Website Privacy Notice
How Safety Toolbox (Pty) Ltd processes personal information collected through its website
WEBSITE PRIVACY NOTICE
How the Company processes personal information collected through its website
| Document | SFT-PAIA-06 Website Privacy Notice |
|---|---|
| Responsible party | Safety Toolbox (Pty) Ltd, trading as Safety Toolbox, registration number 2026/639216/07 |
| Information Officer | Deon Venter, Director and Information Officer (Information Regulator registration 2026-064239) |
| Effective date | 20 August 2026 |
| Version | Rev 1, deployed from HRT-PAIA-06 v1.0 generic master. Review annually and whenever processing changes materially. |
1. Application
This notice applies to www.safetytoolbox.co.za, operated by Safety Toolbox (Pty) Ltd, trading as Safety Toolbox ("the Company"). It explains what personal information is collected when a person visits the site or uses a form on it, why it is collected, and what rights the visitor has under the Protection of Personal Information Act.
Where a visitor is also an employee, a customer or a supplier of the Company, the notice applicable to that relationship applies in addition to this one.
2. Responsible party and contact details
| The Company | Safety Toolbox (Pty) Ltd, trading as Safety Toolbox, registration number 2026/639216/07 |
|---|---|
| Website | www.safetytoolbox.co.za |
| Information Officer | Deon Venter, Director and Information Officer (Information Regulator registration 2026-064239) |
| training@safetytoolbox.co.za | |
| Telephone | +27 82 087 6297 |
| Physical address | Dainfern Square, 1st Floor, Cnr William Nicol Drive & Broadacres Avenue, Dainfern, Johannesburg, Gauteng, 2191 |
| Address for legal service of documents | Dainfern Square, 1st Floor, Cnr William Nicol Drive & Broadacres Avenue, Dainfern, Johannesburg, Gauteng, 2191 |
| Registration number | 2026/639216/07 |
| Date of this notice | 20 August 2026 |
3. Information collected
3.1 Information the visitor provides
Information submitted through a form on the site. The contact form on the Contact Us page collects the visitor's name, email address and message. The account registration and login forms, the checkout form and the course messaging facility collect the information described in section 3.3, which ordinarily includes name, email address, telephone number, the company the visitor represents, and whatever the visitor chooses to put in a message field.
The contact form also records the internet protocol address from which the form is submitted, and any approximate location derived from it. Both are stored with the submission, and the site is set to anonymise them one day after the submission is made.
Visitors are asked not to submit sensitive personal information through a website form. Where a process requires it, the Company will ask for it through a secure channel instead.
3.2 Information collected automatically
The web server records technical information for every visit, including the internet protocol address, the browser and device type, the pages viewed, the date and time, and the site the visitor came from. This information is used to keep the site available and secure and to understand how it is used.
| The site uses cookies, which are small files placed on the visitor's device. Strictly necessary cookies make the site work and cannot be switched off. Other cookies are used for keeping a visitor signed in and holding the contents of a shopping basket, remembering cookie preferences, and measuring how the site is used. Services used: Google Analytics and Google Search Console (through the Site Kit plugin), Google Tag Manager, the WPConsent cookie consent manager, the shop software's own order-attribution cookies, and embedded video players on certain lesson pages. Where the site uses cookies that are not strictly necessary, consent is obtained through the cookie banner before those cookies are set, and the visitor may change or withdraw that choice at any time using the cookie preferences control on the site. Most browsers also allow cookies to be blocked or deleted. Blocking all cookies may stop parts of the site working. |
|---|
3.3 Information collected when a course is bought and taken
The site is an online training store and learning platform. A person who buys a course creates, or is given, a user account, and from that point the Company holds more than website visit information.
Account and purchase information. Name, email address, the username and the encrypted password, billing name and billing address, the courses ordered, the amount paid, the date and status of the order, and the reference the payment gateway returns for the transaction. The Company does not receive, see or store card numbers, card expiry dates or card security codes. Those are entered on the payment gateway's own pages and stay with the gateway.
