Privacy policy

Last updated: September 2026

This Privacy Policy explains how 4TM collects, uses, stores, shares and protects personal information when people:

  • visit or interact with our website;
  • create an account;
  • place an order;
  • request a quotation;
  • submit an enquiry;
  • communicate with us;
  • use a form;
  • upload files;
  • purchase products;
  • request custom production or business services;
  • arrange delivery;
  • book or enquire about rental or event-related services;
  • interact with our marketing or support channels.

This policy is intended to operate in accordance with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) and, where applicable, other data-protection laws such as the EU GDPR or UK GDPR.

This policy should be read together with any cookie notice, Terms & Conditions and other privacy information presented at the point where information is collected.

Quick links

1. Responsible Party

For purposes of POPIA, 4TM is the responsible party for personal information where it determines why and how that information is processed.

Operational contact and Information Officer details are made available separately through the appropriate website, privacy-request or regulatory channels and are intentionally not reproduced in this policy.

2. What Is Personal Information?

Personal information is information relating to an identifiable person or, where applicable under POPIA, an identifiable juristic person.

Depending on the interaction, this may include:

  • name;
  • business name;
  • telephone number;
  • email address;
  • billing information;
  • delivery information;
  • account information;
  • order history;
  • project information;
  • correspondence;
  • technical identifiers;
  • online activity;
  • preferences.

Information that has been irreversibly de-identified so that it can no longer reasonably be linked to an identifiable person is not treated as personal information in the same way.

3. Information You Provide Directly

We may collect information that you provide when you:

  • place an order;
  • create or update an account;
  • request a quotation;
  • submit a contact form;
  • request support;
  • provide delivery instructions;
  • request a custom product;
  • submit artwork or production files;
  • enquire about business services;
  • make a rental or event enquiry;
  • participate in a promotion;
  • provide feedback;
  • submit a review;
  • communicate with us through available channels.

The exact information collected depends on what you ask us to do.

4. Identity and Contact Information

We may process information such as:

  • first and last name;
  • business or organisation name;
  • job role where relevant;
  • email address;
  • telephone number;
  • account username;
  • preferred communication method.

This information may be used to identify the customer, communicate about an enquiry or order and provide the requested service.

5. Order and Transaction Information

When you purchase a product or service, we may process:

  • products ordered;
  • quantities;
  • selected options;
  • order value;
  • payment status;
  • discounts;
  • invoices;
  • transaction references;
  • order history;
  • returns;
  • refunds;
  • warranty or defect claims.

Payment-card information is generally processed by the applicable payment service provider rather than stored directly by 4TM in full.

6. Billing and Delivery Information

We may collect information needed to fulfil an order, including:

  • billing details;
  • delivery address;
  • recipient details;
  • delivery instructions;
  • access information;
  • building or estate access information;
  • preferred delivery date or window;
  • courier information;
  • proof of delivery.

For furniture or bulky deliveries, additional access information may be requested where necessary to plan a safe delivery.

7. Project, Production and Quotation Information

Customers requesting custom or B2B work may provide information such as:

  • product requirements;
  • dimensions;
  • quantities;
  • drawings;
  • photographs;
  • artwork;
  • logos;
  • sketches;
  • specifications;
  • CAD or production files;
  • finish selections;
  • material information;
  • delivery requirements;
  • site information;
  • project notes;
  • approval records.

Some project information may not itself be personal information, but it will be protected appropriately where it forms part of a customer record or contains confidential information.

8. Rental and Event Information

Where rental, event or experience services are offered, we may collect information such as:

  • event date;
  • venue information;
  • delivery and collection requirements;
  • booking contact;
  • access instructions;
  • selected rental items;
  • setup requirements;
  • event-related notes.

We collect only the information reasonably required to quote, plan, deliver and administer the relevant booking.

9. Communications

We may retain communications exchanged through available business channels, including:

  • website forms;
  • email;
  • messaging services;
  • telephone records or call notes;
  • quotation discussions;
  • support conversations;
  • approval messages;
  • customer-service correspondence.

This helps us maintain an accurate record of requests, specifications, approvals and support history.

