CONSUMER DATA PROTECTION & PRIVACY POLICY
​
Entity Name: Bona LN Trading & Projects (Pty) Ltd Â
Trading As: Tweens & Tiny Tots Wellness and Hydro Â
Registration Number: 2018/042131/07 Â
Physical Address: Roma Street, Cosmo City, 2188, Gauteng, South Africa Â
Document Reference: POPIA-CDP Policy (v1.0) Â
--------------------------------------------------------------------------------
1. PURPOSE AND SCOPE
This Consumer Data Protection Policy governs the collection, usage, storage, sharing, and safeguarding of Personal Information by Bona LN Trading & Projects (Pty) Ltd, trading as Tweens & Tiny Tots Wellness and Hydro (hereinafter referred to as the "Company", "we", "us", or "our").Â
This policy is established in accordance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA"), the Promotion of Access to Information Act, No. 2 of 2000 ("PAIA"), and the Constitution of the Republic of South Africa, 1996. It applies to all personal information collected from natural persons (including minor children and their legal guardians) and juristic persons ("Data Subjects") interacting with our wellness and hydro facilities, digital platforms, or administrative services.
--------------------------------------------------------------------------------
2. KEY DEFINITIONS
* Data Subject: The person or legal entity to whom Personal Information relates.
* Personal Information: Information relating to an identifiable, living natural person, or an identifiable, existing juristic person.
* Special Personal Information: Information concerning health, biometric data, religion, ethnic origin, or information relating to minors.
* Responsible Party: The entity which determines the purpose of and means for processing Personal Information (i.e., Bona LN Trading & Projects (Pty) Ltd).
* Operator: A third party who processes personal information on behalf of the Responsible Party under a formal contract.
--------------------------------------------------------------------------------
3. HOW WE COLLECT PERSONAL INFORMATION
We collect information directly from Data Subjects (or their legally authorised representatives) through voluntary disclosure, in-person registration, online forms, and service interactions.
3.1 Information Collected Directly
* Identity Data: Names, surnames, identity/passport numbers, dates of birth, and relationship details (e.g., parent/guardian relation to a child).
* Contact Data: Physical addresses, email addresses, and contact phone numbers.
* Financial Data: Payment details, proof of payment, and billing addresses.
* Health & Wellness Data (Special Personal Information): Medical history, allergies, physical conditions, hydrotherapy suitability details, and emergency contact information.
3.2 Collection of Minors' Information
As a wellness facility servicing children and adolescents, we process Special Personal Information concerning minors (under 18 years of age). In accordance with Section 35 of POPIA, this information is ONLY processed where explicit written consent is granted by a parent or legal guardian.
--------------------------------------------------------------------------------
4. PURPOSE AND USE OF COLLECTED INFORMATION
In accordance with Section 13 of POPIA (Purpose Specification), personal information is collected solely for explicit, specified, and lawful purposes related to our business operations:
* Service Delivery: Scheduling appointments, conducting hydrotherapy and wellness treatments safely, and tailoring therapies to specific health conditions.
* Client Safety: Evaluating physical/medical readiness for hydrotherapy treatments to avoid harm.
* Administration & Billing: Processing bookings, invoicing, processing payments, and maintaining accounting records.
* Communication: Sending appointment reminders, service updates, or responding to client enquiries.
* Compliance & Legal Obligations: Fulfilling record-keeping duties prescribed by South African tax, accounting, and health statutes.
--------------------------------------------------------------------------------
5. STORAGE AND RETENTION OF DATA
5.1 Storage Protocols
Personal Information is retained in both physical (paper-based forms/intake cards) and digital formats:
* Physical Records: Stored in locked filing cabinets within secure administrative areas at our physical premises (Roma Street, Cosmo City, 2188).
* Digital Records: Stored on encrypted local databases and secure cloud platforms protected by multi-factor authentication and role-based access control.
5.2 Retention Schedule
Information is retained only for as long as necessary to achieve the purpose for which it was collected, or as required by law:
* Client Treatment Records: Retained for a minimum of 5 years from the last active service, in compliance with standard commercial record-keeping practices.
* Financial & Tax Records: Retained for 5 to 7 years in accordance with the Tax Administration Act, No. 28 of 2011.
* Destruction: Upon expiry of retention periods, physical documents are securely shredded, and digital data is permanently deleted or de-identified beyond recovery.
--------------------------------------------------------------------------------
6. DATA SECURITY SAFEGUARDS
In terms of Section 19 of POPIA, the Company implements appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorized destruction, or unlawful access to personal information:
* Technical Security: Use of firewalls, anti-malware software, data encryption standard protocols, and restricted system administrative permissions.
* Physical Safeguards: Controlled access to physical premises, lockable filing equipment, and clean-desk policies.
* Operator Contracts: Third-party vendors (e.g., IT providers, payment gateways) are bound by Operator Agreements that require compliance with POPIA security standards.
* Data Breach Notification: In the event of a security compromise, the Company will notify the Information Regulator and affected Data Subjects as required by Section 22 of POPIA.
--------------------------------------------------------------------------------
7. SHARING AND THIRD-PARTY DISCLOSURE
The Company does NOT sell, rent, or trade personal data to third parties. Data is only shared under the following conditions:
1. Service Providers: Operators assisting in IT infrastructure, accounting, or payment processing.
2. Legal Duty: When required by South African law, court order, or regulatory authorities.
3. Emergency Care: To medical personnel where immediate medical intervention is required for a client or minor.
--------------------------------------------------------------------------------
8. RIGHTS OF THE DATA SUBJECT
Data Subjects (or parents/guardians acting on behalf of minors) hold the following statutory rights under POPIA:
* Right of Access: Request confirmation and copies of personal information held by the Company.
* Right to Rectification: Request correction or updating of inaccurate, incomplete, or outdated information.
* Right to Erasure/Objection: Object to data processing or request destruction of data, provided no overarching legal duty requires its retention.
* Direct Marketing Control: Right to opt out of unsolicited marketing communications at any time.
--------------------------------------------------------------------------------
9. INFORMATION OFFICER & CONTACT DETAILS
To exercise any rights, submit enquiries, or lodge requests under POPIA, please contact our designated Information Officer:
Responsible Entity: Bona LN Trading & Projects (Pty) Ltd t/a Tweens & Tiny Tots Wellness and Hydro
Physical Address: Roma Street, Cosmo City, 2188, Gauteng
Designated Information Officer: The Director
Contact Email: info@bonalntradings.com
Contact Phone: 072 293 9231
​
You also have the right to contact the statutory authority directly:
The Information Regulator (South Africa)
Website: https://inforegulator.org.za/
General Enquiries: enquiries@inforegulator.org.za
POPIA Complaints: POPIAComplaints@inforegulator.org.za