Privacy Notice

Protection of Personal Information Act 4 of 2013 (POPIA) · Last updated 30 October 2026

This notice explains what personal information Khethokuhle Prism Stones collects when you use keys.khethokuhle.com or our auto key services, why we collect it, how we protect it and what your rights are. It is given in terms of section 18 of POPIA.

In short

We only collect what we need to quote, verify ownership, make your key and meet our legal duties.
We never sell your information.
The law requires locksmiths to keep proof of identity and authority for at least three years, so we keep those records securely for that period.

1Who we are

Responsible party: Khethokuhle Prism Stones [legal status and registration number]
Information Officer: [name; registered with the Information Regulator]
Address: [physical address]
Contact: info@khethokuhle.com · +27 61 436 9339

2What we collect

Contact details: name, phone or WhatsApp number, email address.
Vehicle details: make, model, year, VIN, key code, and where the vehicle is.
Proof of identity and authority: copies of your ID, driver's licence or passport, vehicle registration certificate, and for businesses, mandate letters, stock records or court orders.
Job and payment records: quotes, invoices, payment confirmations and notes of what we did.
Messages you send us by WhatsApp, email or phone.

The key code and VIN are sensitive security information. We treat them with the same care as a physical key.

3Why we use it, and on what basis

To quote for and carry out your job: needed to conclude and perform our agreement with you (POPIA section 11(1)(b)).
To verify identity and ownership and keep records: required by law under the Private Security Industry Regulation Act 56 of 2001 and the Code of Conduct for Security Service Providers (section 11(1)(c)).
To prevent fraud and vehicle theft, and to report suspected crime to the South African Police Service: our legitimate interest and a legal duty (sections 11(1)(c) and (f)).
To keep financial records as required by tax law.
To answer your questions and complaints.

We do not use your information for unrelated marketing. If we would ever like to send you offers, we will ask for your consent first, and you can say no at any time.

4Who we share it with

The authorities, such as PSIRA or the South African Police Service, when the law requires it or to report suspected fraud or theft.
Service providers who help us run the business, such as our email and web host, accountant and the messaging service you choose to contact us on. They may use your information only to provide their service to us.
The business that instructed us, for example a dealership or bank, when the job is done on its behalf.

We never sell or rent personal information.

5Information that leaves South Africa

If you contact us by WhatsApp or certain email services, your messages may be processed on servers outside South Africa by those providers. They are subject to data protection laws or binding rules that give protection similar to POPIA (section 72). If you prefer, you can share documents with us in person at hand-over instead.

6How long we keep it

Proof of identity and authority: at least three years, as the Code of Conduct for Security Service Providers requires.
Invoices and financial records: five years, as tax law requires.
Requests that did not become a job: deleted within 6 months.

When a retention period ends, we delete or destroy the records securely.

7How we protect it

We keep documents and key codes in password-protected, access-controlled storage, limit access to the people who need it to do your job, and do not keep key codes on paper in vehicles. If we believe your personal information has been accessed without authority, we will tell you and the Information Regulator as POPIA requires.

8This website

The quote form runs in your browser. Nothing you type is sent to us or stored until you choose to send the message it prepares by WhatsApp or email. Documents you select stay on your device.
We do not use advertising or tracking cookies.
The website loads fonts from Google Fonts, which means your browser's IP address is shared with Google when the page loads.

9Your rights

You have the right to:

ask whether we hold information about you and get a copy of it;
ask us to correct or delete information that is wrong, out of date or that we are not entitled to keep (some records must be kept for the periods in section 6);
object to the processing of your information on reasonable grounds;
withdraw consent where we rely on it; and
complain to the Information Regulator (inforegulator.org.za).

To use any of these rights, contact our Information Officer at info@khethokuhle.com. We will ask you to confirm your identity first.

10Changes

We may update this notice. The current version is always on this page, with the date it was last updated.