Shadowgate Properties (Pty) Ltd t/a CapeVend

Last updated [06/06/2026]   |   Version 1.0

This notice explains how we collect, use, share, store and protect your personal information, and what rights you have in relation to it. It is written to comply with the Protection of Personal Information Act 4 of 2013.

Contents

1. Introduction

2. Who we are

3. Who this notice applies to

4. Definitions

5. What personal information we collect

6. Why we process your personal information, and on what legal basis

7. Who we share your personal information with

8. Cookies and website analytics

9. Direct marketing

10. How long we keep your personal information

11. Your rights

12. How to exercise your rights

13. Complaints

14. Security safeguards

15. Security compromises

16. Unsolicited communications to us

17. Links to other websites

18. Changes to this notice

19. Contact us

Shadowgate Properties (Pty) Ltd, trading as CapeVend (“CapeVend”, “we”, “us”, “our”), respects your right to privacy. This notice explains how we handle personal information.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). Where relevant, we also comply with the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”), the Consumer Protection Act 68 of 2008 (“CPA”) and the Promotion of Access to Information Act 2 of 2000 (“PAIA”).

Please read this notice together with our Terms and Conditions and our PAIA Manual.

For the purposes of POPIA, the responsible party is:

Information Officer

Our Information Officer is responsible for compliance with POPIA and PAIA, and is your first point of contact for any privacy query, request or complaint.

• Website visitors — anyone browsing www.capevend.co.za

• Enquirers and prospective clients — people who contact us through our contact form, email, phone or WhatsApp

• Clients and site hosts — businesses, body corporates, schools and other premises where our vending machines are installed

• Machine users — people who buy from our vending machines, particularly using cashless payment

• Suppliers, contractors and service providers

• Job applicants and prospective employees

Personal information means information relating to an identifiable, living natural person, and where applicable an identifiable, existing juristic person. It includes names, contact details, identity numbers, location, online identifiers and correspondence.

Processing means anything done with personal information, including collecting, storing, using, sharing, updating and deleting it.

Data subject means the person to whom the personal information relates — that is, you.

Operator means a third party who processes personal information on our behalf, under contract.

5.1 Information you give us

5.2 Information collected automatically when you use our website

Our web server automatically records certain technical data in log files:

• IP address

• Browser type and version

• Operating system and device type

• Referring URL

• Pages visited, and the date and time of each request

We collect this to keep the website secure and functioning correctly, and to understand in aggregate how the site is used. We do not use these logs to identify you personally, and we do not combine them with other data sets for that purpose.

5.3 Information collected through our vending machines

• Cashless transaction data — the amount, date, time, machine identifier and product purchased. Card payments are processed by our third-party payment provider. We do not receive or store your full card number, CVV or PIN. We may receive a masked card reference, such as the last four digits, and an authorisation reference for reconciliation and refund purposes.

• Machine telemetry — stock levels, temperature, faults, uptime and sales volumes. This is machine data and is not linked to individual buyers.

• Refund and dispute correspondence — if you contact us about a failed vend or an incorrect charge, we collect the details you give us in order to investigate and refund you.

5.4 Cookies

See section 9.

5.5 CCTV

Where CapeVend operates cameras at or on a machine, footage is recorded for the prevention and investigation of theft, vandalism and fraud. Notices are displayed at the point of recording. Footage is retained for 7 days unless required for an investigation, insurance claim or legal proceedings.

5.6 Special personal information and children's information

We do not knowingly collect special personal information as defined in section 26 of POPIA, such as religious beliefs, race, health, biometrics, criminal behaviour or trade union membership, and we do not seek it.

Our website and services are not directed at children. We do not knowingly collect the personal information of a child — a person under 18 who is not legally competent to act without assistance — without the consent of a competent person. Where our machines are placed at schools or similar sites, we do not collect identifying information from learners; transactions are processed in the same anonymous or pseudonymous way as any other cashless purchase. If you believe we hold a child's personal information, contact our Information Officer and we will delete it.

Section 11 of POPIA permits processing on specific grounds. The table below sets out our purposes and the ground we rely on for each.

Where we rely on your consent, you may withdraw it at any time — see section 12.

We will not use your personal information for a purpose that is incompatible with the purpose for which it was collected, unless you consent or the law permits it.

We do not sell your personal information. We share it only where necessary, and only with:

• Payment providers and acquiring banks — to process and settle cashless transactions and refunds

• Vending telemetry and machine management platforms — to monitor stock, faults and sales

• IT, hosting, email and website service providers — to run our systems

• Accountants, auditors, bookkeepers and attorneys — for financial administration and legal advice

• Logistics and installation contractors — where they need site contact details to deliver or service a machine

• Insurers and loss adjusters — where a claim is made

• SARS, regulators, courts and law enforcement — where we are legally obliged to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim

• A purchaser or successor — in the event of a sale, merger or restructuring of our business

Each operator that processes personal information on our behalf is required, in terms of sections 20 and 21 of POPIA, to process it only on our instruction, to treat it as confidential, and to maintain appropriate security safeguards under a written contract.

Cookies are small text files placed on your device when you visit a website. We use:

• Strictly necessary cookies — required for the site to function, for security, and to remember your cookie choices. These cannot be switched off.

• Analytics cookies — used to understand, in aggregate, how visitors find and use the site so that we can improve it. These are placed only with your consent.

