Last updated: 12 October 2026

This policy explains how Lema International Trading (Pty) Ltd (“Lema”, “we”, “our”) collects, uses, shares and protects personal information. It applies when you visit www.lema.co.za, open a customer or trade account, place an order or ask for a quote, shop through your organisation’s purchasing system, or contact us. We process personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). POPIA also protects information about companies and other juristic persons, so this policy covers your organisation’s details as well as your own.

Who we are

Lema is the responsible party for the personal information described in this policy. This means we decide why and how it is processed.

  • Responsible party: Lema International Trading (Pty) Ltd
  • Physical address: 28 Raft Street, Laser Park, Honeydew, Johannesburg, 2170
  • Telephone: +27 11 794 2024
  • Website: www.lema.co.za

Information officer

Our information officer handles privacy questions, requests and complaints.

What personal information we collect

We collect only what we need for the purposes set out in this policy. Fields marked as required on our forms are needed to open an account, process an order or answer an enquiry. If you leave them out, we cannot provide that service. Everything else is optional.

Accounts and trade applications

  • Your name, e-mail address, telephone number and username.
  • Your password. It is stored in a scrambled (hashed) form that our staff cannot read.
  • The account type you apply for, and your company name and street address.
  • Your billing address and any delivery addresses saved to your account, including addresses that your organisation or Lema adds for you.
  • The customer group and price list your account belongs to, and the products and catalogues assigned to it.

Orders, quotes and delivery

  • Contact, billing and delivery details for each order or quote.
  • The products, quantities, prices and delivery method you choose, your preferred delivery date, order notes and references, and how an order is split across delivery addresses.
  • Your order and quote history.
  • The IP address and browser details recorded with each order, and how you arrived at the website (for example from a search engine or a link), recorded by our shop software when you place an order.

Payments

If you order through PunchOut from your company’s purchasing system, payment is handled by that system under your company’s agreement with Lema. Nothing is paid on this site.

Online payments are processed by Ozow, a payment service provider. You enter your banking details on Ozow’s pages, not ours. We do not receive or store your bank login details or card numbers. We receive the payment reference, amount and status so that we can match the payment to your order.

Purchasing-system (PunchOut) connections

Some organisations buy from us through their own procurement software, using a PunchOut connection. When you open our website from your organisation’s purchasing system, that system sends us:

  • an identifier for you, usually your work e-mail address, user name or employee ID, and your name where the system sends it;
  • your organisation’s connection identity and a reference for the shopping session; and
  • the address to which we return your cart.

We use this to sign you in to a buyer account linked to your organisation. When you finish, we send your cart back to your purchasing system for approval: products, quantities, prices, the delivery address you chose, your preferred delivery date and your notes. We keep a record of each session and each cart returned, so that the prices quoted to a buyer at a given time can be checked later.

Artwork and other files

You can send us logos, artwork, delivery split sheets and other files, at checkout or by e-mail. These files can contain personal information, such as names, photographs or contact details. We use them only to quote for, produce and deliver your order.

Enquiries

When you contact us through the contact form, by e-mail or by telephone, we keep your name, e-mail address, company, telephone number and what you tell us.

Website cookies and logs

When you visit the website, our server and security services record technical information: your IP address, the date and time, the pages you request, the page you came from, and your browser and device type. Requests that look like attacks are logged and may be blocked. The cookies we use are listed under Cookies below.

Information we do not ask for

We do not ask for special personal information as POPIA defines it, such as information about health, religion, race, political views, biometrics or criminal behaviour. Please do not include it in messages or files you send us.

Where we get it

  • From you, when you apply for an account, order, upload a file or contact us.
  • From your organisation, when it opens a trade account or PunchOut connection with us and gives us the names, contact details and delivery addresses of its buyers.
  • From your organisation’s purchasing system, each time you shop through a PunchOut connection.
  • From our service providers, for example payment status from Ozow and delivery status from couriers.
  • From your device, through cookies and server logs when you use the website.