10. Information Collected Automatically

When a person visits or interacts with our website, systems and service providers may automatically collect technical information such as:

  • IP address;
  • browser type;
  • device type;
  • operating system;
  • referring page;
  • pages viewed;
  • approximate region derived from technical information;
  • session information;
  • website interactions;
  • timestamps;
  • cookie or similar identifiers.

This information may be used for website functionality, security, fraud prevention, analytics, performance monitoring, user-experience improvement and marketing where lawfully permitted.

11. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage and similar technologies.

Essential Technologies

Used for functions such as:

  • shopping cart;
  • checkout;
  • login;
  • security;
  • fraud prevention;
  • privacy preferences;
  • session management.

Analytics Technologies

Used to understand:

  • visitor numbers;
  • page performance;
  • navigation;
  • website usage;
  • conversion performance.

Marketing Technologies

Where enabled and lawfully permitted, these may be used to:

  • measure advertising;
  • understand campaign performance;
  • personalise marketing;
  • limit repeated advertising;
  • create or measure audiences.

Where consent is legally required, non-essential technologies will be handled in accordance with the applicable consent requirements.

Users may also control certain technologies through browser settings or any privacy controls made available on the website.

12. Information From Third Parties

We may receive limited personal information from third parties where reasonably necessary to operate the business.

These may include:

  • e-commerce platforms;
  • payment providers;
  • courier and logistics providers;
  • communication platforms;
  • marketing platforms;
  • analytics providers;
  • social-media platforms;
  • professional advisers;
  • fraud-prevention providers;
  • business customers or authorised representatives.

We will process third-party information only where there is a lawful basis or other lawful justification for doing so.

13. Why We Process Personal Information

Personal information may be processed to:

  • respond to enquiries;
  • prepare quotations;
  • create customer accounts;
  • process orders;
  • process payments;
  • manufacture or configure products;
  • provide services;
  • arrange deliveries and collections;
  • administer rentals;
  • manage returns and refunds;
  • manage warranty or defect claims;
  • communicate project approvals;
  • provide support;
  • maintain transaction records;
  • prevent fraud;
  • secure systems;
  • improve products and services;
  • analyse website performance;
  • comply with legal, tax and accounting obligations;
  • establish, exercise or defend legal rights;
  • send lawful marketing communications;
  • manage supplier and customer relationships.

We seek to process only information that is adequate, relevant and reasonably necessary for the relevant purpose.

14. Lawful Grounds for Processing

Depending on the circumstances and applicable law, processing may be based on one or more of the following:

  • the information is necessary to enter into or perform a contract;
  • the person has consented;
  • processing is required by law;
  • processing protects a legitimate interest of the person concerned;
  • processing is necessary to pursue a legitimate interest of 4TM or a third party, where permitted;
  • another lawful basis recognised by applicable privacy law applies.

Where processing relies on consent, consent may generally be withdrawn, subject to legal and contractual limitations and without affecting processing that was lawful before withdrawal.

15. Information Required to Complete a Transaction

Some information is necessary to:

  • create an order;
  • process payment;
  • manufacture a product;
  • provide a quotation;
  • perform a service;
  • arrange delivery;
  • administer a rental;
  • comply with law.

If required information is not provided, we may be unable to provide the requested product or service.

Where information is optional, the person may choose not to provide it.

16. Special Personal Information

We do not intentionally request special personal information unless it is genuinely necessary and lawful for a specific purpose.

Customers should avoid including unnecessary sensitive information in:

  • free-text fields;
  • drawings;
  • uploads;
  • photographs;
  • messages;
  • project files.

If sensitive information is supplied inadvertently, it will be handled according to applicable law and the circumstances.

17. Children's Personal Information

Our general commercial website and services are not designed for children to independently enter into transactions.

We do not intentionally collect children's personal information without an appropriate lawful basis or the involvement of a competent person where required.

If it appears that children's personal information has been provided inappropriately, reasonable steps may be taken to restrict, delete or otherwise lawfully handle it.

18. Payment Information

Payments may be processed through third-party payment providers and e-commerce infrastructure.

