Oxbow Office Equipment (Pty) Ltd, trading as Oxbow Office Technology (“Oxbow”, “we”, “us” or “our”) is committed to protecting the privacy and personal information of the businesses, representatives, and users who engage with us. This Privacy and Cookie Policy (this “Policy”) explains how we collect, use, share, store, and protect personal information, and how we use cookies and similar technologies, in the course of operating our business and providing our office technology, telecommunications, solar, security, and related solutions.
This Policy is issued in compliance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Promotion of Access to Information Act, 2 of 2000 (PAIA), the Electronic Communications and Transactions Act, 25 of 2002 (“ECTA”), the Consumer Protection Act, 68 of 2008 (where applicable), and the Regulation of Interception of Communications and Provision of Communication-Related Information Act, 70 of 2002 (“RICA”).
By engaging with Oxbow, including by visiting oxbowsa.co.za, submitting a form on our website, corresponding with us by email, telephone, or social media, or entering into a contract with us, you acknowledge that you have read and understood this Policy.
The Responsible Party (as defined in POPIA) for the processing of personal information described in this Policy is:
Oxbow operates through a head office and a network of franchise entities. Personal information collected by Oxbow may be processed by, or shared with, the following Oxbow entities for the purposes set out in this Policy:
Managing Director: Brett Furlong.
In accordance with section 55 of POPIA, Oxbow has appointed an Information Officer who is responsible for ensuring compliance with POPIA, including responding to data subject requests, liaising with the Information Regulator, and overseeing internal awareness and training. The contact details of the appointed Information Officer are as follows:
In the ordinary course of our business and through our website, we may collect and process the following categories of personal information relating to you or to representatives of your organisation:
Oxbow does not intentionally collect or process any “special personal information” as defined in section 26 of POPIA (including information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour). Should any such information be required for a specific lawful purpose, it will be collected only with your express written consent or where otherwise lawfully permitted.
Oxbow’s website and services are directed at businesses and adult representatives of businesses. We do not knowingly collect personal information from any person under the age of 18. If we become aware that personal information of a person under the age of 18 has been collected without the consent of a competent person, we will take reasonable steps to delete that information.
Oxbow collects personal information directly from you, and in certain limited circumstances from third parties such as referrers or publicly available business directories. The principal channels through which we collect personal information are:
All inbound and outbound telephone calls between you and Oxbow Office Technology are recorded for quality assurance, training, dispute resolution, and record-keeping purposes. Recordings are initially stored in secure cloud storage. When cloud storage capacity approaches its limit, recordings are transferred to Oxbow’s internal storage servers. All internal servers, including those holding call recordings, are backed up on a monthly basis.
Access to call recordings is restricted to authorised Oxbow personnel. Recordings are retained for as long as is reasonably necessary to fulfil the purposes set out above and in accordance with applicable South African legislation, including POPIA and RICA.
By engaging with Oxbow telephonically, you acknowledge that your call may be recorded. If you do not wish for your call to be recorded, please advise the agent at the start of the call so that an alternative communication channel can be arranged.
Oxbow processes personal information only where it has a lawful basis to do so under section 11 of POPIA. The purposes for which we process personal information, and the corresponding lawful basis, are set out below:
Oxbow may share your personal information with the following categories of recipients, strictly to the extent necessary for the purposes set out in this Policy:
Personal information may be shared between Oxbow Head Office and the Oxbow franchise entities (Oxbow Omega, Oxbow Accelerate, Oxbow Affinity, Oxbow Alpha, Oxbow Sigma, Oxbow Tek, and Oxbow Elevate) for the purposes of responding to enquiries, fulfilling contractual obligations, and providing ongoing support.
Oxbow makes use of the following third-party service providers (“Operators” under POPIA), who process personal information on our behalf and under written contract:
Oxbow may share your personal information with the following categories of third parties, strictly to the extent necessary to deliver the products and services you have requested:
All third parties with whom we share your personal information are required to handle that information in a manner consistent with this Policy and with POPIA. We do not sell your personal information to any third party, and we do not share your information for marketing purposes without your explicit consent.
Oxbow may disclose personal information where required to do so by law, court order, or regulatory authority, or where necessary to protect Oxbow’s lawful rights, property, or safety, or those of its employees, customers, or the public.
Oxbow is committed to ensuring that any cross-border transfer of personal information complies with section 72 of POPIA. The following cross-border transfers may take place:
Oxbow will not transfer your personal information to a third party in a foreign country unless one or more of the grounds set out in section 72 of POPIA is met. Where none of those grounds applies, Oxbow will obtain your prior consent before any such transfer takes place.
Oxbow retains personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The principal retention periods applied by Oxbow are as follows:
Oxbow retains customer records on our Customer Relationship Management (CRM) software for as long as is necessary to provide ongoing service, fulfil our contractual obligations, comply with legal and regulatory requirements, and resolve any disputes that may arise. Customer records remain stored on our CRM system until such time as they are formally deleted. You may request the deletion of your personal information at any time by contacting us at enquiries@oxbowsa.co.za, subject to any legal or contractual obligations that may require us to retain certain information for a defined period after the conclusion of our relationship.
Personal information of subscribers to our newsletter or other marketing mailing lists is retained until the subscriber unsubscribes, after which limited information is retained on a suppression list to ensure that the unsubscribe request continues to be respected.
