1. Who we are
1.1 This notice explains how Omnitronix (Pty) Ltd, registered as K2025783241 (South Africa) (Pty) Ltd, registration number 2025/783241/07, of 60 6th Street, Linden, Johannesburg, 2195 ("Omnitronix", "we"), collects and uses personal information. We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA).
1.2 It applies to customers, prospective customers, suppliers, people who contact us, and visitors to omnipart.co.za and omnitronix.co.za. Under POPIA a company or other juristic person can also be a data subject, so this notice covers business customers and suppliers too.
1.3 Our Information Officer is Ethan Lowery, Director, registered with the Information Regulator under registration number 2026-068841. Contact the Information Officer at [email protected], with "Privacy" in the subject line, or on 011 568 9948.
2. What we collect
| WHO | WHAT WE COLLECT | WHERE IT COMES FROM |
|---|---|---|
| Online customers on omnipart.co.za | Name, company name, email, telephone, delivery and billing addresses, password (stored only as a one-way hash), order history, carts, parts lists, saved searches and stock or price alerts you set up, trade details such as a purchase order number or delivery instructions | From you, when you register, check out or use your account |
| Customers and prospective customers | Name, company name, contact person, telephone, email, delivery and billing address, registration and tax details for businesses, quotes, orders, invoices, payments and proofs of payment, returns and warranty claims, correspondence | From you, your staff and our own records |
| Account applicants | Company documents (CIPC registration, B-BBEE certificate or affidavit, tax compliance PIN, bank confirmation letter), names and identity numbers of directors or owners, trade references, credit limit requested, credit bureau results if you consent | From you, your referees and, with consent, a credit bureau |
| Suppliers | Company and contact details, bank account details, tax and B-BBEE details, purchase orders, invoices and payments | From the supplier |
| Website visitors | IP address, browser and device type, pages visited, the site that referred you, and what you search for in our catalogue | From your browser, automatically |
| Visitors who accept analytics | How you use the site, collected by Google Analytics and Microsoft Clarity, including Clarity session recordings and heatmaps in which the text you type is hidden | From your browser, only after you click "Accept analytics" (see OMN-LEG-009) |
| Email recipients | Whether you opened a link in an email we sent, and which one | From the tracked link you click |
| Anyone who contacts us | Name, contact details and what you tell us | From you |
2.1 We do not see or store your card number. Card payments are entered on the payment provider's own secure page.
2.2 We do not ask for special personal information (such as health, religion or biometrics) and we do not knowingly collect information about children. The shop is for adults buying vehicle and electrical parts.
2.3 A proof of payment or bank statement line can show the name and account of the person who paid. We use it only to match the payment and, if needed, to refund that account.
3. Why we use it
3.1 We use personal information only for these purposes, and on these lawful grounds under POPIA s11:
| PURPOSE | LAWFUL GROUND |
|---|---|
| Running your online account, taking and delivering orders, quoting, invoicing, handling returns and warranty claims | Carrying out a contract with you, or steps you asked for before one (s11(1)(b)) |
| Taking card payments, receiving and refunding payments, and preventing payment fraud | Contract, and our legitimate interest in protecting customers and ourselves from fraud (s11(1)(b) and (f)) |
| Booking couriers and sending tracking details | Contract (s11(1)(b)) |
| Stock, price and saved-search alerts you set up in your account | Your consent, which you withdraw by switching the alert off (s11(1)(a)) |
| Reminding you about a cart you left, and telling customers about similar parts and specials | Our legitimate interest in direct marketing to people who gave us their details while buying, with the right to opt out at checkout and in every message (s69(3)) |
| The newsletter | Your consent (s69(1)) |
| Deciding a credit account application and collecting overdue accounts | Contract, and your consent to a credit check (s11(1)(a) and (b)) |
| Keeping accounting, tax and company records | Legal obligation (s11(1)(c)) |
| Keeping quality system records, complaints and nonconformities | Our legitimate interest in supplying the right goods (s11(1)(f)) |
| Running and securing the websites, finding errors, and blocking attacks | Our legitimate interest (s11(1)(f)) |
| Website analytics and Clarity session recordings | Your consent, given in the cookie banner and withdrawn at any time under "Cookie settings" in the footer (s11(1)(a)) |
3.2 We send electronic marketing only to customers about similar goods, or to people who have agreed to receive it. You can opt out at checkout, and every marketing email has an unsubscribe link. We stop as soon as you ask (POPIA s69).
3.3 We do not make decisions about you based solely on automated processing, such as profiling, that have legal or similarly significant effects on you (POPIA s71). Our security services score traffic automatically to block attacks; if you are blocked by mistake, contact us.
4. Who we share it with
4.1 We share personal information only as needed for the purposes above. Service providers that process it for us are our operators under POPIA s20 and s21.
