Oxi Logistics (Pty) Ltd (“OXI Logistics”, “we” or “us”) is responsible for the personal information described in this policy. Under South Africa’s Protection of Personal Information Act 4 of 2013 (POPIA) we are the “responsible party”. Under UK and European data protection law (the GDPR) we are the “controller”.
Our address is Erasmia, Farm Vlakplaats 354-Jr, Centurion, 0023, South Africa. You can email us at info@oxi-logistics.com or call 012 650 0403 (+27 12 650 0403 from outside South Africa).
Our Information Officer makes sure we follow POPIA and handles any request you make under this policy. You can reach them at info@oxi-logistics.com.
This policy covers our website, oxi-logistics.com, and the enquiries you send us through it, by email or by phone. By “personal information” we mean anything that identifies you or can be linked to you, such as your name, email address, phone number or the IP address your device uses on the internet.
Browsing our website. Our website is hosted by Cloudflare. Each time you open a page, Cloudflare processes your IP address, browser type, the page you asked for and your approximate location, worked out from your IP address. This is needed to deliver the page and protect the site, and Cloudflare keeps short-term records of these requests for security and traffic statistics. Our website uses only your country, to decide whether to run Google Analytics (section 4). Our server sets no cookies itself.
Fonts. Our typeface comes from Google Fonts, loaded by a small Google script. To fetch the font and the script, your browser sends your IP address and browser details to Google when a page loads. Google says these requests carry no cookies.
Customer reviews. The Google reviews on our home page are shown by a widget from Elfsight. It loads from Elfsight’s servers, which receive your IP address and browser details. Elfsight says it keeps these for 7 days to find and fix faults, and does not use them to track you for marketing. The reviews are public Google reviews, shown with each reviewer’s name, photo and words.
Google Analytics. Google Analytics records how our website is used, with cookies and details of your device and browser. Section 4 explains what it records and the choices you have. We do not run it for visitors in the UK, the European Economic Area (EEA) or Switzerland.
Our contact form. The form asks for your name, email address, phone number, the service you need, your time zone and your message. A Cloudflare Turnstile check runs on the form to tell people from bots. It looks at signals from your browser and connection, such as your IP address, and does not read what you type. Cloudflare also uses these signals to improve its own bot detection.
When you press send, our website emails your enquiry, through Cloudflare’s email service, to our team’s mailbox, which is hosted on Microsoft 365. The website itself keeps no copy. We reply by email, and if you go ahead we use your details to quote for and arrange your shipment.
Email and phone. The email and phone links on our site open your own apps. Emails reach our Microsoft 365 mailboxes, and we keep what you send us so that we can answer you.
What you need to give us. You can browse the site without giving us anything. To answer an enquiry we need your name and contact details, and the form sends only when every field is filled in. Analytics cookies are never needed to use the site.
The law lets us use personal information only for a stated purpose and on a lawful ground. This is how each use fits.
Answering your enquiry and preparing a quote. Your enquiry and contact details. Lawful ground: steps you asked us to take before a contract (POPIA section 11(1)(b)).
Delivering and protecting the website, and keeping bots off the form (Cloudflare, Turnstile). IP address, browser and connection details, country. Lawful ground: our legitimate interest in a secure, working website (section 11(1)(f)).
Showing our typeface and customer reviews (Google Fonts, Elfsight). IP address and browser details, and reviewers’ public names, photos and words. Lawful ground: our legitimate interest in presenting our site and what customers say about us (section 11(1)(f)).
Measuring how the site is used (Google Analytics). Pages, clicks, cookie identifiers, device and browser details, approximate location. Lawful ground: our legitimate interest in improving the site (section 11(1)(f)).
You can object at any time to any use based on our legitimate interests (section 9). Our website uses no advertising or remarketing cookies, we do not sell personal information, and we do not make decisions about you by automated means alone.
What Google Analytics records. We use Google Analytics 4 to understand how our website is used. It records the pages you visit, how far you scroll, clicks to other websites, file downloads, taps on our phone number and email address, and whether an enquiry was sent from the contact form, along with details of your device and browser and your approximate location. It never receives what you type into the form. Google says Google Analytics does not log or store IP addresses.
Our settings. We keep Google Analytics data for 14 months. Google signals is off, so Google Analytics does not use data from signed-in Google accounts to link your visits across devices, and our Google Analytics is not linked to any advertising account. Google also uses this information for its own purposes, as it explains in How Google uses information from sites or apps that use our services.
Visitors in the UK, the EEA and Switzerland. If Cloudflare places your connection in one of these countries, our website does not run Google Analytics, so no analytics cookies are set and nothing is sent to Google Analytics. As a backstop, Google’s consent settings on our site deny analytics cookies in those countries too.
Cookies. A cookie is a small file a website stores in your browser. These are the cookies used on our site:
_ga — set by Google Analytics. Gives your browser a random ID so that visits can be counted. Lasts 2 years.
_ga_11F7B1T82X — set by Google Analytics. Keeps track of your visit for our analytics. Lasts 2 years.
elfsight_viewed_recently — Elfsight says its reviews widget uses this cookie to stop one visit being counted more than once.