Depending on the payment method, the payment provider may independently collect information required to:

  • authorise payment;
  • detect fraud;
  • process refunds;
  • comply with financial regulations.

4TM does not ordinarily store complete payment-card numbers or card security codes where these are handled directly by the payment provider.

Payment providers process information according to their own legal obligations and privacy terms.

19. E-Commerce Platform

The website may use third-party e-commerce infrastructure, including Shopify or similar platform services, to provide:

  • storefront functionality;
  • checkout;
  • account services;
  • hosting;
  • order management;
  • security;
  • integrations.

Such providers may process personal information as part of providing their services.

Their own privacy notices may also apply to their processing activities.

20. Service Providers and Operators

We may use trusted service providers or operators to process information on our behalf.

These can include providers of:

  • website hosting;
  • e-commerce systems;
  • payment processing;
  • cloud storage;
  • communications;
  • accounting;
  • customer management;
  • couriers;
  • transport;
  • analytics;
  • marketing technology;
  • IT support;
  • cybersecurity;
  • file storage;
  • professional services.

We seek to provide these parties only with information reasonably necessary for the relevant service and to use appropriate contractual or other safeguards where required.

21. Couriers, Transport and Delivery Partners

Where delivery or collection is required, relevant information may be shared with:

  • couriers;
  • freight companies;
  • drivers;
  • delivery teams;
  • logistics coordinators;
  • specialist delivery contractors.

Information shared may include:

  • recipient name;
  • address;
  • telephone number;
  • delivery instructions;
  • access information;
  • order or package information reasonably required for fulfilment.

22. Professional Advisers

Where reasonably necessary, information may be shared with professional advisers such as accountants, auditors, legal advisers, insurers and consultants.

Such sharing may take place for legitimate business administration, compliance, dispute resolution or legal purposes.

23. Legal and Regulatory Disclosure

We may disclose personal information where reasonably necessary or legally required to:

  • comply with legislation;
  • comply with a lawful court order;
  • respond to a regulator;
  • prevent or investigate fraud;
  • enforce contractual rights;
  • defend legal claims;
  • protect the safety or rights of people, property or systems.

Only information reasonably relevant to the purpose should be disclosed.

24. Sale, Restructuring or Transfer of Business

If a business, business unit or relevant asset is reorganised, merged, financed, sold or transferred, personal information connected to that activity may form part of the transaction where lawfully permitted.

Appropriate confidentiality and data-protection measures should be used where required.

25. We Do Not Sell Personal Information as a Data Product

4TM does not operate a business model based on selling or renting customer personal information as a standalone data product.

Information may nevertheless be shared with service providers and other parties for the legitimate operational purposes described in this policy.

26. Direct Marketing

We may communicate information about products, services or updates where permitted by law.

For unsolicited electronic direct marketing, we will apply the requirements of POPIA and other applicable law.

Depending on the circumstances:

  • consent may be required;
  • an existing-customer relationship may permit marketing of our own similar products or services subject to legal conditions;
  • recipients must be provided with a reasonable way to object or unsubscribe where required.

Marketing objections and unsubscribe requests will be respected as required by law.

Transactional communications about an existing order, quotation, delivery, account or service are not treated in the same way as promotional marketing.

27. Marketing Preferences

A person may generally:

  • unsubscribe using the mechanism in the communication;
  • update available marketing preferences;
  • object to qualifying direct marketing;
  • withdraw marketing consent where consent is the basis for the communication.

An opt-out from marketing does not prevent necessary service communications relating to an active transaction or legal obligation.

28. Analytics and Performance

We may use aggregated or personal information, where lawfully permitted, to understand:

  • which pages are useful;
  • where visitors encounter errors;
  • how customers find the website;
  • which products receive interest;
  • how the checkout performs;
  • how marketing campaigns perform.

Where possible and appropriate, analytics may be aggregated, minimised or de-identified.

29. Fraud Prevention and Security

Information may be processed to:

  • detect suspicious transactions;
  • prevent account abuse;
  • protect payment systems;
  • identify malicious website activity;
  • investigate security incidents;
  • enforce access controls;
  • protect customers and business systems.

