Last updated: 6 November 2026.
1. Who we are
Flagman (Pty) Ltd (“Flagman”, “we”, “us”) designs, prints and supplies branded gazebos, flags, banners, umbrellas and event furniture from our workshop at 32 Richard Road, Industria North, Randburg, 2092, South Africa.
We are the “responsible party” for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect when you use flagman.co.za, request a quote, place an order or contact us, why we collect it, who we share it with and the rights you have.
Information Officer: contact details
Email: sales@flagman.co.za (mark the subject “POPIA”)
Phone: 010 500 7333
Post: 32 Richard Road, Industria North, Randburg, 2092
2. What we collect
We only collect what we need to quote, produce, deliver and support your order.
- Contact and company details: name, company, email address, phone or WhatsApp number, delivery address and VAT number if you request a tax invoice.
- Order and quote details: the products, sizes, quantities and options you choose, the event or activation you describe, and your order history.
- Artwork: logos, images and design files you upload or send us for printing. These may contain your trademarks and brand assets, which remain yours.
- Payment information: we do not store card numbers. If you pay by card on the website, the payment is processed by a PCI DSS compliant payment provider, which handles your card details under its own security standards. For EFT we receive your bank’s payment reference only.
- Communications: emails, WhatsApp messages, phone notes and contact form submissions, so that we can answer you and keep a record of what was agreed.
- Website usage: IP address, browser and device type, pages viewed and how you arrived, collected through cookies and similar technologies described in section 6.
We do not knowingly collect information from children under 18. Our products and services are aimed at businesses and organisations.
3. Why we collect it and our lawful basis
| Purpose | Lawful basis under POPIA |
|---|---|
| Preparing quotes and mock-ups, producing and delivering your order, invoicing | Performance of a contract with you, or steps you asked us to take before a contract |
| Answering enquiries by email, phone, WhatsApp or web form | Your consent and our legitimate interest in responding to you |
| Tax invoices, accounting records and warranty records | Legal obligation (Companies Act, VAT Act, Consumer Protection Act) |
| Sending our monthly combos newsletter | Your consent, which you can withdraw at any time |
| Measuring and improving the website, and showing relevant advertising | Your consent given through the cookie notice, and our legitimate interest in running the site |
| Preventing fraud and securing the site | Our legitimate interest |
4. Who we share it with
We never sell personal information. We share it only with service providers (POPIA “operators”) who need it to deliver our service, under written terms that restrict how they use it:
- Couriers: The Courier Guy and Kargo receive your name, delivery address and phone number to deliver orders.
- Payments: PayFast (Pty) Ltd processes card payments.
- Hosting and email: our South African web host, and our email delivery service, process data on our behalf.
- Newsletter: Mailchimp (Intuit Inc., USA) stores subscriber email addresses if you join our list.
- Analytics and advertising: Google (Analytics, Tag Manager, Ads) and Meta Platforms (Facebook and Instagram pixel) receive usage data through cookies, as described in section 6.
- Professional advisers and authorities: accountants, auditors, lawyers, SARS or a court where the law requires it.
Some of these providers are outside South Africa. Where that happens we rely on the provider’s contractual commitments to protect your information to a standard that is at least equivalent to POPIA, as section 72 of POPIA requires.
5. How long we keep it
- Quotes you do not accept: 12 months, then deleted.
- Orders, invoices and payment records: 5 years after the tax year of the transaction, as required by the Tax Administration Act.
- Artwork files: kept for as long as you are a customer so that repeat orders print consistently, and deleted 24 months after your last order unless you ask us to delete them sooner.
- Newsletter data: until you unsubscribe.
- Website analytics: Google Analytics data is retained for 14 months.
6. Cookies
Cookies are small files placed on your device. We use:
- Necessary cookies that make the shop work: WooCommerce cart and session cookies (
woocommerce_cart_hash,woocommerce_items_in_cart,wp_woocommerce_session_*) and the LiteSpeed cache cookie. These cannot be switched off. - Analytics cookies from Google Analytics 4 (
_ga,_ga_*) loaded through Google Tag Manager, which tell us which pages are used and where visitors come from. Data is aggregated and IP addresses are anonymised. - Advertising cookies from Meta (
_fbp) and Google Ads, which allow us to measure and show relevant advertising on those platforms.
You can accept or decline non-essential cookies in the notice shown on your first visit, and change your choice at any time through the “Cookie settings” link in the footer. You can also block cookies in your browser; the cart and checkout may then not work. Google’s privacy policy is at policies.google.com/privacy and Meta’s at facebook.com/privacy/policy.
7. How we protect it
The site is served over HTTPS. Access to order data is limited to staff who need it, protected by individual logins and two-factor authentication where available. Card data never touches our servers. Artwork is stored on access-controlled storage. We review access and backups regularly. If a security compromise affects your personal information we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.
8. Your rights
Under POPIA you may, free of charge in most cases:
- ask whether we hold personal information about you and request a copy (we respond within a reasonable time and in any case within 30 days);
- ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
- object to processing based on our legitimate interests, and object to direct marketing at any time;
- withdraw consent where processing is based on consent, without affecting what was done before;
- complain to the Information Regulator.
To exercise these rights, email sales@flagman.co.za with “POPIA” in the subject or write to our Information Officer at the address above. We may ask you to confirm your identity first. Requests for access to records are handled under our PAIA manual, available on request.
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za
9. Direct marketing
We send marketing emails and WhatsApp messages only to people who have opted in, or to existing customers about similar products as section 69 of POPIA allows. Every message includes a way to opt out, and we act on opt-outs within 7 days.
10. Changes to this policy
We will post any changes on this page and update the date at the top. If a change materially affects how we use your information we will tell existing customers by email.