Privacy & Cookie Policy.

1. Introduction

Oxbow Office Equipment (Pty) Ltd, trading as Oxbow Office Technology (“Oxbow”, “we”, “us” or “our”) is committed to protecting the privacy and personal information of the businesses, representatives, and users who engage with us. This Privacy and Cookie Policy (this “Policy”) explains how we collect, use, share, store, and protect personal information, and how we use cookies and similar technologies, in the course of operating our business and providing our office technology, telecommunications, solar, security, and related solutions. This Policy is issued in compliance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), the Promotion of Access to Information Act, 2 of 2000  (PAIA), the Electronic Communications and Transactions Act, 25 of 2002 (“ECTA”), the Consumer Protection Act, 68 of 2008 (where applicable), and the Regulation of Interception of Communications and Provision of Communication-Related Information Act, 70 of 2002 (“RICA”). By engaging with Oxbow, including by visiting oxbowsa.co.za, submitting a form on our website, corresponding with us by email, telephone, or social media, or entering into a contract with us, you acknowledge that you have read and understood this Policy.

2. Responsible Party

The Responsible Party (as defined in POPIA) for the processing of personal information described in this Policy is:

• Legal name: Oxbow Office Equipment (Pty) Ltd, trading as Oxbow Office Technology
• Registration number: 2001/024237/07
• Registered address: 1B Summer Greens Drive, Century Gate, Century City, 7441, Western Cape, South Africa
• Telephone: 086 106 9269 / 021 835 1400
• Email: enquiries@oxbowsa.co.za
• Website: oxbowsa.co.za

Oxbow operates through a head office and a network of franchise entities. Personal information collected by Oxbow may be processed by, or shared with, the following Oxbow entities for the purposes set out in this Policy:

• Oxbow Head Office
• Oxbow Omega (Directors: Wayne Lategan and Andrew Tully)
• Oxbow Affinity (Director: Darren Brandt)
• Oxbow Alpha (Director: Jaryd Richmond)
• Oxbow Tek (Director: Donovan Gouden)
• Oxbow Accelerate (Director: Russel Hamsley)
• Oxbow Sigma (Director: Brandon Phillips)
• Oxbow Elevate (Director: Eugen Volmer)

Managing Director: Brett Furlong.

3. Information Officer and Deputy Information Officers

In accordance with section 55 of POPIA, Oxbow has appointed an Information Officer who is responsible for ensuring compliance with POPIA, including responding to data subject requests, liaising with the Information Regulator, and overseeing internal awareness and training. The contact details of the appointed Information Officer are as follows:

• Name: Brett Furlong
• Designation: Managing Director
• Email: brett@oxbowsa.co.za
• Telephone: 083 388 0505
• Information Regulator registration: Registered with the Information Regulator of South Africa on 8 July 2026 under registration number 2026-061452. Oxbow has not appointed any Deputy Information Officers at this time. The Information Officer performs these functions:
• Deputy Information Officer(s): None have been appointed at this time; the Information Officer performs these functions.

4. Categories of Personal Information We Collect

In the ordinary course of our business and through our website, we may collect and process the following categories of personal information relating to you or to representatives of your organisation:

• Full name and surname
• Email address
• Telephone number(s)
• Company name and your role within that company
• Information submitted via our website contact, enquiry, and quotation forms
• Information submitted via newsletter and mailing list subscriptions
• Stated areas of interest in our products or solutions (for example, print, telecoms, solar, security)
• Cookies, website analytics data, IP address, browser type, device identifiers, and similar online identifiers
• Recordings of telephone calls between you and Oxbow (see clause 5 below)
• Correspondence and communications between you and Oxbow, including by email and social media

4.1 Special Personal Information

Oxbow does not intentionally collect or process any “special personal information” as defined in section 26 of POPIA (including information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour). Should any such information be required for a specific lawful purpose, it will be collected only with your express written consent or where otherwise lawfully permitted.

4.2 Children’s Personal Information

Oxbow’s website and services are directed at businesses and adult representatives of businesses. We do not knowingly collect personal information from any person under the age of 18. If we become aware that personal information of a person under the age of 18 has been collected without the consent of a competent person, we will take reasonable steps to delete that information.