Your choices. Your browser settings let you block or delete cookies, and our site works without them. You can also stop Google Analytics on every website with Google’s opt-out browser add-on. Our website does not respond to browser “Do Not Track” signals, so please use these choices instead.
We share personal information with the people and companies below, for the reasons given:
the companies that run our systems: Cloudflare (website hosting, security and the contact-form emails), Microsoft (our email) and Google (analytics and fonts);
Elfsight, which shows our Google reviews;
Omni Creative Agency, which builds and looks after our website and has access to our website and analytics accounts;
if your shipment goes ahead, the importing agents and customs brokers who clear it, as our Terms and Conditions describe, and the authorities that issue the permits it needs;
anyone the law requires us to tell, such as a court or a regulator.
Each company has its own privacy policy: Cloudflare, Microsoft, Google and Elfsight.
Some of these companies store or process information outside South Africa. Cloudflare, Google and Microsoft operate worldwide, including in the United States and Europe, and Elfsight’s widget is delivered through Cloudflare’s worldwide network. If your shipment goes ahead, your details also go to the agents, brokers and authorities in the country it is going to.
Countries protect personal information to different standards. The UK and the countries of the EEA have data protection laws comparable to POPIA. The United States has no general federal privacy law of that kind. So we rely on these safeguards. Where a company has binding data-protection terms, or is subject to a law that gives adequate protection, we rely on that (POPIA section 72(1)(a)). Where we send your details abroad to answer your enquiry or carry out your shipment, the transfer is needed for steps you asked us to take or for our contract with you (section 72(1)(c)).
We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires. Then we delete it or remove anything that identifies you.
Enquiries that do not lead to a shipment, including emails: 2 years from our last contact.
Client records, including quotes, shipping and permit documents and correspondence: 5 years after your last shipment with us.
Tax records, including invoices and payment records: 5 years from the submission of the relevant tax return (Tax Administration Act 28 of 2011, section 29), or longer while an audit or objection is open.
Google Analytics data: 14 months.
Elfsight’s records of your IP address: 7 days.
Cloudflare’s request records: a short period, under Cloudflare’s own policy.
Cookies: as listed in section 4.
We take reasonable technical and organisational steps to protect personal information, and we limit access to the people and companies who need it for their work. If a security breach puts your information at risk, we will tell you and the Information Regulator as the law requires.
Wherever you live, you can:
ask whether we hold information about you. This is free. You can also ask for a copy, and for a list of the people or companies who have had access to it;
ask us to correct or delete it if it is wrong, out of date, incomplete, misleading or more than we need, or to delete records we are no longer allowed to keep. We will tell you what we have done, and if we cannot do it, why;
object to our use of your information based on our legitimate interests (POPIA section 11(3)). If you object, we stop unless the law allows us to continue, and we tell you why.
To use any of these rights, email our Information Officer at info@oxi-logistics.com. We will ask you to confirm your identity first. If a fee applies to a copy of your records, we will tell you in advance. You may also use the Information Regulator’s forms, but an email is enough.
Complaints. If you are unhappy with how we handle your information, please tell us first so that we can put it right. You also have the right to complain to the Information Regulator:
Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Phone: 010 023 5200 (+27 10 023 5200 from abroad); toll free in South Africa 0800 017 160
Website: inforegulator.org.za, where complaints can also be lodged through the Regulator’s eServices portal
Everything above applies to you, and the data protection law where you live adds the following.
Lawful bases. We rely on steps before a contract, and the contract itself (Article 6(1)(b)), for enquiries, quotes and shipments; on legal obligation (Article 6(1)(c)) for tax, export and permit records; and on our legitimate interests (Article 6(1)(f)) for keeping the website secure and working and for showing our typeface and reviews. We do not run Google Analytics for you.
Transfers. We are based in South Africa, which has no EU or UK adequacy decision. Where our providers move information onward, most use safeguards such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework, as set out in their own terms. You can ask us for details of these safeguards.
More rights. You also have the right to restrict our use of your information, and to receive it in a usable format or have it sent to someone else (data portability).
Your right to object. You may object at any time, on grounds relating to your situation, to our use of your information based on our legitimate interests. If you do, we will stop unless we have compelling legitimate grounds that override your interests, or need the information for a legal claim.
Complaints. You can complain to the data protection authority where you live or work: in the UK the Information Commissioner’s Office, in the EU the national authority on the European Data Protection Board’s list, and in Switzerland the Federal Data Protection and Information Commissioner.
The rights in section 9 are open to everyone, including our American customers. To review or correct the information we hold about you, email our Information Officer at info@oxi-logistics.com.
We do not let advertising companies collect information about your activity on our site, and our Google Analytics setup does not use Google signals or advertising features.
Our website and services are meant for adults. We do not knowingly collect information about children. If you think a child has sent us information, tell us and we will delete it.
We may update this policy when our website, our services or the law change. When we do, we will change the date at the top of this page.
Questions about this policy, or want to use your rights? Email our Information Officer at info@oxi-logistics.com, call 012 650 0403, or write to the Information Officer, Oxi Logistics (Pty) Ltd, Erasmia, Farm Vlakplaats 354-Jr, Centurion, 0023, South Africa.