Privacy policy
he CMF Group Website: www.cmfgroup.co.za Last updated: 11 June 2026
The CMF Group ("CMF Group", "we", "us", "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share and protect personal information when you interact with our website, our marketplace storefronts, our direct-to-consumer retail channel (including TrueTech.co.za), and our B2B distribution operations.
This policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African law.
1. Who we are
The CMF Group is a South African e-commerce and distribution group specialising in online retail, marketplace management, stock ownership, fulfilment, and brand growth.
Responsible Party (Data Controller): The CMF Group Unit 3, Galaxy Park, 17 Galaxy Avenue, Linbro Park, Sandton, 2090, South Africa Email: sales@cmfgroup.co.za Phone: 012 942 0018
Information Officer: [Insert name and email of designated Information Officer registered with the Information Regulator]
2. The personal information we collect
We collect only the personal information we need to operate our business, fulfil orders, comply with the law, and improve your experience. The information we collect includes:
Information you give us directly
- Identity and contact details: name, surname, email address, phone number, delivery and billing address.
- Account details: username, password, order history, wishlists, saved preferences.
- Payment information: processed by our payment service providers (we do not store full card details on our servers).
- B2B / trade customer details: company name, VAT number, company registration number, trading address, names and contact details of authorised representatives.
- Communications: any message you send us via our contact form, email, phone, or social media.
- Marketing preferences: newsletter sign-up, opt-ins for promotional communications.
Information collected automatically
- Device and connection data: IP address, browser type, operating system, device identifiers.
- Usage data: pages visited, products viewed, time on site, referral URLs.
- Cookies, pixels, and similar tracking technologies (see Section 7).
Information from third parties
- Order and customer information forwarded from third-party marketplaces on which we sell (for example Takealot, Makro, Amazon, Bob Shop and similar platforms) for the limited purpose of fulfilling your order and providing customer support.
- Fraud-prevention and identity-verification data from our payment processors.
- Delivery status updates from our courier and fulfilment partners.
3. How we use your personal information
We process personal information for the following purposes and on the following lawful grounds under POPIA:
| Purpose | Lawful basis |
|---|---|
| Processing and fulfilling orders, including delivery, returns, refunds, and customer support | Performance of a contract |
| Operating and maintaining our website and customer accounts | Legitimate interest / contract |
| Managing B2B trade accounts, credit applications, and account reconciliation | Performance of a contract / legitimate interest |
| Sending transactional communications (order confirmations, dispatch notifications, invoices) | Performance of a contract |
| Sending marketing communications and newsletters | Your consent |
| Personalising your experience and showing relevant products | Legitimate interest / consent |
| Analytics, performance measurement, and improvement of our services | Legitimate interest / consent (for non-essential cookies) |
| Detecting and preventing fraud, abuse, and security incidents | Legitimate interest / legal obligation |
| Complying with tax, accounting, consumer protection, and other legal obligations | Legal obligation |
You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
4. Marketing communications
If you have opted in to receive marketing from us, we may send you newsletters, promotions, product updates, and offers by email or SMS.
You can unsubscribe at any time by:
- clicking the "unsubscribe" link in any marketing email;
- updating your preferences in your account; or
- emailing sales@cmfgroup.co.za.
We will continue to send you transactional and service-related communications (for example, order confirmations) regardless of marketing preferences.
5. Who we share your information with
We do not sell your personal information. We share it only with the following categories of recipients, and only to the extent necessary:
- Shopify — our e-commerce platform, which hosts our website and processes orders.
- Payment providers — for example Payfast, Peach Payments, Yoco, Stripe, or similar, to process your payment securely.
- Courier and fulfilment partners — to deliver your order.
- Third-party marketplaces — where you have purchased from us via a marketplace such as Takealot, Makro, Amazon, or Bob Shop, that platform shares limited order information with us so we can fulfil and support your order.
- Analytics and marketing service providers — for example Google (Analytics, Ads), Meta (Facebook/Instagram Pixel), TikTok, and email service providers such as Klaviyo, Mailchimp, or Shopify Email.
- Professional advisors — auditors, accountants, lawyers, and insurers, where required.
- Regulators and law enforcement — where we are legally required or permitted to disclose.
- Acquirers — in the event of a sale, merger, restructuring, or transfer of all or part of our business.
We require all third parties to keep your personal information secure and to process it only for the purposes for which it was disclosed.
6. Cross-border transfers
Some of our service providers (including Shopify, Google, Meta, and email service providers) store and process personal information outside of South Africa. Where we transfer personal information across borders, we ensure that the transfer complies with Section 72 of POPIA — for example, by relying on the recipient being subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection.
7. Cookies and tracking technologies
Our website uses cookies and similar technologies to:
- keep you signed in and remember items in your cart;
- understand how visitors use our site (analytics);
- measure the performance of our advertising; and
- show you relevant products and ads on third-party platforms.
We use, among others, Google Analytics, Google Ads, Meta (Facebook) Pixel, and TikTok Pixel. These tools may set cookies that allow the relevant provider to track activity across multiple sites.
You can control cookies through your browser settings or via our cookie banner where displayed. Disabling certain cookies may affect site functionality.
8. How long we keep your information
We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, including:
- the period necessary to provide our products and services;
- the period required to comply with our legal, tax, accounting, and regulatory obligations (typically 5 years under South African tax and company law);
- the period necessary to defend or pursue legal claims; and
- in the case of marketing data, until you withdraw your consent.
After the applicable retention period, we securely delete or anonymise the information.
9. How we protect your information
We apply reasonable technical and organisational security measures to protect personal information against loss, unauthorised access, alteration, and disclosure. These include encrypted connections (HTTPS), access controls, secure hosting through Shopify, vetted payment providers, and staff confidentiality obligations.
No method of transmission or storage is completely secure. In the event of a security compromise involving your personal information, we will notify you and the Information Regulator as required by POPIA.
10. Your rights under POPIA
You have the right to:
- access the personal information we hold about you;
- request correction or deletion of inaccurate, irrelevant, excessive, or outdated information;
- object to processing of your information, including for direct marketing;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with the Information Regulator (details below); and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
To exercise any of these rights, contact us at sales@cmfgroup.co.za. We may need to verify your identity before responding. We will respond within a reasonable period, and in any event within the timeframes prescribed by POPIA.
11. Children
Our website and services are not directed at children under the age of 18. We do not knowingly collect personal information from children without parental or guardian consent. If you believe we have collected information from a child, please contact us so we can delete it.
12. Third-party links
Our website may contain links to third-party websites, including marketplaces and social media. We are not responsible for the privacy practices of those sites. Please review their privacy policies before providing personal information.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The latest version will always be available at www.cmfgroup.co.za. Material changes will be communicated via the website or by email where appropriate. The "Last updated" date at the top reflects the current version.
14. Contact us
For any privacy-related question, request, or complaint:
The CMF Group Unit 3, Galaxy Park, 17 Galaxy Avenue, Linbro Park, Sandton, 2090 Email: sales@cmfgroup.co.za Phone: 012 942 0018
Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: complaints.IR@justice.gov.za Website: https://inforegulator.org.za