MYTROX Sports Club, Johannesburg, South Africa, is the "responsible party" for your personal information under POPIA. Our Information Officer is Kerwin Marais — email kerwin@mytrox.co.za or WhatsApp +27 64 901 2116 for any privacy question, request or complaint.

• Identity and contact details: your name, email address, phone number, gender and sock size.
• Delivery details: your street address, suburb and postal code (Johannesburg only).
• Subscription details: your Mystery Box plan, status and pause/resume history.
• Order history: the items you ordered through our shops.
• Sign-in details: your email and, if you use "Sign in with Google", your Google name and email.
• Technical data: browser type, device and basic usage of the site.
• Payment references: payment status from iKhokha. We never see or store your card number or PIN.

We collect this information directly from you (section 12 of POPIA), except sign-in details from Google and payment status from iKhokha, which you authorise when you use those services. We do not collect "special personal information" (such as health, religion, race or biometric data) and ask only for what we need (minimality, section 10).

Your name, phone, email, sock size, gender and delivery address are required to process orders and deliver Mystery Box pairs. Providing them is voluntary, but if you choose not to, we cannot take your order or subscription. Marketing consent is always optional.

We process your information only for these specific purposes (sections 11 and 13 of POPIA):

• To take and deliver orders and manage your Mystery Box subscription — needed to conclude and perform our agreement with you.
• To send order confirmations, subscription notices and pause/cancel confirmations — needed to perform our agreement.
• To let you create and manage a profile — with your consent.
• To notify our team of new subscribers and pause requests — to run the service you asked for.
• To prevent fraud and keep the site secure — our legitimate interest.
• To keep records required by tax and consumer law — a legal obligation.

We will not use your information for a purpose that is not compatible with these (section 15). We do not make decisions about you based solely on automated processing (section 71).

In line with section 69 of POPIA, we will only send you marketing by email, SMS or WhatsApp if you have agreed to it, or if you are an existing customer and the marketing is about similar products. Every message will tell you how to opt out, and you can unsubscribe at any time, free of charge.

We share information only with operators who need it to run our service, under written agreements that require them to keep it confidential and secure (sections 20 and 21):

• iKhokha — payment processing.
• Google — sign-in identity, if you choose "Sign in with Google".
• Our hosting, database and email providers — to run the site and send transactional emails.
• WhatsApp (Meta) — when you choose to contact us or order over WhatsApp.
• Couriers or delivery staff — your name, phone and address, only to deliver your order.
• Authorities — only where the law requires it.

We never sell or rent your personal information.

Some providers (such as our cloud hosting, Google and WhatsApp) store data outside South Africa. Under section 72 of POPIA we only transfer information to parties bound by laws, binding corporate rules or agreements that give protection substantially similar to POPIA, or where the transfer is needed to perform our agreement with you.

In line with section 14, we keep profile and order records while your account is active and for 5 years after your last transaction (as required for tax records), then delete, destroy or de-identify them. Information not needed for legal records is deleted when you delete your profile.

We take appropriate technical and organisational measures (section 19): an encrypted, access-controlled cloud database, row-level access rules so customers can only see their own data, individual staff sign-ins, and payments handled entirely by iKhokha over encrypted connections.

If we believe your information has been accessed by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22.

You have the right to:

• be told that your information is being collected, and be notified of any breach;
• ask whether we hold information about you and request a copy (section 23);
• ask us to correct, update, delete or destroy your information (section 24);
• withdraw your consent at any time — this does not affect processing already done;
• object to processing based on legitimate interest, and to direct marketing at any time (section 11(3));
• not be subject to decisions based solely on automated processing (section 71);
• complain to the Information Regulator and to go to court (section 99).

You can delete your profile yourself in My profile → Danger zone, or email kerwin@mytrox.co.za. We may ask you to confirm your identity first, and we will respond within 30 days. Requests are free; for copies of records under the Promotion of Access to Information Act (PAIA), only the prescribed fees may apply.

If you are unhappy with how we handled your information, you may complain to:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: POPIAComplaints@inforegulator.org.za · General: enquiries@inforegulator.org.za
Website: www.inforegulator.org.za

This site is not aimed at children under 18. Under section 35 we do not process a child's information without the consent of a parent or guardian. If you believe a child gave us information, tell us and we will delete it.

We use only essential local storage on your device to keep your cart and sign-in session working. We do not use advertising or tracking cookies.

We may update this notice; the date at the top shows the current version. Material changes will be highlighted on the site or sent to you by email.