Privacy Policy

Committed to Protecting and Respecting

Privacy and Security Information

This policy sets out the basis on which any personal data we collect from our customers/visitors and provided to us. 






The Protection of Personal Information Act, 4 of 2013 (POPIA) gives effect to the constitutional right to data privacy in terms of Section 14 of the Bill of Rights of the Constitution.

The responsible use of the MUNTSTUK’S website and related resources in respect of data privacy is important to MUNTSTUK’S.

Whilst MUNTSTUK’S is committed to protecting all person’s rights to privacy and who in consequence will ensure that all person’s Personal Information is used appropriately, transparently and according to applicable law, the MUNTSTUK’S has to ensure that these privacy rights are balanced with other rights such as the right to use and have access to the MUNTSTUK’S Information and Services including its online and social media platforms and applications.


This Policy sets out the responsibilities and obligations of all persons who make use of, or access or receive MUNTSTUK’S Information and Communications via its electronic communication facilities and resources including its website, email and social media platforms and how all users of these facilities and resources are to ensure that when using these resources that they respect and process another’s Personal Information lawfully and under the provisions of POPIA and the 8 Personal Information Processing Principles.





In this Policy (as defined below), unless the context requires otherwise, the following words and expressions bear the meanings assigned to them and cognate expressions bear corresponding meanings–

1.1 "Child" means any natural person under the age of 18 (eighteen) years;

 1.2 "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information under the control of or in the possession of Muntstuk;

 1.3 "Data Subject" has the meaning ascribed thereto under POPIA;

 1.4 "Direct Marketing" means to approach a person, by electronic communication, to promote or offer to supply, in the ordinary course of business, any goods or services to the data subject;

 1.5 "Direct Marketer" means a supplier who employs Direct Marketing as an advertising mechanism;

 1.6 "Employees" means any employee of Muntstuk;

 1.7 "Government" means the Government of the Republic of South Africa;

 1.8 "Muntstuk" means the Muntstuk Company of South Africa (Proprietary) Limited, registration number 1948/030259/07, with its registered address at 7 Woodmead Estate, Woodmead Drive, Woodmead, Johannesburg;

 1.9 "Operator" means a person or entity who Processes Personal Information for a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that Responsible Party;

 1.10 "PAIA" means the Promotion of Access to Information Act, No 2 of 2000;

 1.11 "Personal Information" has the meaning ascribed thereto under POPIA and specifically includes any form of information that can be used to identify a Data Subject;

 1.12 "Policy" means this Privacy Policy;

 1.13 "POPIA" means the Protection of Personal Information Act No. 4 of 2013;

 1.14 "Processing" has the meaning ascribed thereto under POPIA. "Process" has a corresponding meaning;

 1.15 "Regulator" means the Information Regulator established in terms of POPIA;

 1.16 "Responsible Party" means a public or private body or any other person which alone or in conjunction with others, determines the purpose of and means for Processing Personal Information;

 1.17 "Special Personal Information" means Personal Information concerning a Data Subject's religious or philosophical beliefs, race or ethnic origin, trade union membership, political opinions, health, sexual life, biometric information or criminal behaviour; and

1.18 "Third Party" means any independent contractor, agent, consultant, sub-contractor or other representatives of Muntstuk.




2.1 The purpose of this Policy is to inform Data Subjects about how Muntstuk Processes their Personal Information.

2.2 Muntstuk, in its capacity as Responsible Party (and/or Operator, where applicable), shall strive to observe, and comply with its obligations under POPIA as well as accepted information protection principles, practices and guidelines when it Processes Personal Information from or in respect of a Data Subject.

 2.3 This Policy applies to Personal Information collected by Muntstuk in connection with the products and services which Muntstuk provides. This includes information collected directly from you as a Data Subject, as well as information we collect indirectly through our service providers who collect your information on our behalf.

 2.4 This Privacy Policy does not apply to the information practices of Third-Party companies who we may engage with our business operations (including, without limitation, their websites, platforms and/or applications) which we do not own or control; or individuals that Muntstuk does not manage or employ. These Third-Party Sites may have their privacy policies and terms and conditions and we encourage you to read them before using them.