5. How We Collect Personal Information

Oxbow collects personal information directly from you, and in certain limited circumstances from third parties such as referrers or publicly available business directories. The principal channels through which we collect personal information are:

• Submissions made through forms hosted on oxbowsa.co.za (including contact, enquiry, quotation, and newsletter forms);
• Email enquiries and correspondence sent to our published email addresses;
• Telephone calls placed to and received from our published telephone numbers (see clause 5.1 below);
• Cookies, web beacons, and analytics tools deployed on our website (see clause 13);
• Direct messages, comments, lead forms, and enquiries received via our official social media channels;
• Information provided during in-person meetings, site surveys, installations, and service calls.

5.1 Recording of Telephone Calls

All inbound and outbound telephone calls between you and Oxbow Office Technology are recorded for quality assurance, training, dispute resolution, and record-keeping purposes. Recordings are initially stored in secure cloud storage. When cloud storage capacity approaches its limit, recordings are transferred to Oxbow’s internal storage servers. All internal servers, including those holding call recordings, are backed up on a monthly basis. Access to call recordings is restricted to authorised Oxbow personnel. Recordings are retained for as long as is reasonably necessary to fulfil the purposes set out above and in accordance with applicable South African legislation, including POPIA and RICA. By engaging with Oxbow telephonically, you acknowledge that your call may be recorded. If you do not wish for your call to be recorded, please advise the agent at the start of the call so that an alternative communication channel can be arranged.

6. Purpose and Lawful Basis for Processing

Oxbow processes personal information only where it has a lawful basis to do so under section 11 of POPIA. The purposes for which we process personal information, and the corresponding lawful basis, are set out below:

• To respond to enquiries and pre-contractual requests, on the lawful basis of section 11(1)(b) of POPIA (steps taken in preparation for entering into a contract);
• To prepare and issue sales quotations, on the lawful basis of section 11(1)(b) of POPIA;
• To deliver and support the products, services, and solutions we have agreed to provide, on the lawful basis of section 11(1)(b) of POPIA (performance of a contract);
• To send marketing emails, newsletters, and other direct marketing communications, on the lawful basis of section 11(1)(a) of POPIA (consent);
• To improve our website, products, and services, including through analytics and user testing, on the lawful basis of section 11(1)(f) of POPIA (legitimate interests);
• To comply with applicable tax, accounting, and other legal or regulatory obligations, on the lawful basis of section 11(1)(c) of POPIA;
• To pursue and recover debts owed to Oxbow, on the lawful basis of section 11(1)(f) of POPIA (legitimate interests);
• To route enquiries to the appropriate Oxbow franchise based on geographic location or area of interest, on the lawful basis of section 11(1)(f) of POPIA (legitimate interests).

7. Recipients of Personal Information

Oxbow may share your personal information with the following categories of recipients, strictly to the extent necessary for the purposes set out in this Policy:

7.1 Internal Oxbow Entities

Personal information may be shared between Oxbow Head Office and the Oxbow franchise entities (Oxbow Omega, Oxbow Accelerate, Oxbow Affinity, Oxbow Alpha, Oxbow Sigma, Oxbow Tek, and Oxbow Elevate) for the purposes of responding to enquiries, fulfilling contractual obligations, and providing ongoing support.

7.2 Service Providers and Operators

Oxbow makes use of the following third-party service providers (“Operators” under POPIA), who process personal information on our behalf and under written contract:

• Afrihost – website hosting and email infrastructure;
• Formidable Forms – website form submission plugin;
• Zendesk – customer relationship management (CRM) and customer support software used to manage leads, customers, support tickets, and related records;
• Google LLC – website analytics, advertising measurement, and related cloud services;
• Complianz – website cookie consent management plugin.

7.3 Suppliers, Delivery, and Logistics Partners

Oxbow may share your personal information with the following categories of third parties, strictly to the extent necessary to deliver the products and services you have requested:

• Suppliers: We share relevant customer information with certain product suppliers operating across Cape Town, Johannesburg, and Durban. This is to facilitate the sourcing, configuration, and delivery of the goods and solutions you have purchased or are enquiring about.
• Delivery and logistics service providers: We share information such as your name, delivery address, and contact details with delivery partners operating across Cape Town, Johannesburg, and Durban so that goods can be transported to you efficiently and securely.

All third parties with whom we share your personal information are required to handle that information in a manner consistent with this Policy and with POPIA. We do not sell your personal information to any third party, and we do not share your information for marketing purposes without your explicit consent.

