POPIA Compliance Statement

Protection of Personal Information Act, 2013 (Act No. 4 of 2013)

Effective Date: December 5, 2024 | Last Updated: September 19, 2026 | Version: 1.1

1. Introduction

1.1 Purpose of This Statement

This POPIA Compliance Statement details how Fumanoa Travel Card ("Fumanoa," "we," "us," or "our"), a product operated by Kanvas Creative Solutions (registration number 2019/136304/07), complies with the Protection of Personal Information Act, 2013 ("POPIA" or "the Act"). This statement should be read in conjunction with our Privacy Policy and Terms & Conditions.

1.2 Our Commitment

Fumanoa is committed to:

  • Processing personal information lawfully, fairly, and transparently
  • Protecting the privacy rights of data subjects
  • Implementing appropriate security measures
  • Complying with all requirements of POPIA
  • Respecting and facilitating the exercise of data subject rights

1.3 Legislative Framework

POPIA regulates the processing of personal information in South Africa to:

  • Give effect to the constitutional right to privacy
  • Balance privacy rights with other rights and interests
  • Regulate the flow of personal information across borders
  • Promote responsible processing of personal information

2. Responsible Party Information

2.1 Responsible Party Details

As defined by POPIA Section 1, Kanvas Creative Solutions (registration number 2019/136304/07), trading as Fumanoa Travel Card, is the "responsible party" that determines the purpose of and means for processing personal information.

Legal Entity: Kanvas Creative Solutions (registration number 2019/136304/07)
Trading As: Fumanoa Travel Card
Address: 42 Heystrek Street, Rustenburg, North West, South Africa
Email: legal@fumanoa.com
Website: https://fumanoa.com

2.2 Information Officer

In accordance with POPIA Section 56, we have designated an Information Officer responsible for:

  • Ensuring POPIA compliance
  • Handling data subject requests
  • Liaising with the Information Regulator
  • Maintaining records of processing activities
  • Managing data breaches and incidents
  • Overseeing data protection practices

3. Personal Information We Process

3.1 Categories of Data Subjects

Category Description
Customers/Users Account holders, card purchasers, website visitors
Children Children under 18 (with parental consent)
Third Parties Individuals who scan QR codes, emergency contacts
Employees & Contractors Fumanoa employees and service providers

3.2 Categories of Personal Information

1

Identity Information

Full names, username, date of birth

2

Contact Information

Addresses, emails, phone numbers, social media

3

Financial Information

Payment methods, transaction history

4

Profile Content

Photos, descriptions, preferences

4. The Eight Conditions for Lawful Processing

POPIA establishes eight conditions that must be met for lawful processing of personal information. Fumanoa complies with each condition as detailed below.

1

Accountability

We take responsibility for processing personal information and ensuring compliance with all conditions.

2

Processing Limitation

We process information lawfully, reasonably, and only with consent or as permitted by law.

3

Purpose Specification

We collect information for specific, explicitly defined, and lawful purposes.

4

Further Processing Limitation

We don't use information for purposes incompatible with original collection.

5

Information Quality

We ensure information is complete, accurate, not misleading, and updated.

6

Openness

We maintain documentation and notify data subjects about processing.

7

Security Safeguards

We secure information using appropriate technical and organizational measures.

8

Data Subject Participation

We respect rights to access, correct, and object to processing of information.

5. Data Subject Rights

Right of Access

Request confirmation of processing and access to your information

Right to Correction

Correct inaccurate information and complete incomplete information

Right to Object

Object to processing based on legitimate interests or for marketing

Right to Deletion

Request deletion of information ("Right to be Forgotten")

5.1 Exercising Your Rights

How to Submit a Request:

  1. Email: legal@fumanoa.com
  2. Subject: "[Right Name] Request" (e.g., "Access Request")
  3. Include: Full name, username, email, specific request
  4. Provide identification if needed

5.2 Response Timeline

  • We acknowledge receipt within 48 hours
  • We process requests within 30 days
  • May extend 30 days for complex requests
  • We notify you of any extensions with reasons

6. Security Safeguards

6.1 Technical Safeguards

Encryption

  • SSL/TLS encryption for all data transmission
  • Password hashing using secure algorithms (bcrypt)
  • Encrypted storage for sensitive information
  • End-to-end encryption for payment data

Access Controls

  • Role-based access control (RBAC)
  • Multi-factor authentication for admin access
  • Strong password requirements
  • Regular access reviews and audits

6.2 Data Breach Response

Notification Obligations: If a security breach occurs, we will:

  • Notify the Information Regulator (if required)
  • Notify affected data subjects
  • Notify within reasonable time of becoming aware
  • Provide information about the breach and recommended actions

7. Direct Marketing Compliance

7.1 POPIA Section 69 Requirements

Opt-In Required: We do not send marketing communications without consent.

Consent must be:

  • Explicit and informed
  • Separate from other terms
  • Easy to withdraw

7.2 Easy Unsubscribe

  • Every marketing email includes unsubscribe link
  • One-click unsubscribe process
  • No login required to unsubscribe
  • Effective immediately (within 48 hours)

8. Complaints and Information Regulator

8.1 Internal Complaint Process

How to Complain: Email: legal@fumanoa.com
Subject: "Privacy Complaint"

Include: Your contact information, details of complaint, steps taken, desired outcome

8.2 Information Regulator Contact

Information Regulator (South Africa)

Physical Address: JD House, 27 Sitemens Street, Braamfontein, Johannesburg, 2001
Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
Email: inforeg@justice.gov.za
Website: https://www.justice.gov.za/inforeg/

9. Contact Information

General Inquiries

Email: legal@fumanoa.com
Subject: POPIA Inquiry
Response: Within 48 hours

Information Officer

Email: legal@fumanoa.com
Subject: Information Officer
Response: Within 5 business days

Data Breach Reports

Email: legal@fumanoa.com
Subject: URGENT - Data Breach
Response: Immediate acknowledgment

10. Acknowledgments

Our Commitment

Fumanoa Travel Card is committed to:

  • Full compliance with POPIA
  • Protecting data subject privacy
  • Transparency in processing activities
  • Respecting data subject rights
  • Continuous improvement of data protection practices

Our Accountability

We take responsibility for:

  • All processing activities
  • Processing by our operators
  • Compliance with all eight conditions
  • Implementation of appropriate safeguards
  • Prompt response to data subject requests
  • Cooperation with Information Regulator

Effective Date: December 5, 2024
Last Updated: September 19, 2026
Version: 1.1
Next Review Date: December 5, 2025

Fumanoa Travel Card
c/o Kanvas Creative Solutions (registration number 2019/136304/07)
42 Heystrek Street, Rustenburg, North West, South Africa
Email: legal@fumanoa.com
Website: https://fumanoa.com

Information Regulator (South Africa)
Email: inforeg@justice.gov.za
Website: https://www.justice.gov.za/inforeg/