Legal
POPIA requests
Last updated: 5 October 2026
How Hello Brand complies with the Protection of Personal Information Act 4 of 2013 (POPIA), and how you can see, correct or delete your personal information, object to its use or withdraw consent.
Our commitment
Hello Brand processes personal information only for lawful, specific and clear purposes, and applies POPIA's eight conditions for lawful processing to this website, our services and the campaigns we run on Hello Brand OS. We do not sell personal information, and we share it only where the law requires, where this notice allows, or where it is needed to deliver a service you asked for.
This notice covers personal information Hello Brand processes as a responsible party. Hello Brand OS is built on Social Wiiv's platform, and Social Wiiv processes platform data on our behalf as our operator; its POPIA Compliance notice (socialwiiv.com/POPIA-Compliance.html) covers platform-level processing.
Accountability
We take responsibility for compliance and have an Information Officer under section 55 of POPIA.
Only what is needed
We collect only information that is adequate, relevant and not excessive for its purpose.
Your rights
You may ask to see, correct, delete or stop the use of your information at any time.
Responsible party
Hello Brand (Pty) Ltd
Registration number 2021/518544/07
Address: Woodstock Foundry, 170 Albert Road, Woodstock, Cape Town, 7915
[email protected] · 021 569 7123 ext. 233
www.hellobrand.co.za
Information Officer (section 55)
Information Officer: Baron Marshall (Social Wiiv)
They oversee our POPIA compliance, handle requests and deal with the Information Regulator. Reach them at [email protected].
What we collect (section 18)
We collect personal information from you directly, through campaigns on the platform, and in limited cases from other sources where the law allows.
Identity and contact
Name, email address, phone number, organisation and role, and venue details you give us in an enquiry or quote request.
Usage and technical
IP address, browser type and pages requested, recorded by the server that hosts this site. On the platform, analytics data only with consent.
Campaign and event
Details you share on a campaign sign-up screen, such as your cellphone number, answers and participation.
Transactions
Merchandise quotes and orders. This website takes no card payments.
Engagement and rewards
Points, rewards, redemptions and game scores in campaigns on the platform.
Security and access
Platform login credentials (stored as one-way hashes), access logs, QR scan events and session tokens.
Purpose and lawful basis
Every use of personal information rests on at least one condition for lawful processing in Chapter 3 of POPIA, recorded for each activity.
01 Consent
Freely given, specific, informed and unambiguous. You may withdraw it at any time.
02 Contract
Needed to perform a contract with you, or to take steps you asked for before one, such as a proposal or quote.
03 Legitimate interest
Security, fraud prevention, improving our services and talking to existing clients, where your rights do not override it.
04 Legal obligation
Needed to comply with South African law, such as tax law and court orders.
05 Our operator
Social Wiiv processes platform data for us only on our documented instructions, under a written operator agreement.
Your rights
Access
Ask whether we hold information about you, and get a copy.
Correction
Have wrong, out-of-date or misleading information corrected.
Deletion
Have information deleted that we are no longer allowed to keep.
Objection
Object to processing, including for direct marketing.
Withdraw consent
Withdraw consent at any time, without affecting what was done before.
Complain
Complain to the Information Regulator.
Opt out
Stop marketing messages through the unsubscribe link or by asking us.
Be told of a breach
Be notified if your information is compromised (section 22).
How to make a request
- Prepare it. Include your name, contact details, the information concerned, the right you want to use (access, correction, deletion, objection or other) and, if you can, the dates and the campaign or service involved.
- Send it to our Information Officer with the form below, or by email to [email protected] with the subject “POPIA request”.
- Confirm who you are. We may ask for proof of identity, such as a copy of your ID or passport. We use it only to verify you and do not keep it afterwards.
- Hear back. We aim to acknowledge your request within 3 business days and reply in full within 30 days. If we need longer, we will tell you within those 30 days and give a new date, no more than 30 days later.
- Outcome. If we cannot do what you ask, we will explain why in writing. You may then complain to the Information Regulator.
Campaign information
For information you gave on a campaign, we will pass your request to the brand or venue that ran it and to Social Wiiv where needed. Formal requests for access to records under PAIA are explained in our PAIA manual.
Request form
There is a problem
Online submissions aren't switched on yet. Nothing was sent. Email your request to [email protected] with the subject “POPIA request”. Your answers are still in the form.
Keeping and deleting information (section 14)
We keep personal information only as long as its purpose needs or the law requires. Then we securely delete it or remove anything that identifies you.
| Information | Kept for | Basis |
|---|---|---|
| Financial and billing records | 5 years after the transaction | Legal obligation (SARS) |
| Employee records | Length of employment plus 3 years | Legal obligation (BCEA) |
| Marketing contacts | Until you opt out, or 3 years without contact | Consent |
| Enquiries and quote requests | As long as the conversation and any work that follows | Contract or legitimate interest |
Who processes it for us (section 21)
Written operator agreements
Everyone who processes personal information for us, including Social Wiiv, is bound by a written agreement with duties no less strict than ours under POPIA.
Outside South Africa
Where information leaves South Africa, the recipient country must give adequate protection or be bound by agreements, as section 72 requires. Social Wiiv hosts client databases in South Africa, on Microsoft Azure.
Payments
This website takes no card payments. Merchandise is quoted first and nothing is charged online.
Never sold
We do not sell, rent or trade personal information. Marketing goes only from us, or for a client under a contract, with consent.
Security safeguards (section 19)
We take reasonable technical and organisational measures against loss, damage, unauthorised destruction and unlawful access. On the platform, Social Wiiv applies TLS 1.3 encryption in transit, AES-256 at rest, role-based access, continuous monitoring and staff training, as set out in its Trust Center (socialwiiv.com/Security-Trust.html).
If personal information is compromised, we will notify the Information Regulator and the people affected, as section 22 of POPIA requires.
Complaints (section 74)
If you are not happy with how we handled your information or your request, you may complain to the Information Regulator. Please contact our Information Officer first, so we can try to put it right.
Information Regulator (South Africa)
P.O. Box 31533, Braamfontein, Johannesburg, 2017
[email protected]
inforegulator.org.za
Related documents
- Privacy notice: how we collect, use and protect personal information.
- PAIA manual: how to request access to records we hold.
- Cookie notice: cookies and browser storage.
- Social Wiiv Trust Center (socialwiiv.com/Security-Trust.html): the platform's security safeguards.