3.1 Muntstuk collects Personal Information directly from Data Subjects as and when required for a defined purpose unless an exception is applicable (such as, for example, where the Data Subject has made the Personal Information public or the Personal Information is contained in or derived from a public record).

3.2 Muntstuk will always collect Personal Information in a fair, lawful and reasonable manner to ensure that it protects the Data Subject's privacy and will Process the Personal Information based on legitimate grounds in a manner that does not adversely affect the Data Subject in question.

3.3 Muntstuk often collects Personal Information directly from the Data Subject and/or in some cases, from Third Parties. Where Muntstuk obtains Personal Information from Third Parties, Muntstuk will ensure that it obtains the consent of the Data Subject to do so or will only Process the Personal Information without the Data Subject's consent where Muntstuk is permitted to do so in terms of clause 3.1 above or the applicable law.

3.4 An example of such Third Parties includes (i) recruitment agencies; (ii) other companies providing services to Muntstuk; and (iii) where Muntstuk makes use of publicly available sources of information (e.g. the Companies and Intellectual Property Commission, an agency of the Department of Trade and Industry in South Africa (CIPC)).




4.1 Where Muntstuk is the Responsible Party, it will only Process a Data Subject's Personal Information (other than for Special Personal Information) where –

4.1.1 consent of the Data Subject (or a competent person, where the Data Subject is a Child) is obtained;

4.1.2 Processing is necessary to carry out the actions for the conclusion of a contract to which a Data Subject is a party;

4.1.3 Processing complies with an obligation imposed by law on Muntstuk;

4.1.4 Processing protects a legitimate interest of the Data Subject; and/or

4.1.5 Processing is necessary for pursuing the legitimate interests of Muntstuk or of a third party to whom the information is supplied.

4.2 Muntstuk will only Process Personal Information where one of the legal bases referred to in paragraph 4.1 above is present.

4.3 Muntstuk will make the manner and reason for which the Personal Information will be Processed clear to the Data Subject.

4.4 Where Muntstuk is relying on a Data Subject's consent as the legal basis for Processing Personal Information, the Data Subject may withdraw his/her/its consent or may object to MUNTSTUK’S Processing of the Personal Information at any time. However, this will not affect the lawfulness of any processing carried out before the withdrawal of consent or any Processing justified by any other legal ground provided under POPIA.

4.5 If the consent is withdrawn or if there is otherwise a justified objection against the use or the Processing of such Personal Information, Muntstuk will ensure that the Personal Information is no longer Processed.

4.6 Google Analytics are used to monitor our website and assist us in making improvements. Our use of Google Analytics requires us to pass to Google your IP address (but no other information) - Google uses this information to prepare site usage reports for us, but Google may also share this information with other Google services. In particular, Google may use the data collected to contextualize and personalize the advertisements of its advertising network. 

4.7 Muntstuk may have to share data with third parties, including other professional advisers, third-party service providers and other related entities. We require third parties to respect the security of your data and to treat it under the law.  If we do, you can expect a similar degree of protection in respect of your personal information.


You agree that we have the right to share your personal information with:

  • any member of our group, which means any of our subsidiaries and related entities;

  • selected third parties including:

    • certain Government departments, executive agencies, public bodies and public authorities;

    • professional advisers, expert witnesses, mediators, business partners, agents, associations, suppliers and sub-contractors, but only for the performance of any contract we enter into with you;

    • other clients and third parties who are directly or indirectly involved or interested in any transaction or claim (including the other side, their representatives and related parties);

    • professional associations and accreditors;

    • analytics and search engine providers that assist us in the improvement and optimization of our site; and

    • credit reference agencies to assess your credit score where this is a condition of us entering into a contract with you; databases, checks and searches (including for due diligence inquiries, ID verification services, criminal record checks and company checks).

4.8 All third-party service providers and other related entities are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your data for their purposes. We only permit them to process your data for specified purposes and under our instructions.

4.9 Muntstuk may disclose personal information to third parties:

  • if they sell or buy any business or assets, in which case we will disclose your data to the prospective seller or buyer of such business or assets;

  • if or substantially all of its assets are acquired by a third party, in which case personal data held by it about its clients will be one of the transferred assets; or

  • if we are under a duty to disclose or share your data to comply with any legal obligation or terms and conditions and other agreements or to protect the rights, property, or safety of, our clients, or others. This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction.




5.1 Special Personal Information is sensitive Personal Information of a Data Subject and Muntstuk acknowledges that it will generally not Process Special Personal Information unless –

5.1.1 Processing is carried out under the Data Subject's consent;

5.1.2 Processing is necessary for the establishment, exercise or defence of a right or obligation in law;

5.1.3 Processing is for historical, statistical or research purposes, subject to stipulated safeguards;

5.1.4 information has deliberately been made public by the Data Subject; or

5.1.5 specific authorisation applies in terms of POPIA.

5.2 Muntstuk acknowledges that it may not Process any Personal Information concerning a Child and will only do so where it has obtained the consent of the parent or guardian of that Child or where it is permitted to do so under applicable laws.




6.1 Muntstuk understands its obligation to make Data Subjects aware of the fact that it is Processing their Personal Information and inform them of the purpose for which Muntstuk Processes such Personal Information.

6.2 Muntstuk will only Process a Data Subject's Personal Information for a specific, lawful and clear purpose (or for specific, lawful and clear purposes) and will ensure that it makes the Data Subject aware of such purpose(s) as far as possible.

6.3 It will ensure that there is a legal basis for the processing of any Personal Information. Further, Muntstuk will ensure that Processing will relate only to the purpose for and of which the Data Subject has been made aware (and where relevant, consented to) and will not process any Personal Information for any other purpose(s).

6.4 Muntstuk will generally use Personal Information for purposes required to operate and manage its normal operations and these purposes include one or more of the following non-exhaustive purposes – to provide its products or services to customers and where relevant, for purposes of doing appropriate customer onboarding and credit vetting for purposes of onboarding suppliers or service providers as approved suppliers/service providers of Muntstuk. For this purpose, Muntstuk will also Process a service provider's/supplier's Personal Information for purposes of performing the necessary due diligence checks; as part of the "Know Your Customer" / "KYC" process as per the requirements of the Financial Intelligence Centre Act, No. 38 of 2001; generally for procurement and supply purposes; for purposes of monitoring the use of MUNTSTUK’S electronic systems and online platforms by Data Subjects. Muntstuk will, from time to time, engage third-party service providers (who will Process the Data Subject's Personal Information on behalf of Muntstuk) to facilitate this; for purposes of preventing, discovering and investigating violations of this Policy, the applicable law and other Muntstuk policies; in connection with the execution of payment processing functions, including payment of MUNTSTUK’S suppliers'/service providers' invoices; for employment-related purposes such as recruiting staff, administering payroll, background checks, etc.; in connection with internal audit purposes (i.e. ensuring that the appropriate internal controls are in place to mitigate the relevant risks, as well as to carry out any investigations where this is required); in connection with external audit purposes. For this purpose, Muntstuk engages external service providers and, in so doing, shares Personal Information of the Data Subjects with third parties; for company secretarial related purposes. For this purpose, Muntstuk will, from time to time, collect information relating to Data Subjects from third parties such as the Companies and Intellectual Property Commission, an agency of the Department of Trade and Industry in South Africa for such other purposes to which the Data Subject may consent from time to time; for such other purposes as authorised in terms of applicable law; and to comply with any applicable law or any query from Government authorities, including any regulatory authority that has authority over Muntstuk.




7.1 Muntstuk will take reasonable steps to ensure that all Personal Information is kept as accurate, complete and up to date as reasonably possible depending on the purpose for which Personal Information is collected or further processed.

7.2 Muntstuk may not always expressly request the Data Subject to verify and update his/her/its Personal Information unless this process is specifically necessary.

7.3 Muntstuk, however, expects that the Data Subject will notify Muntstuk from time to time in writing of any updates required in respect of his/her/its Personal Information.