Why we use it and on what legal basis

Section 11 of POPIA allows processing only on certain grounds. We rely on the following:

  • To open and run your account, process orders and quotes, take payment, produce branded goods, arrange delivery and handle returns. Where you are the customer, this is necessary to conclude or perform our contract with you (section 11(1)(b)). Where you buy for an organisation, it is in the legitimate interests of your organisation and Lema in carrying out their contract (section 11(1)(f)).
  • To assess trade account applications and set the right prices and product ranges for each account. Steps you ask us to take before entering a contract, and our legitimate interests (sections 11(1)(b) and 11(1)(f)).
  • To run PunchOut connections and return carts to your organisation’s purchasing system. The legitimate interests of your organisation and Lema in their supply arrangement (section 11(1)(f)).
  • To answer enquiries. Steps you ask us to take, and our legitimate interest in responding (sections 11(1)(b) and 11(1)(f)).
  • To keep accounting, tax and company records. Compliance with the law (section 11(1)(c)).
  • To keep the website secure, prevent fraud and fix faults, and to understand how customers find the website. Our legitimate interests (section 11(1)(f)).
  • To send direct marketing. Your consent, or the customer rule in section 69(3). See Direct marketing below.
  • To protect our legal rights, for example in a dispute about an order. Our legitimate interests (section 11(1)(f)).

We do not use personal information for purposes that are unrelated to these without telling you first, or without another lawful basis.

Who we share it with

We do not sell personal information. Authorised Lema staff can see account details and orders, and can view the website as your account sees it to help with an order or a problem. We share personal information outside Lema only as follows:

  • Website hosting and support: the company that builds, hosts and maintains our website and its server.
  • Cloudflare: a network service that protects the website against attacks and delivers its pages. All visits to the website pass through it.
  • Ozow: to process online payments.
  • Couriers: the recipient’s name, delivery address and telephone number, so that they can deliver your order.
  • Suppliers and subcontractors: where a supplier delivers goods to you directly or a subcontractor helps to produce or brand your order, the details they need to do so.
  • Banks: to receive payments and pay refunds.
  • E-mail service providers: to send order confirmations, account messages and our replies.
  • Your organisation: when you shop through a PunchOut connection, your cart and order details go back to your organisation’s purchasing system.
  • Professional advisers and insurers: our auditors, accountants, lawyers and insurers, where they need it to advise or insure us.
  • Authorities: the South African Revenue Service, the police, courts or a regulator, where the law requires it.

Service providers who process personal information for us are operators under POPIA. They may process it only with our knowledge or authorisation, must treat it as confidential and must keep it secure (sections 20 and 21).

Information sent outside South Africa

Our website and its database are hosted on a server in Johannesburg. Cloudflare, Inc. is a United States company. It handles technical information about each visit, such as your IP address, browser details and the pages you request, and may process this information in data centres outside South Africa, including in the United States. Some of our other service providers, such as e-mail providers, may also process personal information outside South Africa.

Section 72 of POPIA limits transfers of personal information to other countries. We or our operators transfer personal information outside South Africa only where that section allows it, for example where the recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA, where the transfer is necessary to perform a contract with you, or where you consent.

How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it for, unless the law requires or allows us to keep it longer (section 14). Then we delete it, destroy it or remove the details that identify you.

  • Orders, quotes, invoices and payment records, including orders placed through PunchOut: seven years, as the Companies Act 71 of 2008 (section 24) requires. This also covers the five years the Tax Administration Act 28 of 2011 (section 29) requires. We keep them longer if a tax audit or a legal dispute needs them.
  • Account details: while your account is open. If you ask us to close your account, we delete your account details, except what we must keep as part of the order records above.
  • Trade applications we do not approve: 12 months after our decision.
  • Enquiries that do not lead to an account or order: two years after our last contact with you.
  • Artwork and other files: with the order they belong to, so that repeat orders match. Ask us and we will delete artwork you no longer want us to keep, unless it forms part of an order record we must keep.
  • Records of e-mails the website sends: 30 days.
  • Server and security logs: for a limited period, after which they are deleted automatically, unless we need them to investigate a security incident.
  • Marketing preferences: until you unsubscribe. We then keep a record of your opt-out so that we do not contact you again.