7.4 Legal and Regulatory Disclosures

Oxbow may disclose personal information where required to do so by law, court order, or regulatory authority, or where necessary to protect Oxbow’s lawful rights, property, or safety, or those of its employees, customers, or the public.

8. Cross-Border Transfers of Personal Information

Oxbow is committed to ensuring that any cross-border transfer of personal information complies with section 72 of POPIA. The following cross-border transfers may take place:

• Personal information processed via Google products and services may be stored and processed by Google LLC in data centres located outside South Africa, primarily in the United States of America and the European Union. Google is a participant in the EU-US Data Privacy Framework and its contracts include Standard Contractual Clauses, providing protections that are substantially similar to those afforded under POPIA.
• Personal information processed via our Zendesk CRM and customer support platform is hosted on Amazon Web Services infrastructure and may be stored and processed in data centres located outside South Africa, including in the United States and other regions in which Zendesk operates data centres (such as the European Economic Area, Australia, or Japan), under contractual safeguards, including Standard Contractual Clauses, that are substantially similar to those required by POPIA.

Oxbow will not transfer your personal information to a third party in a foreign country unless one or more of the grounds set out in section 72 of POPIA is met. Where none of those grounds applies, Oxbow will obtain your prior consent before any such transfer takes place.

9. Retention of Personal Information

Oxbow retains personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. The principal retention periods applied by Oxbow are as follows:

9.1 Customer Records (CRM)

Oxbow retains customer records on our Customer Relationship Management (CRM) software for as long as is necessary to provide ongoing service, fulfil our contractual obligations, comply with legal and regulatory requirements, and resolve any disputes that may arise. Customer records remain stored on our CRM system until such time as they are formally deleted. You may request the deletion of your personal information at any time by contacting us at enquiries@oxbowsa.co.za, subject to any legal or contractual obligations that may require us to retain certain information for a defined period after the conclusion of our relationship.

9.2 Marketing and Newsletter Subscribers

Personal information of subscribers to our newsletter or other marketing mailing lists is retained until the subscriber unsubscribes, after which limited information is retained on a suppression list to ensure that the unsubscribe request continues to be respected.

9.3 Job Applications

Personal information submitted as part of a job application is retained for a maximum period of five (5) years from the date of submission, after which it is securely destroyed unless a longer retention period is required by law or consented to by the applicant.

9.4 Cookie Data

Cookie data is retained in accordance with the individual lifespans set out in clause 13 below and is subject to a maximum retention period of 12 months.

9.5 Call Recordings

Call recordings are retained for as long as is reasonably necessary to fulfil the purposes set out in clause 5.1, and thereafter are securely deleted or anonymised.

9.6 General Records

Records required to be retained under tax, accounting, or other legislation are retained for the minimum period prescribed by the relevant law.

10. Security Measures

Oxbow takes appropriate, reasonable technical and organisational measures to safeguard personal information against loss, damage, unauthorised destruction, and unlawful access or processing, as required by section 19 of POPIA. These measures include the following:

10.1 Technical Security

• The Oxbow website is served over HTTPS and is secured by a valid SSL/TLS certificate;
• Databases and stored passwords are encrypted at rest;
• Individual login credentials are required for all systems holding personal information, with two-factor authentication enabled on systems that hold customer personal information;
• Vendor security assessments are performed periodically to confirm that operators and sub-processors maintain measures compliant with applicable legislation.

10.2 Physical Storage Locations

• Website data hosted by Afrihost is physically stored in data centres located in South Africa;
• Data processed via Google services is physically stored in data centres located in the United States of America and the European Union, subject to the safeguards described in clause 8;
• Data processed via the Zendesk CRM and customer support platform is hosted on Amazon Web Services infrastructure and may be stored in data centres located outside South Africa, including in the United States, the European Economic Area, Australia, or Japan.

10.3 Role-Based Access Controls

Access to personal information is controlled on a role-based basis. Access is granted only to staff whose roles require it for the performance of their duties:

• CRM (customer and lead records): Sales has full access to leads and customer records relevant to their accounts. Marketing has read access to contact details and marketing preferences. Finance has full access to billing-relevant fields. Installation and service teams have access to customer records relevant to their open jobs. Leadership has full access for oversight purposes.
• Website-submitted data (contact forms, enquiry forms, quote requests): Marketing and Sales only.
• Social media submitted data (DMs, comments, lead forms): Marketing and Sales only.
• Payroll and HR records: HR and Finance only. Access is removed promptly when a staff member leaves Oxbow or changes role.

