Privacy Policy

1. Purpose and scope

This Privacy Policy explains how Blue White Medical (Pty) Ltd ("Blue White Medical", "we", "us" or "our") processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African laws.

It applies when you visit or use our website, contact us, request a quotation, purchase products, submit products or equipment for assessment or repair, interact with us as a customer, supplier or business partner, apply for work with us, or otherwise provide personal information to us.

This policy is a general privacy notice. A more specific notice, contract or consent request may apply to a particular service or interaction. If there is a conflict, the more specific notice or legally binding agreement will apply to that interaction.

2. Key definitions

The terms "personal information", "processing", "data subject", "responsible party", "operator" and "special personal information" have the meanings given to them in POPIA. In simple terms, personal information is information relating to an identifiable living person and, where applicable, an identifiable existing juristic person such as a company.

3. Personal information we may collect

The information we collect depends on how you interact with us. It may include:

• Contact and identification information, such as your name, job title, organisation, email address, telephone number, billing or delivery address and, where legitimately required, identity or registration information.
• Enquiry and communication information, including contact-form submissions, quotation requests, emails, WhatsApp communications, call notes, complaints, compliments and other correspondence.
• Customer, supplier and transaction information, such as account details, purchase orders, quotations, invoices, delivery information, order history, warranties, service records and information needed to fulfil contractual and regulatory obligations.
• Repair and equipment information, such as equipment descriptions, serial numbers, fault reports, service history and the contact details of persons responsible for the equipment.
• Payment and financial administration information. Where online payment is available, payment credentials may be processed by a payment service provider. We generally do not receive or store full payment-card details.
• Website and technical information, such as IP address, browser and device type, approximate location derived from an IP address, referring pages, pages visited, dates and times, cookie identifiers and security logs.
• Marketing preferences, including whether you have agreed to receive communications and any unsubscribe or objection request.
• Recruitment information, if you apply for a position, such as your CV, qualifications, employment history, references and information needed to assess your application.

4. Special personal information, health information and children

Blue White Medical supplies and services medical equipment but does not provide patient healthcare through this website. Please do not send patient records, clinical details or other special personal information through our general website forms, email or WhatsApp unless we have specifically requested it and provided a lawful, secure method.

If special personal information is received or is genuinely necessary for a lawful business purpose, we will process it only where POPIA permits and with appropriate safeguards. Our website and services are directed at businesses and adults. We do not knowingly collect personal information from children through the website without the authorisation or other lawful basis required by POPIA.

5. How we collect personal information

We may collect personal information:

• directly from you, including through forms, email, telephone, WhatsApp, orders, quotations, contracts and in-person interactions;
• from your employer, organisation, authorised representative, customer, supplier or referral source;
• automatically when you use our website, through server logs, cookies and similar technologies;
• from service providers, payment providers, couriers, distributors, business partners or publicly available sources where lawful; and
• from regulators, professional advisers or authorities where this is permitted or required by law.

6. Why and on what grounds we process information

We process personal information only where there is a lawful justification under POPIA. Depending on the circumstances, we may rely on consent, the performance or conclusion of a contract, compliance with a legal obligation, protection of a legitimate interest of the data subject, or our legitimate interests or those of a third party, provided those interests do not unjustifiably prejudice your rights.

We may process personal information to:

• respond to enquiries, provide information and prepare quotations;
• create and manage customer or supplier records and perform contracts;
• process orders, payments, deliveries, returns, warranties, repairs and after-sales support;
• communicate about products, services, orders, equipment, accounts, policies and operational matters;
• manage finance, tax, auditing, quality, medical-device, safety and other legal or regulatory obligations;
• verify information, prevent fraud, protect our systems and investigate suspected misuse or security incidents;
• operate, maintain, troubleshoot and improve our website, services and customer experience;
• manage suppliers, distributors, professional advisers and other business relationships;
• consider job applications and manage recruitment;
• send direct marketing where permitted by POPIA and honour communication preferences; and
• establish, exercise or defend legal claims and protect our rights, property, staff, customers and the public.

7. Cookies and similar technologies

Our website may use cookies and similar technologies to make the website work, remember preferences, maintain security, understand website use and, where enabled and lawfully permitted, measure or support marketing. Cookies may be set by us or by third-party services embedded in or linked from the website, such as maps, analytics, social media, payment or communication services.