8.1 Muntstuk may store your Personal Information in hardcopy format and/or in electronic format using MUNTSTUK’S secure on-site servers or other internally hosted technology. Your Personal Information may also be stored by Third Parties, via cloud services or other technology, with whom Muntstuk has contracted, to support MUNTSTUK’S operations as a food manufacturing company.

8.2 MUNTSTUK’S Third-Party service providers, including data storage and processing providers, may from time to time also have access to a Data Subject's Personal Information in connection with purposes for which the Personal Information was initially collected to be Processed.

8.3 Muntstuk will ensure that such Third-Party service providers will Process the Personal Information under the provisions of this Policy, all other relevant internal policies and procedures and POPIA.

8.4 These Third Parties do not use or have access to the Data Subject’s Personal Information other than for purposes specified by Muntstuk, and Muntstuk requires such parties to employ at least the same level of security that Muntstuk uses to protect the Data Subject’s data.

8.5 Your Personal Information may be processed in South Africa or another country where Muntstuk, its affiliates and their Third-Party service providers maintain servers and facilities and Muntstuk will take steps, including by way of contracts, to ensure that it continues to be protected, regardless of its location, in a manner consistent with the standards of protection required under applicable law, including POPIA

8.6 All information provided is stored on secure/hosted servers.  Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to prevent unauthorised access.




9.1 To the extent that Muntstuk acts in its capacity as a Direct Marketer, it shall strive to observe, and comply with its obligations under POPIA when implementing principles and practices concerning Direct Marketing.

9.2 Muntstuk acknowledges that it may only use Personal Information to contact the Data Subject for purposes of Direct Marketing from time to time where it is permissible to do so.

9.3 It may use Personal Information to contact any Data Subject and/or market MUNTSTUK’S services directly to the Data Subject(s) if the Data Subject is one of MUNTSTUK’S existing clients, the Data Subject has requested to receive marketing material from Muntstuk or Muntstuk has the Data Subject's consent to market its services directly to the Data Subject.

9.4 If the Data Subject is an existing client, Muntstuk will only use his/her/its Personal Information if it has obtained the Personal Information through the provision of a service to the Data Subject and only to similar services to the ones Muntstuk previously provided to the Data Subject.

9.5 Muntstuk will ensure that a reasonable opportunity is given to the Data Subject to object to the use of their Personal Information for MUNTSTUK’S purposes when collecting the Personal Information and on the occasion of each communication to the Data Subject for purposes of Direct Marketing.

9.6 Muntstuk will not use your Personal Information to send you marketing materials if you have requested not to receive them. If you request that we stop processing your Personal Information for marketing purposes, Muntstuk shall do so. We encourage that such requests to opt-out of marketing be made via forms and links provided for that purpose in the marketing materials sent to you.




We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements.  As a general rule, we will destroy your personal information 5 years after you cease being a client.  

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your data, the purposes for which we process your data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances, we may anonymity your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.


10.1 Muntstuk may keep records of the Personal Information, correspondence, or comments it has collected in an electronic or hardcopy file format.

10.2 In terms of POPIA, Muntstuk may not retain Personal Information for a period longer than is necessary to achieve the purpose for which it was collected or processed and is required to delete, destroy (in such a way that it cannot be reconstructed) or de-identify the information as soon as is reasonably practicable once the purpose has been achieved. This prohibition will not apply in the following circumstances –

10.2.1 where the retention of the record is required or authorised by law or by any Governmental authority


10.2.2 Muntstuk requires the record to fulfil its lawful functions or activities;

10.2.3 retention of the record is required by a contract between the parties thereto;

10.2.4 the Data Subject (or competent person, where the Data Subject is a Child) has consented to such longer retention; or

10.2.5 the record is retained for historical, research, archival or statistical purposes provided safeguards are put in place to prevent use for any other purpose. Accordingly, Muntstuk will, subject to the exceptions noted in this Policy, retain Personal Information for as long as necessary to fulfil the purposes for which that Personal Information was collected and/or as permitted or required by applicable law.

10.3 Where Muntstuk retains Personal Information for longer periods for statistical, historical, archival or research purposes, Muntstuk will ensure that appropriate safeguards have been put in place to ensure that all recorded Personal Information will continue to be processed under this Policy and applicable laws.

10.4 Once the purpose for which the Personal Information was initially collected and Processed no longer applies or becomes obsolete, Muntstuk will ensure that the Personal Information is deleted, destroyed or de-identified sufficiently so that a person cannot re-identify such Personal Information. In instances where we de-identify your Personal Information, Muntstuk may use such de-identified information indefinitely.




11.1 Should Muntstuk need to collect Personal Information by law or under its obligations as an employer or product or service provider, and you fail to provide the Personal Information when requested, we may be unable to perform our duties as an employer, in terms of the applicable law or in terms of providing the product to you.

11.2 Should Muntstuk need to collect Personal Information for any of the purposes set out in clause 11.1 and you fail to provide the Personal Information when requested, your failure to provide such Personal Information may have negative consequences, including that Muntstuk may not be able to effectively perform its obligations as an employer (where Muntstuk needs to Process your Personal Information to perform its obligations as an employer) or product or service provider (where Muntstuk needs to Process your Personal Information to provide you with its products or services), have to decline to receive the relevant services from you as a supplier, and you will be notified where this is the case.




12.1 Muntstuk shall preserve the security of Personal Information and, in particular, prevent its alteration, loss and damage, or access by non-authorised third parties.

12.2 Muntstuk will ensure the security and integrity of Personal Information in its possession or under its control with appropriate, reasonable technical and organisational measures to prevent the loss, unlawful access and unauthorised destruction of Personal Information.

12.3 Muntstuk has implemented physical, organisational, contractual and technological security measures (having regard to generally accepted information security practices or industry-specific requirements or professional rules) to keep all Personal Information secure, including measures protecting any Personal Information from loss or theft, and unauthorised access, disclosure, copying, use or modification. Further, Muntstuk maintains and regularly verifies that the security measures are effective and regularly updates the same in response to new risks.




13.1 A Data Breach refers to any incident in terms of which reasonable grounds exist to believe that the Personal Information of a Data Subject has been accessed or acquired by any unauthorised person.

13.2 A Data Breach can happen for many reasons, which include: (a) loss or theft of data or equipment on which Personal Information is stored; (b) inappropriate access controls allowing unauthorised use; (c) equipment failure; (d) human error; (e) unforeseen circumstances, such as a fire or flood; (f) deliberate attacks on systems, such as hacking, viruses or phishing scams; and/or (g) alteration of Personal Information without permission and loss of availability of Personal Information.

13.3 Muntstuk will address any Data Breach under the terms of POPIA.

13.4 Muntstuk will notify the Regulator and the affected Data Subject (unless the applicable law or a Government authority requires that we delay notification to the Data Subject) in writing in the event of a Data Breach (or a reasonable belief of a Data Breach) in respect of that Data Subject's Personal Information.

13.5 Muntstuk will provide such notification as soon as reasonably possible after it has become aware of any Data Breach in respect of such Data Subject's Personal Information.

13.6 Where Muntstuk acts as an 'Operator' for purposes of POPIA and should any Data Breach affect the data of Data Subjects whose information Muntstuk Processes as an Operator, Muntstuk shall (in terms of POPIA) notify the relevant Responsible Party immediately where there are reasonable grounds to believe that the Personal Information of relevant Data Subjects has been accessed or acquired by any unauthorised person.




14.1 Muntstuk may disclose Personal Information to Third Parties and will enter into written agreements with such Third Parties to ensure that they Process any Personal Information under the provisions of this Policy, and POPIA.

14.2 Muntstuk notes that such Third Parties may assist Muntstuk with the purposes listed in paragraph 6.3 above – for example, service providers may be used, inter alia,

14.2.1 for data storage;

14.2.2 to assist Muntstuk with auditing processes (external auditors);

14.2.3 for providing outsourced services to Muntstuk, including in respect of its (i) legal, (ii) data storage requirements and (iii) upskilling of its Employees; and/or

14.2.4 to notify the Data Subjects of any pertinent information concerning Muntstuk.

14.3 Muntstuk will disclose Personal Information with the consent of the Data Subject or if Muntstuk is permitted to do so without such consent under applicable laws


14.4 Further, Muntstuk may also send Personal Information to a foreign jurisdiction outside of the Republic of South Africa, including for Processing and storage by Third Parties.

14.5 When Personal Information is transferred to a jurisdiction outside of the Republic of South Africa including to any cloud, data centre or server located outside of South Africa, Muntstuk will obtain the necessary consent to transfer the Personal Information to such foreign jurisdiction or may transfer the Personal Information where Muntstuk is permitted to do so under the provisions applicable to cross-border flows of Personal Information under POPIA.

14.6 The Data Subject should also take note that the Processing of Personal Information in a foreign jurisdiction, if and to the extent such Processing does occur, may be subject to the laws of the country in which the Personal Information is held, and may be subject to disclosure to the governments, courts of law, enforcement or regulatory agencies of such other country, according to the laws of such country.



15.1 Our website uses cookies, which are small text files sent by a web server to store on a web browser that distinguishes you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site.

For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy. They are used to ensure websites function properly, store user preferences when needed and collect anonymous statistics on website usage.

15.2 You may refuse to accept cookies by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you select this setting you may be unable to access certain parts of our website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to the website. If you accept a “cookie” or fail to deny the use of “cookies”, you agree that we may use your personal information collected using “cookies” (subject to the provisions of this Policy). Where you either reject or decline cookies, you are informed that you may not be able to fully experience the interactive features of our website.




16.1 POPIA read with the relevant provisions of the Promotion of Access to Information Act, No. 2 of 2000 ("PAIA") confers certain access rights on Data Subjects.


These rights include -


16.1.1 a right of access: a Data Subject having provided adequate proof of identity has the right to (i) request a Responsible Party to confirm whether any Personal Information is held about the Data Subject; and/or (ii) request from a Responsible Party a description of the Personal Information held by the Responsible Party including information about Third Parties who have or have had access to the Personal Information. A Data Subject may request: Muntstuk to confirm, free of charge, whether it holds any Personal Information about him/her/it; and to obtain from Muntstuk the record or description of Personal Information concerning him/her/it and any information regarding the recipients or categories of recipients who have or had access to the Personal Information. Such record or description is to be provided: (a) within a reasonable time; and (b) in a reasonable manner and format and a generally understandable form.

16.1.2 a right to request correction or deletion: a Data Subject may also request Muntstuk to – correct or delete Personal Information about the Data Subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or destroy or delete a record of Personal Information about the Data Subject that Muntstuk is no longer authorised to retain records in terms of POPIA's retention and restriction of records provisions.
On receipt of such a request, Muntstuk is required to, as soon as is reasonably practicable – correct the information; delete or destroy the information; provide the Data Subject with evidence in support of the information; or where the Data Subject and Responsible Party cannot reach an agreement on the request and if the Data Subject requests this, Muntstuk will take reasonable steps to attach to the information an indication that correction has been requested but has not been made;

16.1.3 a right to consent and to object to processing: a Data Subject that has previously consented to the Processing of his/her/its Personal Information has the right to withdraw such consent and may do so by providing Muntstuk with notice to such effect at the address set out in paragraph 20. Further, a Data Subject may object, on reasonable grounds, to the Processing of Personal Information relating to him/her/it.

16.2 Accordingly, Muntstuk may request the Data Subject to provide sufficient identification to permit access to or provide information regarding the existence, use or disclosure of the Data Subject's Personal Information. Any such identifying information shall only be used to facilitate access to or information regarding the Personal Information.

16.3 The Data Subject can request in writing to review any Personal Information about the Data Subject that Muntstuk holds including Personal Information that Muntstuk has collected, utilised or disclosed.

16.4 Muntstuk shall respond to these requests under POPIA and PAIA and provide the Data Subject with any such Personal Information to the extent required by law and any of MUNTSTUK’S policies and procedures which apply in terms of the PAIA.