How we protect it

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures to protect personal information. Ours include:

  • encrypted (HTTPS) connections between your browser and the website;
  • passwords stored only in hashed form, and the credentials for purchasing-system connections stored encrypted;
  • access to customer information limited to staff and providers who need it, each with their own login;
  • a firewall, attack filtering and malware scanning on the website and its server; and
  • payments handled by Ozow, so that banking details never reach our systems.

If we have reasonable grounds to believe that someone has accessed or acquired your personal information without authority, we will tell the Information Regulator and you as soon as reasonably possible, as section 22 requires.

Keep your password private and log out on shared devices. Tell us straight away if you think someone else has used your account.

Your rights

Under POPIA you can ask us what personal information we hold about you, ask us to correct or delete it, object to some processing, and complain to the Information Regulator. Send requests to our information officer at [email protected], by hand or courier to our address, or through our contact page. You do not have to use a particular form. We may ask you to prove your identity before we act on a request, so that we do not give your information to someone else.

Access

You can ask us to confirm, free of charge, whether we hold personal information about you (section 23). You can also ask for a copy of it, or a description of it, and for the identity or categories of the third parties who have had access to it. Requests for copies follow the Promotion of Access to Information Act 2 of 2000 (PAIA). Our PAIA manual explains the process, the request for access page has the form, and the outcome of request page explains how we respond and the fees that may apply. If a fee applies, we will give you a written estimate before we do the work.

Correction and deletion

You can ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and to destroy or delete records we are no longer allowed to keep (section 24). This is free. We will tell you in writing what we have done within 30 days. Where the law requires us to keep a record, we will tell you so. You can also update most of your details yourself under My account.

Objection and withdrawing consent

You can object, on reasonable grounds relating to your particular situation, to processing we do on the basis of legitimate interests (section 11(3)). You can object to direct marketing at any time. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing that took place before you withdrew it.

Complaints

If you are unhappy with how we handle your personal information, please tell our information officer first so that we can try to put it right. You also have the right to complain to the Information Regulator (section 74). Complaints are made on the Regulator’s Form 5, which is on its website.

Direct marketing

We send marketing by e-mail, SMS or other electronic messages only as section 69 of POPIA allows:

  • to people who have opted in by giving their consent; or
  • to our customers, about our own similar products and services, where we gave them the chance to refuse such messages when we collected their details.

Every marketing message says that it comes from Lema and tells you how to stop further messages. Unsubscribing is free and does not affect your account or orders. Order confirmations, delivery updates and account messages are not marketing, and you will keep receiving them while you have an account or an open order.

Cookies

Cookies are small files that a website stores in your browser. We use cookies that the website needs to work, and WooCommerce’s order attribution cookies. We do not use advertising cookies or third-party analytics cookies.

  • Login cookies (names starting with wordpress_) keep you signed in. They last for two days, or 14 days if you tick “Remember me”, and are removed when you log out. A PunchOut session uses the same kind of cookie, which ends when the session ends.
  • Cart and session cookies (woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_) remember your cart and checkout details. They last up to two days, or up to seven days when you are signed in.
  • Order attribution cookies (names starting with sbjs_) record how you arrived at the website and how many pages you viewed. If you place an order, this is saved with it. They expire within 30 minutes of your last activity on the website.
  • Security cookies may be set by Cloudflare or by our server’s security service when they check that a visitor is not an automated program.

You can block or delete cookies in your browser settings. If you block the cookies the website needs, you will not be able to sign in or use the cart.

Our website links to catalogues on other websites. Those websites have their own privacy policies, and we are not responsible for how they use your information.

Children

Our website and services are for businesses and adults. We do not knowingly collect personal information about anyone under 18. If we learn that we hold a child’s personal information without the consent of a parent or guardian, as section 35 of POPIA requires, we will delete it.

Information about other people

If you give us personal information about someone else, such as a colleague who receives a delivery or a person named in artwork, make sure you are allowed to share it and that they know you are giving it to us for the purposes in this policy.

Changes to this policy

We update this policy when our practices or the law change. The date at the top shows when it last changed. If a change affects how we use information you have already given us, we will tell account holders by e-mail before the change applies.

Read this policy together with our terms and conditions and our refund and returns policy. For questions about this policy, contact our information officer or use our contact page.