Privacy Policy

Chemsys (Pty) Ltd ("Chemsys", "we", "us") is the Responsible Party for the processing of your personal information as defined in the Protection of Personal Information Act, 2013 ("POPIA"). Our registered place of business is Sandton, Johannesburg, Gauteng, South Africa.

• Identity & contact details: name, work email, telephone number.
• Business details: company name, VAT number, trade references, expected order volume.
• Account data: login credentials and account role (B2B customer or administrator).
• Transaction data: orders placed, quantities, packaging preferences and collection details.
• Technical data: cookies and essential session data required to operate the portal.

• To perform the B2B onboarding, verification and account approval process.
• To fulfil and manage wholesale and white-label orders (contractual necessity).
• To operate secure, role-based access to the ordering portal.
• To comply with legal, tax and regulatory obligations.
• For legitimate business interests such as fraud prevention and service improvement.

Where processing relies on your consent (for example, non-essential cookies or marketing communications), you may withdraw that consent at any time by contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We do not sell your personal information. We may share it with trusted Operators (service providers) who process data on our behalf under written agreements, and with authorities where required by law. All Operators are bound to maintain confidentiality and appropriate security measures.

Where personal information is transferred outside South Africa, we ensure the recipient is subject to laws, binding rules or agreements that provide an adequate level of protection consistent with POPIA.

We retain personal information only for as long as necessary to fulfil the purposes described above, or as required by applicable law (including tax and company legislation). When no longer required, information is securely deleted or de-identified.

We apply appropriate, reasonable technical and organisational measures to protect personal information against loss, unauthorised access and misuse, including access controls, role-based permissions and account lock controls.

• To be notified that your information is being collected or has been accessed.
• To request access to the personal information we hold about you.
• To request correction, updating or deletion of your information.
• To object to processing and to lodge a complaint with the Regulator.

You have the right to lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — email POPIAComplaints@inforegulator.org.za.