16.5 The Data Subject can challenge the accuracy or completeness of his/her/its Personal Information in MUNTSTUK’S records at any time under the process set out in the PAIA Manual for accessing information.

 16.6 If a Data Subject successfully demonstrates that their Personal Information in MUNTSTUK’S records is inaccurate or incomplete, Muntstuk will ensure that such Personal Information is amended or deleted as required (including by any Third Parties).




17.1 Muntstuk will respond to each written request of a Data Subject not later than 30 (thirty) days after receipt of such requests. Under certain circumstances, Muntstuk may, however, extend the original period of 30 days once for a further period of not more than 30 (thirty) days.

 17.2 A Data Subject has the right to make a complaint to Muntstuk in respect of this time limit by contacting Muntstuk using the contact details provided in paragraph 20 below.




18.1 Muntstuk reserves the right to make amendments to this Policy from time to time and will use reasonable efforts to notify Data Subjects of such amendments.

18.2 The current version of this Policy will govern the respective rights and obligations between the Data Subject and Muntstuk each time that the Data Subject access and use MUNTSTUK’S site.




‘‘Personal information’’ means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, and may include the following:

  • information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person

  • information relating to the education or the medical, financial, criminal or employment history of the person

  • any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignments to the person

  • the biometric information of the person

(Biometric information includes a technique of personal identification that is based on physical, physiological or behavioural characterization including blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition.)

  • the personal opinions, views or preferences of the person

  • correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence

  • the views or opinions of another individual about the person

  • the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person

Both individuals and companies are included in the ambit of “personal information”.

It is not "personal information" if the information is already in the public domain or is not used, or intended to be used, in trade or commerce.


Processing is any operation or activity or any set of operations, whether or not by automatic means, concerning personal information.

Processing is, therefore, the automated or non-automated activity of collecting, recording, organizing, storing, updating, distributing and even the act of deleting personal information.


The “responsible party” is the company or entity that decides what to do with personal information and how to process the information.


Record means any information that is recorded in any format that is in the possession or under control of a responsible party, regardless of who made the record and when the record came into existence. Records may include:

  • writing on any material

  • a book, map, plan, graph or drawing

  • information produced, recorded or stored using any tape-recorder, computer equipment, whether hardware or software or both or other devices.

The POPI Act applies to the processing of personal information where:

  • a responsible party enters the information in a record using automated or non-automated methods. If the recorded information is processed by non-automated means it must be part of a filing system or intended to be part of a filing system.

  • a responsible party is domiciled in the RSA or

  • if a responsible party is not domiciled in the RSA BUT uses automated or non-automated methods in the RSA - except if these methods are only used to forward personal information through the RSA

  • in the course of purely household or personal activity

  • where the information has been sufficiently de-identified and cannot be re-identified again and

  • some state functions including criminal prosecutions, national security, etc.

The POPI Act does not apply to the processing of personal information

  • in the course of purely household or personal activity

  • where the information has been sufficiently de-identified and cannot be re-identified again and

  • some state functions including criminal prosecutions, national security, etc.

Certain journalistic, literary and artistic purposes are also excluded from the ambit of the Act.




20.1 All comments, questions, concerns or complaints regarding your Personal Information or this Policy, should be forwarded to us.

20.2 If a Data Subject is unsatisfied with how Muntstuk addresses any complaint concerning MUNTSTUK’S Processing of Personal Information, the Data Subject can contact the office of the Regulator, the details of which are set out below – 

  • Main Activity:  Coin Dealer

  • Physical Address:  Crystal Crescent, Midstream, Centurion, Pretoria, Gauteng, 1692, Republic of South Africa (RSA)

  • Office Hours:  Website operates 24/7, all year round

If you have questions or concerns please refer to our Terms and Conditions, Policies or Statements. 

Please contact us should you have any questions

NOTE: does not guarantee that the Acts displayed on this website reflect the most recent version of those Acts after any possible amendments. is not liable for any loss sustained or prejudice caused by a disregard of this warning.