This may involve automated security tools supplied by e-commerce, payment or security providers.

30. Automated Processing

Certain systems may use automated rules or algorithms for functions such as:

  • payment screening;
  • fraud detection;
  • spam prevention;
  • security;
  • website personalisation;
  • analytics;
  • order routing.

Where applicable law creates rights relating to decisions based solely on automated processing that produce legal or similarly significant effects, those rights will be respected.

31. Data Quality

We take reasonably practicable steps to keep personal information complete, accurate, not misleading and appropriately updated where necessary for the purpose.

Customers should update important account, delivery or project information when it changes.

32. Data Minimisation

We aim not to collect or retain more personal information than is reasonably needed for the relevant purpose.

Customers should avoid supplying unnecessary personal information within production files, artwork, CAD files, photographs or project notes.

33. Security Safeguards

We use reasonable technical and organisational safeguards appropriate to the nature of the information and foreseeable risks.

Measures may include:

  • access controls;
  • authentication;
  • secure platforms;
  • encryption where appropriate;
  • account permissions;
  • backups;
  • software updates;
  • service-provider security controls;
  • monitoring;
  • staff or contractor access restrictions.

No system can be guaranteed to be completely secure.

Security measures are therefore reviewed and adjusted in response to changing risks where reasonably practicable.

34. Security Incidents

If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, the incident will be assessed and handled in accordance with applicable law.

Where legally required, notification may be made to the Information Regulator, affected data subjects or other relevant authorities.

Notification may be delayed where lawful authorities require or permit a delay.

35. Data Retention

Personal information is retained only for as long as reasonably necessary for:

  • the purpose for which it was collected;
  • order and customer administration;
  • warranty and support;
  • legal obligations;
  • tax and accounting requirements;
  • dispute resolution;
  • fraud prevention;
  • contract enforcement;
  • recordkeeping.

Different categories of information may therefore have different retention periods.

When information is no longer required and there is no lawful reason to retain it, reasonable steps will be taken to delete, destroy or de-identify it.

36. Order and Accounting Records

Certain order, invoice, payment and accounting records may need to be retained for periods required by tax, accounting, corporate or other legislation.

A deletion request does not require information to be deleted where another law requires or lawfully permits its continued retention.

37. Project and Production Records

Project information may be retained where reasonably necessary for:

  • repeat orders;
  • warranty history;
  • manufacturing traceability;
  • customer approvals;
  • dispute resolution;
  • legitimate recordkeeping.

Personal information within those records remains subject to applicable privacy requirements.

Ownership of drawings, designs, artwork, production files and intellectual property is governed separately by the Terms & Conditions and applicable agreements.

38. International Processing and Transfers

Some technology, cloud, payment, e-commerce or service providers may process information outside South Africa.

Where personal information is transferred outside South Africa, we will seek to rely on a lawful basis permitted by POPIA, which may include:

  • adequate protection under law or binding arrangements;
  • consent where appropriate;
  • transfer required to perform a contract;
  • another basis permitted by section 72 of POPIA.

Where the GDPR or UK GDPR applies, any additional cross-border transfer requirements applicable to that processing will also be considered.

39. Access to Personal Information

Subject to applicable law, a person may request confirmation of whether personal information concerning them is held and may request access to that information.

Access requests may be subject to:

  • identity verification;
  • lawful grounds for refusal;
  • the rights of other persons;
  • applicable PAIA procedures;
  • legally permitted fees where relevant.

Privacy and information-access requests should be submitted through the privacy or contact channel published on the website.

40. Correction of Personal Information

A data subject may request correction of personal information that is, for example:

  • inaccurate;
  • irrelevant;
  • excessive;
  • out of date;
  • incomplete;
  • misleading;
  • unlawfully obtained.

Requests will be considered and handled as required by POPIA and applicable regulations.

41. Deletion or Destruction Requests

A data subject may request deletion or destruction of qualifying personal information where 4TM is no longer authorised to retain it.

A deletion request may not always result in immediate deletion where information must lawfully be retained for purposes such as tax, accounting, legal compliance, dispute resolution, contract enforcement, fraud prevention or another lawful retention purpose.

