Privacy Notice

This notice explains how YommySax ("we", "us", "our") handles personal information collected through this website, in particular through the booking enquiry form. It is written to meet South Africa's Protection of Personal Information Act (POPIA) and, for clients in the United Kingdom and European Union, the UK/EU General Data Protection Regulation (GDPR).

TODO(owner): confirm the legal entity name and, if trading as a registered business, the registration number to be named as the responsible party / data controller.

TODO(owner): effective date of this notice (for example, the date it is first published). Update this date whenever the notice changes.

When you submit a booking enquiry we collect the information you provide in the form. This typically includes your name, your email address, your phone or WhatsApp number, and details about your event: the event date, the event type, the venue or location, the expected guest count, and the package or service you are interested in.

We also record that you ticked the consent box on the enquiry form, together with the date and time that consent was given, so that we have a record of the permission you granted.

We do not ask for special or sensitive categories of personal information through this form, and you should not include any in the free-text fields.

We use your information to respond to your enquiry, to discuss and quote for your event, and to arrange and carry out a booking if you go ahead. We may also use your contact details to follow up on an enquiry you started.

Under POPIA, we process this information on the basis of your consent (given when you submit the form) and because it is necessary to take steps at your request before entering into, and then to perform, a booking agreement. Under the GDPR the equivalent bases are your consent, the performance of a contract (and pre-contract steps taken at your request), and our legitimate interest in responding to and managing enquiries for our services.

We only use your information for the purposes described here, or for a directly related purpose you would reasonably expect.

We keep enquiry and booking information only for as long as it is needed for the purposes above, and to meet any legal, accounting or tax obligations.

TODO(owner): set the exact retention periods. A sensible default to confirm with your attorney is: keep enquiries that do not become bookings for up to 12 months, and keep records relating to confirmed bookings for the period required by tax and accounting law (in South Africa this is commonly 5 years from the end of the relevant tax period). Confirm the final figures before publishing.

We do not sell your personal information. We share it only with service providers that help us operate, and only as needed:

Our email / SMTP provider, which transmits and stores the enquiry emails we receive and the replies we send.

Our website hosting provider, which runs the infrastructure this site is served from.

Analytics providers (Google and Meta) — but ONLY if you accepted cookies on this site. If you declined, these providers are not loaded and receive no information about your visit. See our Cookie Notice for details, and the "Cross-border transfers" section below.

TODO(owner): list the actual providers used (for example, the email/SMTP service and the hosting provider by name) so visitors can identify the operators who process their data.

We may also disclose information where we are required to do so by law, or to establish, exercise or defend legal claims.

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access and misuse. These include serving this site over an encrypted (HTTPS) connection, limiting who can access enquiry data, and relying on reputable providers for email and hosting.

No method of transmission or storage is completely secure, so while we work to protect your information we cannot guarantee absolute security.

YommySax performs internationally, and some of the providers we rely on (for example, our email and hosting services, and the analytics providers named above) may store or process personal information on servers outside South Africa, including in other countries.

Where information is transferred across borders, we take steps to ensure it continues to receive a level of protection consistent with POPIA and, for UK/EU clients, the GDPR — for example by using providers that offer appropriate safeguards and contractual protections.

TODO(owner): once the final providers are confirmed, note the regions where data is processed and the safeguard relied on (for example, provider data-processing terms and standard contractual clauses).

If you are in South Africa, POPIA gives you the right to ask us what personal information we hold about you and to request a copy of it; to ask us to correct information that is inaccurate; to ask us to delete or destroy information we no longer have a lawful reason to keep; and to object, on reasonable grounds, to our processing of your information.

You also have the right to complain to the Information Regulator of South Africa if you believe we have not handled your information lawfully. The Information Regulator can be contacted via its official website and the contact details it publishes there.

If you are in the United Kingdom or the European Union, you have the rights to access your personal information; to have inaccurate information rectified; to have your information erased in certain circumstances; to restrict our processing in certain circumstances; to data portability; and to object to processing.

Where we rely on your consent, you have the right to withdraw it at any time (this does not affect processing already carried out before withdrawal).

You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EU, the data protection authority in your country.

You can withdraw your consent to our use of your enquiry information at any time by contacting us using the details below. We will stop using your information for the purposes that relied on that consent, unless we have another lawful basis to continue (for example, to perform a booking you have already confirmed, or to meet a legal obligation).

To change or withdraw your cookie choice for analytics, see our Cookie Notice.

If you have questions about this notice, or wish to exercise any of your rights, please contact us using the contact details in the site footer in the interim.

TODO(owner): name the Information Officer (POPIA) and, if required, a representative/contact point for UK/EU clients, with a direct email address. Until that is set, the footer contact details above serve as the interim contact for privacy queries.