| RECIPIENT | WHAT THEY RECEIVE AND WHY | WHERE |
|---|---|---|
| MDS Collivery, and The Courier Guy and Fastway through Bob Go | Name, telephone, email, delivery address and parcel details, to deliver your order and handle claims | South Africa |
| NjiaPay, with its card processor Paystack | Order reference and amount, and the card and contact details you enter on their payment page, to take the payment | South Africa and other countries |
| Rackzar | Hosts the server in Johannesburg that runs omnipart.co.za and holds the shop's database and backups | South Africa |
| Randcore Development (Pty) Ltd | Runs the shop's server, our error monitoring (on Amazon Web Services in Cape Town) and Core Platform, our quoting, invoicing and accounting system | South Africa |
| Microsoft (Microsoft 365) | Our email, including order and account emails sent from [email protected], and our documents and intranet | South Africa and other countries |
| Cloudflare | Carries all traffic to omnipart.co.za and protects it from attacks; sees your IP address and the pages you request | Worldwide network, including the USA |
| Google (Google Analytics, Google Maps address search) | Analytics data, only after you accept analytics; the address text you type into the address search on the checkout form | USA |
| Microsoft (Clarity) | Session recordings and heatmaps with typed text hidden, only after you accept analytics | USA |
| Nedbank | To receive payments and make refunds | South Africa |
| Our accountant and tax practitioner, SARS and CIPC | To keep and file our accounts and tax returns as the law requires | South Africa |
| Manufacturers and suppliers | To assess a warranty claim or handle a recall, where we need to give your details | South Africa and the manufacturer's country |
| A credit bureau | Only for account applicants who consent, to check creditworthiness | South Africa |
| Attorneys and debt collectors | Only to collect an overdue account or defend a claim | South Africa |
4.2 Each operator may use the information only on our instructions and must keep it secure, under a written agreement or its own published data processing terms (POPIA s20 and s21).
4.3 We send our product catalogue to Google so that parts appear in Google Shopping. That feed holds product data only, never customer information.
4.4 We do not sell personal information.
5. Information sent outside South Africa
5.1 Cloudflare, Google, Microsoft (Clarity and parts of Microsoft 365) and our card processors may store or process information outside South Africa, mainly in the USA and the European Union.
5.2 We use these providers only because they are bound by data processing terms that give protection substantially similar to POPIA, including the European Union's standard contractual clauses, and because the transfer is needed to carry out our contract with you or you consented to it (POPIA s72(1)(a), (b) and (c)). Analytics and Clarity data leave South Africa only if you accept analytics.
6. How long we keep it
| RECORD | HOW LONG |
|---|---|
| Orders, quotes, invoices, payments, delivery and returns records | 7 years after the transaction (Companies Act s24 and Tax Administration Act s29) |
| Online account details | While the account is open. When you ask us to close it, we delete or anonymise it within 30 days, except the order records above |
| Carts that never became an order, and guest checkout details with no order | 30 days, then deleted automatically |
| Parts lists, saved searches and alerts | Until you delete them or close your account |
| Marketing contact details | Until you opt out. After that we keep only your email address and the opt-out date, so that we do not contact you again |
| Records of which email links were clicked | 24 months, then deleted automatically |
| Catalogue search records (search words and results, no name or IP address) | 12 months, then deleted automatically |
| Visitor records (IP address, pages, referring site) | 13 months, then deleted automatically |
| Web server logs | Rotated automatically by size, normally within weeks |
| Error reports | 90 days |
| Google Analytics | The period set in our Google Analytics account, no more than 14 months |
| Microsoft Clarity | Recordings for 30 days; heatmaps and summaries for up to 13 months, as Microsoft sets |
| Backups of the shop | Up to 8 weeks, encrypted |
| Credit account files | 7 years after the account is closed |
| Unsuccessful credit applications | 12 months after the decision |
| Privacy and access requests | 5 years, with our quality records |
6.1 After that, we delete or destroy the information, or remove what identifies you (POPIA s14).
7. How we protect it
7.1 We protect personal information with reasonable technical and organisational measures (POPIA s19): access is limited to the people at Omnitronix who need it, accounts use strong passwords and sign-in controls, information travels over encrypted connections, passwords are stored only as one-way hashes, backups are encrypted, and we never handle card numbers. Our controls follow our information security management system (ISO/IEC 27001:2022).
7.2 If we believe your personal information has been accessed or acquired by someone without authority, we tell the Information Regulator and you as soon as reasonably possible (POPIA s22).
7.3 We will never email you new banking details or ask you to pay a different account. See OMN-LEG-001 clause 5.
8. Your rights
8.1 You may:
(a) ask whether we hold personal information about you, and ask for a copy of it (POPIA s23);
(b) ask us to correct, update or delete information that is wrong, out of date, incomplete or that we may no longer keep (POPIA s24);
(c) object to processing based on our legitimate interest, and to direct marketing at any time (POPIA s11(3));
(d) withdraw a consent you gave, without affecting what we did before;
(e) complain to the Information Regulator.
8.2 If you have an account on omnipart.co.za, the "My personal data" page in your account lets you download your data and ask us to delete your account. You can also email the Information Officer at [email protected]. We may ask you to prove your identity first. We reply within 30 days. Requests for records are handled under our PAIA manual (OMN-LEG-006).
8.3 To stop marketing, use the marketing choice at checkout, click "unsubscribe" in any marketing email, or email us. To withdraw analytics consent, use "Cookie settings" in the website footer.
8.4 You may complain to the Information Regulator of South Africa: website inforegulator.org.za, complaints email [email protected]. We ask that you contact us first so that we can try to resolve it.
9. Cookies and analytics
9.1 Our Cookie and analytics notice (OMN-LEG-009) lists every cookie and tag on omnipart.co.za and explains the cookie banner. Cookies needed to run the shop are always on. Google Analytics and Microsoft Clarity load only after you click "Accept analytics".
10. Changes to this notice
10.1 We publish the current version of this notice on our websites, showing its revision and date. We change it when we add a system or service provider that holds personal information.
11. Related documents
- OMN-LEG-001 Terms and conditions of sale
- OMN-LEG-006 PAIA manual
- OMN-LEG-009 Cookie and analytics notice
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
Controlled copy of OMN-LEG-005 Rev B, held in the Omnitronix QMS. Revision date 12 Oct 2026.