10.4 Staff Training and Awareness

All new staff receive a documented briefing on data handling responsibilities as part of onboarding, covering the basics of POPIA, password and device security, customer confidentiality, and the procedure for reporting a suspected data breach. A refresher is delivered to all staff annually.

10.5 Backups and Disaster Recovery

Oxbow maintains a documented backup and disaster recovery procedure to ensure the continued availability and integrity of personal information in the event of a system failure, cyber incident, or other disruption. The current method is as follows: Personal information held in Oxbow’s core systems is backed up every 24 hours to a dedicated backup server hosted by Afrihost in South Africa. Backups are encrypted and access to them is restricted to authorised IT personnel. Because backups are taken on a 24-hour cycle, Oxbow’s recovery point objective (RPO) is up to 24 hours, and Oxbow applies a standard recovery time objective (RTO) aligned to its hosting provider’s restoration timeframes. The Oxbow IT function is responsible for maintaining, testing, and restoring backups.

11. Data Breach Response

Oxbow maintains a documented data breach response procedure that meets the requirements of section 22 of POPIA. The key elements of that procedure are as follows:

• Detection and reporting: Oxbow’s IT function is responsible for the detection, escalation, and initial containment of any suspected security compromise. All staff are required to report any suspected breach to IT or to the Information Officer immediately.
• Severity assessment: Following a report, an initial assessment of the severity, scope, and likely impact of the suspected compromise is conducted within a standard window of 48 hours.
• Notification to data subjects: Where a breach is reasonably believed to have resulted in unauthorised access to or acquisition of personal information, affected data subjects will be notified in writing, in accordance with the form and content required by section 22 of POPIA.
• Notification to the Information Regulator: The Information Regulator will be notified using its prescribed reporting form, which is available on the Regulator’s website and is bookmarked for prompt access by the Information Officer.

12. Cookies and Tracking Technologies

Oxbow’s website uses cookies and similar tracking technologies to operate the site, remember user preferences, measure usage, and (where you have consented) deliver relevant marketing. Cookie consent on the Oxbow website is managed via the Complianz consent management platform.

12.1 What Cookies Are

Cookies are small text files that are placed on your device when you visit a website. They allow the website to recognise your device, remember your preferences, and understand how the site is used. Oxbow also uses similar technologies such as web beacons, pixels, and local storage, which are referred to collectively as “cookies” in this Policy. Cookies may be session cookies, which are deleted when you close your browser, or persistent cookies, which remain on your device until they expire or are deleted.

12.2 Categories of Cookies We Use

The cookies used on oxbowsa.co.za fall into the following categories:

• Strictly necessary cookies: these are required for the website to function and cannot be switched off in our systems. They are usually set only in response to actions made by you, such as submitting a form or setting your privacy preferences. No consent is required for these cookies.
• Functional cookies: these enable enhanced functionality and personalisation, such as remembering your preferences. If you do not allow these cookies, some parts of the website may not function properly.
• Analytics and performance cookies: these allow us to count visits and traffic sources so that we can measure and improve the performance of our site, for example through Google Analytics. They help us understand which pages are the most and least popular.
• Advertising and targeting cookies: these may be set through our site by our advertising partners to build a profile of your interests and show you relevant advertising on other sites. They do not store directly identifying information but are based on uniquely identifying your browser and device. Analytics, functional, and advertising cookies are only placed where you have given your consent through our cookie consent banner. You may withdraw that consent at any time (see clause 12.5).

12.3 Cookies Currently in Use

The specific cookies currently placed on oxbowsa.co.za, together with their category, provider, purpose, and lifespan, are set out in the table below. This inventory is maintained by Oxbow and is updated whenever the cookies used on the website change: Cookie name Category Provider Purpose Lifespan/expiry [TO BE COMPLETED after site relaunch: add one row per cookie by running a Complianz cookie scan on the live oxbowsa.co.za, capturing cookie name, category, provider, purpose, and lifespan. Include at minimum the Complianz consent cookie and all Google Analytics / Google Ads cookies.]