Learning information. Which courses a learner is enrolled in, which lessons and modules have been started and completed, the date and time of each completion, every assessment attempt and the answers given, the mark obtained on each attempt, whether the pass mark was reached, and the certificate issued on completion, including the certificate record number and the name and course title printed on it.
Messages. Where a learner uses the course messaging facility to ask a question, the message and the reply are stored on the site as a record attached to that learner and that course.
Correspondence generated by the platform. Order confirmations, enrolment and completion notifications and other course emails sent to the learner, and the delivery log kept by the site's mail plugin, which records the recipient address, the subject, the time of sending and whether the message was accepted for delivery.
Employer-purchased seats. Where an employer buys seats for its staff, the employer supplies the learner names and email addresses and the Company processes them to create the enrolments. The employer is told which of its learners completed the course and may be given a copy of the certificate, because that is the purpose for which the employer bought the training. Assessment answers and individual attempt-by-attempt marks are not routinely disclosed to the employer.
Information inherited with the site. This website was built on an existing installation, and that installation carried user accounts and certificate records created before Safety Toolbox (Pty) Ltd existed, the oldest dating to June 2018. Those records are held on the same footing as the rest, are not published or indexed, and are being reviewed so that anything the Company has no lawful reason to keep is deleted. A person who believes the site holds a record of theirs from that period may ask the Information Officer, using the contact details in this notice, what is held and ask for it to be deleted.
4. Purposes and lawful basis
| Purpose | What it involves | Lawful basis |
|---|---|---|
| Answering an enquiry | Responding to a message, quotation request or callback request, and the correspondence that follows | Steps preceding a contract, and legitimate interest |
| Running and securing the site | Hosting, maintenance, error diagnosis, protection against attacks and abuse | Legitimate interest |
| Understanding how the site is used | Aggregated statistics on visits, pages and referral sources | Consent where analytics cookies are used, otherwise legitimate interest |
| Newsletters and marketing | Sending marketing communications to a person who has subscribed or who is an existing customer, with an unsubscribe facility in every message | Consent, or legitimate interest for existing customers |
| Selling a course | Taking and processing an order, taking payment through the payment gateway, issuing the order confirmation and the invoice, and keeping the record of the transaction the law requires an online supplier to keep | Performance of the contract, and a legal obligation |
| Delivering the training | Creating the account and the enrolment, giving access to the lessons, recording progress, marking assessments and issuing the certificate | Performance of the contract |
| Answering a learner's question | Receiving and replying to a message sent through the course messaging facility | Performance of the contract, and legitimate interest |
| Proving that training took place | Keeping the enrolment, completion and certificate record so that a learner or an employer can later show the training was done | Legitimate interest, and a legal obligation where health and safety law requires the employer to keep the record |
| Refunds and disputes | Processing a cancellation or refund, removing the enrolment where a refund is made, and dealing with a query or complaint about a transaction | Performance of the contract, and a legal obligation |
| Employer-purchased seats | Creating enrolments from a list supplied by an employer and reporting completion back to that employer | Performance of the contract with the employer, and legitimate interest |
5. Sharing
Information is shared only with the parties that make the site and the training work, and with any authority where the law requires disclosure. Those parties are the website and email host, the payment gateway, the learning platform and store software running on the site, the transactional email service, and the analytics service. The Company does not sell information collected through the site and does not share it for anyone else's marketing.
Website and email hosting: the site and its mailboxes are hosted in a shared hosting environment operated by the Company's hosting provider, which necessarily has technical access to the site database and to mail passing through it.
Payments: card payments are processed by the Payfast payment gateway. The buyer is taken to the gateway to enter card details, and the gateway returns to the site only the outcome of the payment and a transaction reference. Card details are never in the Company's hands.
Course emails: order, enrolment and completion emails are sent through a transactional mail service configured on the site, which records the recipient address, subject and delivery outcome in a log kept on the site.
Analytics: aggregated usage statistics are produced by Google Analytics and Google Search Console. These are set only where the visitor has accepted analytics cookies.
Each of these providers processes on the Company's behalf and is bound to keep the information confidential and to use it only for the purpose it was given. Where a provider processes personal information outside South Africa, it is on the basis that the law of that country, or the contract with the provider, gives protection substantially similar to the Protection of Personal Information Act.
6. Links to other sites
The site may link to sites the Company does not control. This notice does not apply to those sites, and the Company is not responsible for how they handle personal information. Read the notice on the site being visited.
7. Children
The site is not directed at children, and the Company does not knowingly collect personal information from a child through it. Where the Company becomes aware that it has, the information is deleted unless a competent person consents or another ground in the Act applies.
Accounts on this site are intended for people of eighteen or older, because the training is workplace training bought by adults or by their employers. Where a course is bought for a person under eighteen, the Company relies on the consent of that person's competent person, which the buyer confirms by placing the order.
8. Retention and security
A submission made through the contact form is stored on the site for twelve months from the date it is made, so that the Company can answer the enquiry and deal with whatever follows from it. The internet protocol address stored with that submission, and any approximate location derived from it, are anonymised a day after the submission is made; the site is set to retain them for one day.
A copy of the same message also passes through the service that sends the site's email. That service keeps a delivery log recording the recipient address, the subject, the content of the message and whether it was delivered, and the log is deleted after fourteen days.
Enquiries and the correspondence arising from them are kept for twenty-four months from the last contact, unless a relationship arises, in which case the retention applicable to that relationship governs. Server logs are kept by the hosting provider for a limited period; the provider does not publish a fixed retention period for them. The Company applies appropriate and reasonable technical and organisational measures to protect information collected through the site, including a valid transport layer security certificate on every page that collects information.
Order, payment and invoice records are kept for the period the tax and company legislation requires, being at least five years from the end of the financial year to which they relate, and thereafter only where a dispute or a claim is still live.
Enrolment, completion, assessment and certificate records are kept indefinitely unless the learner asks for deletion and the Company has no lawful reason to keep them. The reason is that the point of the certificate is that it can be checked later: a learner may need to prove years afterwards that the training was done, and an employer may need the same proof for a health and safety file or an inspection.
Assessment attempt detail, meaning the individual answers given on each attempt, is kept for as long as the certificate it supports, so that a challenged result can be checked.
Messages sent through the course messaging facility are kept for twenty-four months from the last message in the exchange.
Account records for a person who has never bought a course and has no enrolment are deleted once the Company is satisfied there is no reason to keep them.
A learner who asks for deletion should understand what deletion costs them: deleting the enrolment and certificate record removes the Company's ability to confirm afterwards that the course was completed. The Company will say so before acting on the request.
9. Rights, requests and complaints
A visitor may ask what personal information the Company holds, ask for a copy, ask for correction or deletion, object to processing based on legitimate interest, withdraw consent including consent to cookies, and unsubscribe from marketing. Requests go to the Information Officer at the details in this notice.
Where a person asks the Company to erase the personal information it holds about them, the Company actions that request through the erasure facility built into the site. A contact-form submission whose email address matches the request is removed from the site when the request is actioned, and is not merely hidden from view.
A person may tell the Company at any time to stop sending marketing, and every marketing message carries an unsubscribe link. Marketing about the Company's own courses is sent only to a person who has asked for it or who has bought a course, and never to an address obtained from anywhere else.
A complaint may be lodged with the Information Regulator (South Africa) at POPIAComplaints@inforegulator.org.za or through www.inforegulator.org.za.
10. Changes to this notice
The Company may amend this notice. The current version is always the one published on the site, and the date below shows when it was last changed.
| Version | Date | Approved by | Change |
|---|---|---|---|
| Rev 0 | 20 August 2026 | Deon Venter, Director | Initial issue |
| Rev 1 | 20 August 2026 | Deon Venter, Director | Reissued on the Safety Toolbox letterhead; contact-form fields, the IP address stored with a submission, the retention periods and the erasure route restated to match the site. |
Related documents. Our PAIA Manual, published in terms of section 51 of the Promotion of Access to Information Act, 2000, explains what records the Company holds and how to ask for one. Our Terms of Sale and Website Terms of Use govern purchases made through this site.