also do not treat disclosure to a payment provider, delivery provider, hosting provider or other service provider performing a genuine business function as though it were the sale of customer information.
If TAPDX's business model or use of personal information changes materially in future, the change must be assessed on its own facts and the privacy information updated where required.
21. Cross-border processing
Some of the technology, infrastructure or service providers used by TAPDX may process or store information outside South Africa.
Where personal information is transferred outside South Africa, TAPDX will handle the transfer in accordance with POPIA and will use an available lawful basis for the transfer together with appropriate safeguards where required.
The fact that a service provider operates internationally does not mean that the customer's information may be used without restriction. The information remains subject to the purpose for which TAPDX disclosed it and to the applicable legal and contractual protections.
22. Information security
TAPDX takes reasonable technical and organisational measures appropriate to the nature of the information we process and the risks associated with that processing.
These measures are intended to reduce risks such as unauthorised access, loss, misuse, alteration, disclosure or destruction of personal information.
No internet-based system can be represented as absolutely secure. TAPDX therefore does not promise that a security incident can never occur.
Where POPIA requires notification of a security compromise, TAPDX will take the steps required by law, including notification to the Information Regulator and affected people where applicable.
23. How long we keep personal information
TAPDX does not apply one arbitrary retention period to every category of information.
Information is retained for as long as reasonably required for the purpose for which it was collected or subsequently lawfully processed, or for a longer period where retention is authorised or required by law, contract, legitimate business record-keeping requirements or another lawful basis.
For example, an ordinary analytics event does not need to be retained for the same period as an order, invoice, tax record, complaint, Store Credit record or unresolved legal dispute.
When personal information is no longer required and there is no lawful reason to retain it, TAPDX will take reasonable steps to delete, destroy or appropriately de-identify it.
24. Accuracy of personal information
TAPDX will take reasonably practicable steps, having regard to the purpose for which information is used, to keep personal information complete, accurate, not misleading and updated where necessary.
Customers can assist by providing accurate order, contact and delivery information and by informing TAPDX when relevant account information changes.
A customer remains responsible for checking information such as custom wording, artwork, web addresses, specifications and delivery details where TAPDX asks the customer to review or approve them.
25. Your rights under POPIA
Subject to POPIA and any lawful limitations, you may ask TAPDX to confirm whether we hold personal information about you and may request access to personal information that we hold.
You may also request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and you may request the destruction or deletion of information where TAPDX is no longer authorised to retain it.
Where POPIA gives you the right to object to particular processing, you may exercise that right.
Where processing depends on your consent, you may withdraw that consent. Withdrawal does not retrospectively make processing that was lawful before withdrawal unlawful, and it does not necessarily affect processing that TAPDX may continue on another lawful basis.
You may also object to or opt out of direct marketing as provided by applicable law.
TAPDX may need to verify your identity before giving access to personal information or acting on a request. This is intended to prevent personal information from being disclosed or changed at the request of an unauthorised person.
26. Requests to correct or delete information
A request to correct or delete information does not automatically require TAPDX to erase every record connected with the customer.
For example, TAPDX may still need to keep transaction, accounting, tax, fraud-prevention, Store Credit, complaint or legal records where retention remains lawful and necessary.
Where only part of a record needs correction, TAPDX may correct that part while retaining the remainder where appropriate.
Where deletion is not legally available, TAPDX will consider whether another step, such as restricting unnecessary use or correcting the record, is appropriate.
Privacy requests may be submitted to hello@tapdxtags.com.
27. Complaints about personal information
If you believe TAPDX has handled your personal information incorrectly, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.
You also have the right to lodge a complaint with the Information Regulator (South Africa).
At the effective date of this Privacy Policy, the Information Regulator can be contacted at:
- Email: enquiries@inforegulator.org.za
- Telephone: 010 023 5200
- Website: inforegulator.org.za
The Information Regulator's contact information may change independently of TAPDX. Its official website should be consulted for current details.
28. Special personal information and children's information
TAPDX does not ordinarily need special personal information in order to sell standard TAPDX products, and customers should not provide sensitive information unnecessarily.
Where a particular TAPDX product, service or use case genuinely requires the processing of special personal information or information relating to a child, TAPDX will assess that processing separately and apply the additional requirements required by law before relying on that information.
The existence of a possible product use case does not itself authorise TAPDX to collect sensitive or children's information without the appropriate basis.
29. Automated processing
TAPDX may use automated systems to perform ordinary business functions such as applying a valid promotion, associating an eligible referral, processing checkout rules, detecting a duplicated technical event or generating transactional communications.
At launch, TAPDX does not use optional website analytics to make solely automated decisions about customers that produce significant legal effects, and it does not dynamically increase a customer's product price because of that customer's browsing behaviour.
If TAPDX later introduces materially different automated decision-making that requires additional disclosure or safeguards under POPIA, it will assess that processing before relying on it.
30. Links and third-party services
The TAPDX website may contain links to websites, platforms or services operated by other organisations.
Once you leave a TAPDX-controlled environment and interact directly with another organisation, that organisation may process personal information under its own privacy terms.
TAPDX is not responsible for an unrelated organisation's independent privacy practices merely because a link to that organisation appears on the TAPDX website.
This does not remove TAPDX's responsibility for personal information that TAPDX itself discloses to a service provider or other recipient.
31. Business changes
If TAPDX or Iconic Connex (Pty) Ltd undergoes a legitimate restructuring, investment, sale, merger, reorganisation or transfer of relevant business assets, personal information associated with the affected business may form part of that transaction where lawful and reasonably necessary.
Any recipient acquiring responsibility for that information will remain subject to applicable privacy and data-protection obligations.
A business transaction does not automatically permit customer information to be repurposed without regard to the purposes for which it was collected.
32. Changes to this Privacy Policy
TAPDX may update this Privacy Policy as the business, website, products, technology or legal requirements develop.
A change to this Privacy Policy does not by itself authorise a new form of personal-information processing where POPIA requires additional steps before that processing may begin.
Where a change is material to the way personal information is processed, TAPDX will update its privacy information and take any additional steps required by law.
The effective date displayed at the beginning of the Privacy Policy identifies the version currently published.
33. Contacting TAPDX about privacy
Questions, concerns and requests relating to this Privacy Policy or TAPDX's handling of personal information may be sent to:
- TAPDX Tags
- Operated by Iconic Connex (Pty) Ltd
- Email: hello@tapdxtags.com
- Business address: 9 Pebble Lake, Florin Road, Strubensvallei, Roodepoort, 1724
When making a privacy request, please provide enough information for TAPDX to understand and locate the relevant record. Do not send unnecessary sensitive information.
TAPDX may ask for reasonable verification before acting on a request where this is necessary to protect the information from unauthorised access.
The TAPDX privacy principle
TAPDX's approach is that personal information should be collected and used because there is a genuine customer, transaction, operational, security, legal or business purpose for doing so, and not merely because technology makes additional collection possible.
We aim to tell customers what we actually do, distinguish optional analytics from functions genuinely required to operate the service, retain identifiable information only while there is a justified reason for doing so, and keep our privacy practices aligned with the way the TAPDX website and business actually operate.