Analytics provider. We use [Matomo / ANALYTICS PROVIDER] for website analytics. IP addresses are anonymised before storage. Analytics data is [self-hosted on our own server / hosted by PROVIDER in COUNTRY] and is not sold or disclosed to third parties for their own purposes.

Managing cookies. You can accept or decline non-essential cookies through the banner shown when you first visit the site, and you can change your choice at any time via [LINK TO COOKIE SETTINGS]. You can also configure your browser to notify you about cookies, to reject them, or to delete them when you close the browser. Disabling cookies may limit some functionality of this website.

Third-party content. Where our website embeds content from third-party platforms, such as social media feeds or maps, those providers may set their own cookies and receive your IP address. Their processing is governed by their own privacy policies, not ours.

We will only send you electronic direct marketing — email, SMS or automated calls — if:

• you have given your consent, in the prescribed manner, in terms of section 69(1) of POPIA and section 45 of ECTA; or

• you are an existing customer, and we obtained your contact details in the course of a sale, and we are marketing our own similar products or services, and you were given a reasonable opportunity to object both at the time of collection and in every communication since — as permitted by section 69(3) of POPIA.

If you are not an existing customer, we may approach you once to request your consent, using the prescribed Form 4 under the POPIA Regulations. If you refuse, we will not approach you again.

You may opt out at any time, free of charge, by clicking the unsubscribe link in any marketing message or by emailing our Information Officer. We will action opt-outs promptly and will not require you to give a reason.

We keep personal information only for as long as is necessary for the purpose it was collected for, unless a law requires or permits a longer period, or you have consented to longer retention.

When the retention period ends, we destroy or delete the records in a manner that prevents their reconstruction in an intelligible form, or de-identify them permanently.

Under POPIA you have the right to:

• Be notified that your personal information is being collected, and that it has been accessed or acquired by an unauthorised person.

• Request access to the personal information we hold about you, and to be told who has had access to it. This is done through a PAIA request — see section 13. We may charge the prescribed PAIA fee, and will tell you the amount before processing the request.

• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, using Form 2 of the POPIA Regulations.

• Object to processing, on reasonable grounds, where we rely on legitimate interests or on the protection of a legitimate interest, using Form 1 of the POPIA Regulations.

• Object to direct marketing at any time, and to withdraw consent to it.

• Withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before we received your withdrawal, and may mean we can no longer provide certain services.

• Not be subject to a decision based solely on automated processing that results in legal consequences for you, or affects you to a substantial degree. We do not currently make decisions of this kind.

• Complain to the Information Regulator — see section 14.

• Institute civil proceedings regarding an alleged interference with the protection of your personal information.

Exercising these rights is free, except that the prescribed fee may apply to an access request under PAIA.

Send your request to our Information Officer at info@capevend.co.za, or by post to the address in section 2.

These forms are available from the Information Regulator's website at inforegulator.org.za, or we will send them to you on request.

We will need to verify your identity before acting on a request. We aim to respond within 30 days, or within the period prescribed by PAIA where that applies. If we cannot meet that timeframe, we will tell you why and give you a revised date.

If you are unhappy with how we have handled your personal information, please raise it with our Information Officer first — we would prefer the chance to resolve it directly.

You also have the right to complain to the Information Regulator at any time, using POPIA Form 5:

The Information Regulator (South Africa)

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

PO Box 31533, Braamfontein, Johannesburg, 2017

Telephone: 010 023 5200   |   Toll free: 0800 017 160

General enquiries: enquiries@inforegulator.org.za

POPIA complaints: POPIAComplaints@inforegulator.org.za

PAIA complaints: PAIAComplaints@inforegulator.org.za

Website: www.inforegulator.org.za

In terms of section 19 of POPIA, we secure the integrity and confidentiality of personal information in our possession by taking appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, and unlawful access or processing.

Our measures include:

• Encryption of data in transit using SSL/TLS across our website and payment flows

• Access controls, unique user accounts and the principle of least privilege

• Password policies and multi-factor authentication on key systems

• Regular software updates and patching

• Secure backups

• Written contracts with all operators, imposing equivalent security obligations

• Staff confidentiality undertakings and privacy awareness training

• Periodic review of our safeguards and of new risks

No transmission over the internet is completely secure. Email in particular can be intercepted. While we take reasonable steps to protect your information, we cannot guarantee absolute security, and you send information to us over the internet at your own risk.

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise, in terms of section 22 of POPIA. Our notification will describe the possible consequences, the measures we intend to take or have taken, what you can do to mitigate the possible adverse effects, and, if known, the identity of the unauthorised person.

We expressly prohibit the use of contact details published on this website for the purpose of sending unsolicited advertising or marketing material. We reserve the right to take legal steps against senders of unsolicited commercial communications.

Our website may link to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy notices before providing them with personal information.

We may update this notice from time to time to reflect changes in our operations or in the law. The current version is always available at www.capevend.co.za/privacy, and the date at the top of this document shows when it was last revised. Where a change materially affects how we process your personal information, we will bring it to your attention directly where reasonably possible.

Information Officer

Shadowgate Properties (Pty) Ltd t/a CapeVend

308 Donyo, Bougain Villas Estate, 1 Century Boulevard, Century City, Cape Town, 7447

Email: info@capevend.co.za

Telephone: +27 84 777 3058