12.4 Cookies Set by Third Parties

Some cookies are placed by third parties that provide services on our behalf. In particular, Google (through Google Analytics and related services) may set cookies to measure website performance and the effectiveness of advertising, and our consent management provider, Complianz, sets a cookie to record your consent choices. These third parties process the resulting data in accordance with their own privacy policies. Where any of these cookies involves the transfer of personal information outside South Africa, the safeguards described in clause 8 (Cross-Border Transfers of Personal Information) apply.

12.5 Managing and Withdrawing Cookie Consent

You can withdraw or change your cookie consent at any time as follows: by clicking the persistent “Cookie Settings” link in the footer of oxbowsa.co.za, which reopens the Complianz consent banner and allows you to review, change, or withdraw your consent for each category of cookie. You may also block or delete cookies through your browser settings. Please note that disabling certain cookies may impair the functionality of the website.

13. Direct Marketing

Oxbow undertakes direct marketing only where lawfully permitted to do so. The principles applied to direct marketing are as follows:

• Consent is obtained from users via newsletter sign-up forms and through the cookie consent banner and Terms and Conditions notification displayed on the website. Each form of consent is presented separately so that consent is unbundled in respect of each distinct purpose.
• An unsubscribe mechanism is included in every marketing email sent by Oxbow, allowing recipients to opt out of further marketing communications at any time.
• Existing customers may, where permitted under section 69(3) of POPIA, receive marketing relating to similar products and services, subject to their right to opt out at any time.
• Records of consent are securely retained at the Zendesk CRM.

14. Automated Decision-Making

Oxbow does not subject data subjects to any decisions based solely on automated processing within the meaning of section 71 of POPIA. No automated decision-making tools are used by Oxbow to make decisions that produce legal or similarly significant effects in respect of any data subject.

15. Your Rights as a Data Subject

Subject to the conditions and exceptions set out in POPIA, you have the following rights in relation to your personal information:

• Right to be notified: you have the right to be informed when your personal information is being collected, and this Policy serves as that notification;
• Right to access: you have the right to request confirmation of whether we hold personal information about you and to request a copy of that information;
• Right to correction or deletion: you have the right to request that we correct inaccurate, irrelevant, or out-of-date personal information, or that we delete personal information which we have no lawful reason to retain;
• Right to object to processing: you have the right to object, on reasonable grounds, to the processing of your personal information, including for direct marketing purposes. If you object to direct marketing, we will stop sending you direct marketing communications without delay;
• Right to object to automated decision-making: you have the right to object to any decision made about you solely by automated means and to request that a person reviews that decision;
• Right to lodge a complaint: if you believe that we have handled your personal information unlawfully, you have the right to lodge a complaint with the Information Regulator of South Africa (see clause 16).

15.1 How to Exercise Your Rights

Requests to exercise any of the above rights should be submitted in writing to the Information Officer at the following address: Information Officer: Brett Furlong Email: brett@oxbowsa.co.za Telephone: 083 388 0505 Oxbow will respond to your request within 30 calendar days of receipt, unless a longer period is required and reasonable in the circumstances, in which case we will notify you of the expected response time. Where required by POPIA, certain requests must be made using the prescribed forms (Form 1, Form 2, and Form 3 of the POPIA Regulations), which are available on the Information Regulator’s website.

16. Information Regulator Contact Details

If you are not satisfied with Oxbow’s handling of your personal information, you may lodge a complaint with the Information Regulator of South Africa at the following address:

• The Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Complaints: complaints.IR@justice.gov.za
• General enquiries: inforeg@justice.gov.za

17. PAIA Manual

Oxbow has prepared a manual in accordance with section 51 of the Promotion of Access to Information Act, 2 of 2000, setting out the records held by Oxbow and the procedure for requesting access to those records. A copy of the manual may be obtained at the following location: a copy may be requested from the Information Officer at brett@oxbowsa.co.za  DOWNLOAD LINK NOW.

Contact Us

Any questions about this Policy, or about Oxbow’s handling of personal information, may be directed to:

• Oxbow Office Equipment (Pty) Ltd, trading as Oxbow Office Technology 1B Summer Greens Drive, Century Gate, Century City, 7441
• Telephone: 086 106 9269 / 021 835 1400
• Email: enquiries@oxbowsa.co.za
• Website: oxbowsa.co.za

  End of Privacy and Cookie Policy.