Where deletion is appropriate, it will be handled in accordance with applicable law.

42. Objection to Processing

Where POPIA permits a data subject to object to particular processing, the objection may be submitted through the privacy-request channel made available on the website.

The objection will be assessed according to the purpose of processing, the lawful basis relied upon and applicable statutory requirements.

43. Withdrawal of Consent

Where processing is based specifically on consent, consent may generally be withdrawn.

Withdrawal applies prospectively, does not make earlier lawful processing unlawful and may affect our ability to provide an optional service that depends on that consent.

44. Additional Rights Where GDPR Applies

Where the EU GDPR or UK GDPR applies to a particular processing activity, additional rights may include, subject to the relevant law:

  • access;
  • rectification;
  • erasure;
  • restriction;
  • objection;
  • data portability;
  • withdrawal of consent;
  • rights relating to qualifying automated decision-making;
  • complaint to a competent supervisory authority.

These rights apply only where the relevant legislation applies to the particular person and processing activity.

45. Identity Verification

Before actioning a privacy request, reasonable information may be requested to verify identity, authority to act on behalf of another person and the account or record to which the request relates.

This is intended to prevent unauthorised access, alteration or deletion of personal information.

Only information reasonably necessary for verification should be requested.

46. Requests Made on Behalf of Another Person

A person submitting a privacy request on behalf of another person may be required to provide appropriate proof of authority.

Requests involving children, estates, companies or representatives will be handled according to the applicable legal requirements.

47. Information Regulator

A person who believes that personal information has been processed in contravention of POPIA may have the right to lodge a complaint with the Information Regulator (South Africa).

Current complaint procedures and official contact information are available from the Information Regulator through its official channels.

The existence of this complaint right does not prevent a person from first raising the issue directly through the privacy channel made available on the 4TM website.

48. Third-Party Websites and Services

Our website may contain links to websites, platforms or services operated by third parties.

4TM does not control the independent privacy practices of those third parties.

Users should review the relevant third-party privacy notice before providing personal information directly to an external service.

49. Social Media

Interaction with 4TM through a social-media platform may involve processing by both 4TM and the relevant social-media provider.

The platform's own privacy terms govern its independent processing.

Information posted publicly on social media should be treated as public according to the settings and nature of the platform.

50. Reviews, Testimonials and Customer Content

Where customers submit reviews, photographs, testimonials or other content, that information will be processed for the purpose for which it was submitted or otherwise lawfully agreed.

Personal information will not knowingly be published beyond the scope reasonably expected or agreed.

Separate permission may be requested where customer content is intended for promotional use outside its original context.

51. Confidential Commercial Information

A project may include information that is commercially confidential but is not personal information.

Examples may include:

  • technical drawings;
  • pricing structures;
  • product concepts;
  • manufacturing specifications;
  • brand assets.

Such information may also be protected under contractual confidentiality, intellectual-property or other legal arrangements.

This Privacy Policy governs personal information and does not replace those separate contractual protections.

52. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in:

  • legal requirements;
  • technology;
  • service providers;
  • website functionality;
  • business processes;
  • privacy practices.

The Last updated date will be revised when the policy is materially updated.

Where required by law, additional notice or consent will be obtained for a material change in processing.

53. Privacy Requests

Privacy requests, including requests for access, correction, deletion, objection, withdrawal of consent, marketing opt-out or information about processing, should be submitted through the privacy or contact channel published on the website.

This policy intentionally does not reproduce physical addresses, personal contact details or operational contact details.

Summary

4TM may process personal information to:

  • operate the website;
  • respond to enquiries;
  • quote and manufacture work;
  • process orders and payments;
  • deliver products;
  • administer rentals and services;
  • support customers;
  • maintain lawful business records;
  • secure systems;
  • improve the customer experience;
  • send lawful marketing.

We aim to collect only what is reasonably necessary, protect it appropriately, retain it only for a lawful period and respect the rights provided by applicable privacy law.

If any provision of this policy conflicts with a mandatory data-protection requirement, the applicable legal requirement will prevail.