You can manage non-essential cookies through any cookie controls made available on the website and through your browser settings. Blocking certain cookies may affect website functionality. Please also read our separate Cookie Policy for more detail about the cookies currently used.

8. Direct marketing

We may send information about our products or services where you have consented or where another lawful basis under POPIA permits us to do so. Electronic marketing will identify the sender and provide a reasonable, free way to opt out. You may object to direct marketing or unsubscribe at any time by using the unsubscribe facility in the message or contacting us at info@bwmed.co.za. We will retain enough information to record and honour your opt-out request.

9. When we share personal information

We do not sell personal information. We may share it only when reasonably necessary and lawful, including with:

• employees and authorised representatives who need the information for their work;
• hosting, IT, cybersecurity, cloud, email, communications, customer-management and website service providers;
• payment service providers, banks, couriers, logistics providers, manufacturers, distributors and repair partners;
• accountants, auditors, insurers, lawyers and other professional advisers;
• regulators, law-enforcement bodies, courts, tax authorities or other public bodies where required or permitted by law;
• a buyer, investor or successor in connection with a proposed or completed business transaction, subject to appropriate confidentiality and legal safeguards; and
• other parties where you direct us to share information or provide valid consent.

Where a service provider processes personal information for us as an operator, we require appropriate confidentiality, security and data-protection commitments. A recipient may also be an independent responsible party for its own processing, in which case its privacy terms may apply.

10. Cross-border transfers

Some service providers or systems may process or store information outside South Africa. We will transfer personal information across borders only where section 72 of POPIA permits it, including where the recipient is subject to a law, binding corporate rules or agreement providing an adequate level of protection; where you consent after being informed; where the transfer is necessary for a contract; or where another lawful exception applies. We will take reasonable steps to ensure appropriate safeguards are in place.

11. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to complete transactions and services, maintain quality and service records, meet legal, tax, medical-device, employment, audit or recordkeeping duties, resolve disputes, enforce agreements or establish legal claims.

Retention periods vary according to the record and applicable law. When information is no longer required, we will delete, destroy or de-identify it in a reasonably secure manner, unless continued retention is permitted or required by law.

12. Information security and security compromises

We use reasonable and appropriate technical and organisational safeguards designed to protect personal information against loss, damage, unauthorised destruction, unlawful access, interference, modification or disclosure. Measures may include access controls, authentication, backups, security monitoring, staff awareness, supplier controls and secure disposal, as appropriate to the risk.

No method of transmission or storage is completely secure. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay or direction.

13. Your rights

Subject to POPIA and any applicable limitations, you may:

• ask whether we hold personal information about you and request access to it;
• ask us to correct or update inaccurate, incomplete, excessive, misleading or outdated information;
• request deletion or destruction where we are no longer authorised to retain information;
• object, on reasonable grounds, to processing based on certain legitimate interests;
• object at any time to processing for direct marketing;
• withdraw consent where processing is based on consent, without affecting earlier lawful processing;
• request information about the identity of third parties who have had access to your information where POPIA provides for this;
• not be subject, except as POPIA permits, to a decision based solely on automated processing that produces legal or substantial effects; and
• lodge a complaint with the Information Regulator or institute civil proceedings where legally entitled.

To exercise a right, contact us using the details below. We may need to verify your identity and authority before acting. We will respond within the period and in the manner required by applicable law. Certain access requests may also be handled under the Promotion of Access to Information Act 2 of 2000 (PAIA) and our PAIA Manual.

14. Third-party websites and services

Our website may link to or embed services operated by third parties, including maps, social media, WhatsApp, payment or other external services. When you interact with those services, the third party may collect personal information under its own privacy terms. We do not control those independent practices and encourage you to review the relevant third-party privacy notices.

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our activities, technology, legal requirements or privacy practices. The latest version will be published on our website with its effective date. Material changes may also be communicated through an appropriate additional notice.

16. Contact Blue White Medical

For privacy questions, objections, access or correction requests, complaints or withdrawal of consent, contact:

17. Information Regulator (South Africa)

If you believe your personal information has been processed in breach of POPIA, you may first contact us so that we can try to resolve the matter. You also have the right to lodge a complaint with the Information Regulator: