Privacy Policy

Last updated: 20 May 2026

This Privacy Policy explains how Best Tobacco Company, also referred to as "BTC", "we", "us", or "our", collects, uses, stores, shares, and protects personal information when you use https://besttobaccocompany.co.za, submit a trade enquiry, contact us, or otherwise interact with us through the website.

This website is a corporate and trade-focused website for adult users. It is not intended for minors and is not an online tobacco shop.

Important: this document is a working legal draft. It should be reviewed by a South African privacy or commercial attorney before publication.

1. Scope of this Policy

This Policy applies to personal information processed through:

the BTC website;
contact and trade enquiry forms;
email, telephone, and website-based communications linked to the website;
age verification and cookie consent tools;
website analytics, security, hosting, and technical services; and
follow-up business communications arising from website enquiries.

This Policy does not apply to third-party websites, platforms, or services that may be linked from the website. Those services are governed by their own privacy notices and terms.

2. Responsible Party

For purposes of South African data protection law, BTC is generally the responsible party for personal information collected through this website, unless a separate written agreement states otherwise.

Operational details to confirm before publication:

Registered legal entity name: [insert full registered company name]
Company registration number: [insert registration number]
Registered address: [insert registered address]
Information Officer: [insert Information Officer name and contact details]
Privacy contact email: [insert privacy email, for example privacy@besttobaccocompany.co.za]

Until a dedicated privacy email is confirmed, users may contact BTC through the contact details published on the website.

3. Personal Information We Collect

We may collect the following categories of personal information, depending on how you use the website.

3.1 Information you provide directly

When you submit a trade enquiry, contact form, email, phone request, or other communication, we may collect:

name and surname;
company or organisation name;
job title or business role;
email address;
telephone number;
location, province, country, or trading area;
enquiry type;
message content;
business registration, licensing, or trade-related information if requested later;
correspondence records; and
any other information you choose to provide.

3.2 Age verification and consent information

Because the website relates to tobacco products, we use an age gate. We may process:

age confirmation status;
date of birth fields entered into the age gate, where technically processed;
whether you selected "remember me";
session storage or local storage values used to remember age verification; and
cookie consent preferences.

The website should avoid storing full dates of birth unless strictly necessary. A better privacy practice is to store only a yes/no age-verification flag and not retain the full date entered.

3.3 Technical and usage information

When you use the website, we or our service providers may automatically collect:

IP address;
browser type and version;
device type;
operating system;
pages visited;
referring website;
time and date of visit;
approximate location derived from IP address;
interaction data, such as form submissions or navigation paths;
cookie identifiers;
security logs; and
error, diagnostic, and performance data.

3.4 Business and trade verification information

Where a website enquiry develops into a possible trade relationship, we may request or process additional business information, such as:

proof of business identity;
company registration details;
tax or VAT details;
physical trading address;
distribution, wholesale, or retail details;
lawful trading or licensing information where applicable;
credit or account application information;
authorised representative details; and
compliance documentation required for lawful trade.

Those later-stage processes may be governed by additional notices, forms, or agreements.

4. We Do Not Intentionally Collect Children's Information

The website is not intended for persons under 18. We do not knowingly invite, request, or market to minors.

If we become aware that a minor has submitted personal information through the website, we may delete the information, refuse further communication, and take reasonable steps to prevent continued access, unless we are legally required to retain a record.

5. How We Use Personal Information

We may use personal information for the following purposes:

to operate and maintain the website;
to manage age verification and responsible access controls;
to receive, assess, and respond to trade enquiries;
to contact you about your enquiry;
to verify your identity, age, role, company, or authority where appropriate;
to assess potential trade, wholesale, retail, distribution, supply, or business relationships;
to manage business records and correspondence;
to comply with applicable law, regulation, tax, excise, tobacco control, privacy, reporting, or record-keeping obligations;
to protect BTC, users, systems, partners, and the public from unlawful, fraudulent, abusive, or high-risk activity;
to improve website performance, content, usability, and security;
to administer cookie consent and user preferences;
to send lawful business communications where permitted;
to enforce website Terms and Conditions; and
to establish, exercise, or defend legal rights.

6. Legal Grounds for Processing

Where POPIA applies, we process personal information only where we have a lawful basis to do so. Depending on the context, this may include:

your consent;
performance of a contract or steps taken at your request before entering into a contract;
compliance with an obligation imposed by law;
protection of our legitimate interests or your legitimate interests;
proper performance of a public law duty where applicable; or
processing permitted by law for business, security, compliance, or legal purposes.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing that occurred lawfully before withdrawal, and it does not affect processing based on another lawful ground.

7. Cookies, Local Storage, and Similar Technologies

The website may use cookies, local storage, session storage, scripts, analytics tools, and similar technologies.

We may use these technologies to:

remember whether you passed the age gate;
remember cookie preferences;
keep the website functional and secure;
understand how visitors use the website;
improve website performance and content;
detect technical problems; and
protect against misuse.

Some technologies are essential for the website to work properly. Others may be optional, such as analytics or preference-related technologies.

You can control some cookies through your browser settings. Blocking cookies or storage may affect age verification, preferences, forms, and website functionality.

8. Direct Marketing and Business Communications

BTC may contact you in response to an enquiry you submit.

We may also send business-to-business communications about BTC, products, trade opportunities, compliance matters, or related corporate updates where permitted by law and where the communication is relevant to your business relationship or enquiry.

We will not knowingly send tobacco marketing communications to minors. We will also not sell tobacco products online through the website.

Where required, you may opt out of non-essential marketing communications by using the unsubscribe method provided or by contacting us.

9. Sharing Personal Information

We may share personal information with:

BTC employees, directors, representatives, and authorised personnel;
website hosting, security, analytics, email, CRM, IT, and technical service providers;
professional advisers, such as attorneys, auditors, tax advisers, and compliance consultants;
logistics, distribution, retail, wholesale, or trade partners where necessary for a lawful business enquiry or relationship;
regulators, law enforcement, public authorities, courts, or government bodies where legally required or reasonably necessary;
parties involved in a business restructuring, merger, acquisition, sale, or transfer, subject to appropriate confidentiality and legal protections; and
other parties where you have authorised us to do so.

We require service providers to process personal information only for authorised purposes and to apply appropriate confidentiality and security measures.

10. International Transfers

Some service providers, hosting systems, analytics tools, email systems, or technical platforms may process information outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer is lawful and that appropriate safeguards apply. These safeguards may include contractual protections, service provider policies, or other lawful transfer mechanisms.

11. Security

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, misuse, disclosure, alteration, and destruction.

These measures may include access controls, secure hosting, password controls, encryption where appropriate, monitoring, backups, staff controls, and service provider due diligence.

No website, email system, or internet transmission is completely secure. You should avoid sending highly sensitive information through ordinary website forms unless requested through a secure and appropriate channel.

12. Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Retention periods may depend on:

the nature of the enquiry;
whether a trade relationship is formed;
legal, regulatory, tax, excise, accounting, or audit requirements;
dispute, complaint, or enforcement risk;
security and fraud-prevention needs; and
legitimate business record-keeping requirements.

Where information is no longer required, we will delete, de-identify, or securely archive it where reasonably practical.

13. Your Rights

Subject to applicable law, you may have the right to:

ask whether we hold personal information about you;
request access to your personal information;
request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained information;
object to certain processing;
withdraw consent where processing is based on consent;
request restriction of processing in appropriate circumstances;
complain to the Information Regulator; and
request information about third parties who have had access to your personal information where applicable.

We may need to verify your identity before responding to a request. Some requests may be refused or limited where the law allows or requires this, including where records must be retained for legal, regulatory, tax, security, or dispute purposes.

14. PAIA and Access to Records

Requests for access to records may be subject to the Promotion of Access to Information Act 2 of 2000, as amended.

Where required, BTC should make a PAIA Manual available containing the details required by law, including how to submit requests for access to records.

Operational item to complete before publication: confirm whether BTC has a current PAIA Manual and Information Officer details, and link them from this Privacy Policy if available.

15. Information Regulator

If you believe your personal information rights have been infringed, you may contact us first so that we can try to resolve the issue.

You may also contact the Information Regulator South Africa:

Website: https://inforegulator.org.za
Email: enquiries@inforegulator.org.za
Telephone: 010 023 5200
Toll-free: 0800 017 160

Please confirm these details before publication because regulator contact details may change.

16. Data Breaches

If we become aware of unauthorised access to, or acquisition of, personal information that creates a legal notification obligation, we will take reasonable steps required by law. This may include notifying affected persons and/or the Information Regulator where required.

17. Accuracy of Information You Provide

You are responsible for ensuring that information you submit to BTC is accurate, complete, current, and lawfully provided.

If you provide information about another person, company representative, employee, or contact, you confirm that you have authority to do so and that you have provided any required privacy notice to that person.

18. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the website with a revised "Last updated" date.

Material changes may be highlighted on the website where appropriate.

19. Contact

For privacy requests, personal information queries, corrections, objections, or complaints, contact BTC through the details published on the Contact page or through the dedicated privacy contact once confirmed.

Current trade contacts listed on the website:

Yaghya Chilwan: Yaghya@besttobaccocompany.co.za, +27 76 789 7989
Raaziq Poole: Raaziq@besttobaccocompany.co.za, +27 72 364 6172

Before publishing this Privacy Policy, BTC should confirm:

full registered legal entity name;
company registration number;
registered address;
Information Officer details;
PAIA Manual status and link;
privacy contact email;
actual website analytics, CRM, hosting, and email service providers;
cookie list and retention periods; and
whether any personal information is transferred outside South Africa.