Personal information submitted as part of a job application is retained for a maximum period of five (5) years from the date of submission, after which it is securely destroyed unless a longer retention period is required by law or consented to by the applicant.
Cookie data is retained in accordance with the individual lifespans set out in clause 12.3 below and is subject to a maximum retention period of 12 months.
Call recordings are retained for as long as is reasonably necessary to fulfil the purposes set out in clause 5.1, and thereafter are securely deleted or anonymised.
Records required to be retained under tax, accounting, or other legislation are retained for the minimum period prescribed by the relevant law.
Oxbow takes appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage, unauthorised destruction, and unlawful access or processing, as required by section 19 of POPIA. These measures include the following:
Access to personal information is controlled on a role-based basis. Access is granted only to staff whose roles require it for the performance of their duties:
All new staff receive a documented briefing on data handling responsibilities as part of onboarding, covering the basics of POPIA, password and device security, customer confidentiality, and the procedure for reporting a suspected data breach. A refresher is delivered to all staff annually.
Oxbow maintains a documented backup and disaster recovery procedure to ensure the continued availability and integrity of personal information in the event of a system failure, cyber incident, or other disruption. The current method is as follows: Personal information held in Oxbow’s core systems is backed up every 24 hours to a dedicated backup server hosted by Afrihost in South Africa. Backups are encrypted and access to them is restricted to authorised IT personnel. Because backups are taken on a 24-hour cycle, Oxbow’s recovery point objective (RPO) is up to 24 hours, and Oxbow applies a standard recovery time objective (RTO) aligned to its hosting provider’s restoration timeframes. The Oxbow IT function is responsible for maintaining, testing, and restoring backups.
Oxbow maintains a documented data breach response procedure that meets the requirements of section 22 of POPIA. The key elements of that procedure are as follows:
Oxbow’s website uses cookies and similar tracking technologies to operate the site, remember user preferences, measure usage, and (where you have consented) deliver relevant marketing. Cookie consent on the Oxbow website is managed via the Complianz consent management platform.
Cookies are small text files that are placed on your device when you visit a website. They allow the website to recognise your device, remember your preferences, and understand how the site is used. Oxbow also uses similar technologies such as web beacons, pixels, and local storage, which are referred to collectively as “cookies” in this Policy. Cookies may be session cookies, which are deleted when you close your browser, or persistent cookies, which remain on your device until they expire or are deleted.
The cookies used on oxbowsa.co.za fall into the following categories:
The specific cookies currently placed on oxbowsa.co.za, together with their category, provider, purpose, and lifespan, are set out in the table below. This inventory is maintained by Oxbow and is updated whenever the cookies used on the website change:
Cookie name Category Provider Purpose Lifespan/expiry [TO BE COMPLETED after site relaunch: add one row per cookie by running a Complianz cookie scan on the live oxbowsa.co.za, capturing cookie name, category, provider, purpose, and lifespan. Include at minimum the Complianz consent cookie and all Google Analytics / Google Ads cookies.]
Some cookies are placed by third parties that provide services on our behalf. In particular, Google (through Google Analytics and related services) may set cookies to measure website performance and the effectiveness of advertising, and our consent management provider, Complianz, sets a cookie to record your consent choices. These third parties process the resulting data in accordance with their own privacy policies. Where any of these cookies involves the transfer of personal information outside South Africa, the safeguards described in clause 8 (Cross-Border Transfers of Personal Information) apply.
You can withdraw or change your cookie consent at any time as follows: by clicking the persistent “Cookie Settings” link in the footer of oxbowsa.co.za, which reopens the Complianz consent banner and allows you to review, change, or withdraw your consent for each category of cookie. You may also block or delete cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the website.
Oxbow undertakes direct marketing only where lawfully permitted to do so. The principles applied to direct marketing are as follows:
Oxbow does not subject data subjects to any decisions based solely on automated processing within the meaning of section 71 of POPIA. No automated decision-making tools are used by Oxbow to make decisions that produce legal or similarly significant effects in respect of any data subject.
Subject to the conditions and exceptions set out in POPIA, you have the following rights in relation to your personal information:
Requests to exercise any of the above rights should be submitted in writing to the Information Officer at the following address: Information Officer:
Brett Furlong Email: brett@oxbowsa.co.za
Telephone: 083 388 0505
Oxbow will respond to your request within 30 calendar days of receipt, unless a longer period is required and reasonable in the circumstances, in which case we will notify you of the expected response time. Where required by POPIA, certain requests must be made using the prescribed forms (Form 1, Form 2, and Form 3 of the POPIA Regulations), which are available on the Information Regulator’s website.
If you are not satisfied with Oxbow’s handling of your personal information, you may lodge a complaint with the Information Regulator of South Africa at the following address:
Oxbow has prepared a manual in accordance with section 51 of the Promotion of Access to Information Act, 2 of 2000, setting out the records held by Oxbow and the procedure for requesting access to those records. A copy of the manual may be downloaded here, or a copy may be requested from the Information Officer at brett@oxbowsa.co.za.
Any questions about this Policy, or about Oxbow’s handling of personal information, may be directed to:
End of Privacy and Cookie Policy.
