OAK RIDGE FARM · SOUTH AFRICA
Your privacy at the farm.
Effective version: 2026-09-16
This notice explains how Aubrey Kurten, trading as Oak Ridge Farm, handles personal information under the Protection of Personal Information Act, 2013 (POPIA). The contact details of the responsible party are below.
Our South African service
Accounts, orders, subscriptions and incubation enquiries are intended only for people aged 18 or older who are in South Africa and requesting services in South Africa. We do not offer international fulfilment. If you are outside South Africa, please do not register or submit a service request. Browsing from abroad does not remove any privacy rights you may have.
What we collect and why
| Information | Purpose and whether it is needed |
|---|---|
| Name, email and account credentials | To create and secure your account, verify your email, and respond to you. Name and email are required for an account. Passwords are handled by our authentication provider, not displayed to farm staff. |
| Phone number | Optional contact method for arranging your request. You can leave it blank. |
| Basket, box choices, quantities, collection preferences and delivery area | To assess and fulfil your request. A delivery area is needed only for delivery enquiries; we ask for an exact address later only if a delivery is agreed. |
| Egg type, breed if known, egg count and incubation preferences | To assess capacity and agree incubation arrangements. Additional notes are optional. |
| Agreed orders, subscriptions, hatch results and payment status | To administer services and keep necessary business records. We do not take online card payments or request card details in these forms. |
| Terms/privacy versions, declarations, request references and timestamps | To record what you requested and the notices and terms you acknowledged. We do not store a date of birth or use ID documents to check the adult-use declaration. |
| Technical and security information | Our infrastructure providers may process IP addresses, browser/device information and security logs to deliver and protect the service. We do not use them for advertising profiling. |
We collect information directly from you or from activity in your account. You can browse without an account. If you do not provide information needed for a particular request, we may be unable to provide that service. Do not submit another person’s information without authority, or put ID numbers, financial credentials, children’s details or health information in notes.
Our reasons for processing
We process necessary account and service information to take steps you request towards a contract and to perform agreed services. We also process information where required by law and for legitimate interests such as securing the service, preventing misuse and resolving disputes, subject to your rights under POPIA. Where a purpose requires consent, we will ask separately and explain how to withdraw it. Reading this notice is not blanket consent to every use of your information.
Sharing and service providers
Access is limited to authorised farm personnel and service providers needed to run the service. Supabase provides the database and authentication. After optional analytics permission, PostHog receives public page-view paths and technical request information. A website host and an email-delivery provider may handle information needed to serve pages and send account messages; the production providers and transfer arrangements must be confirmed before online collection opens. We may share the minimum required information with a delivery provider if you agree to delivery, or with professional advisers and authorities where legally necessary.
We do not sell personal information, run advertising trackers, subscribe customers to marketing through these forms, or send customer account/request records to AI models for training. Optional PostHog public-page analytics starts only when you choose it. You may separately allow masked recordings of browsing pages to help us find usability problems. These recordings exclude account, enquiry and basket screens; input values and on-page text are masked, and URL query strings are removed. PostHog automated tools may analyse permitted masked recordings to highlight site problems. We do not identify customers to PostHog or send account IDs or form answers. Automatic click and browser error capture are disabled. You can refuse or withdraw either permission through Analytics settings in the footer or cookies page. PostHog may process an IP address or device details when your browser contacts its service. Account verification, password resets and messages about a request are service communications, not newsletter subscriptions. Links to WhatsApp are optional and open a separate service with its own privacy terms.
Processing outside South Africa
Using a South African service does not mean all technology is located in South Africa. Supabase, PostHog and other infrastructure providers may process or support information in other countries. The selected PostHog project region must be confirmed before launch; the current setup is expected to be US Cloud. Before enabling online collection, we must document the selected hosting locations, operators and a lawful transfer basis under section 72 of POPIA. A South African governing-law clause does not itself authorise an overseas data transfer. You can ask our privacy contact for the applicable providers, locations and safeguards.
Retention and protection
We retain information only while needed for its stated purpose or for applicable legal, accounting or dispute requirements. Enquiries that do not proceed, inactive accounts, service records and security logs require different retention periods. Records under a legal hold may need to be retained longer. The operational retention schedule and provider backup periods must be confirmed before online collection opens; deletion requests are assessed against these requirements.
Controls include encrypted connections in production, verified account access, database access rules, restricted administration and validation of requests. No internet service can promise absolute security. If a security compromise occurs, we will assess and make notifications required by POPIA.
Your choices and rights
You can request confirmation of the information held about you, access to it, correction of inaccurate information, deletion or destruction where applicable, and object to processing on grounds provided by POPIA. You can withdraw consent where processing relies on it, without invalidating earlier lawful processing or preventing processing supported by another lawful basis.
In your account, you can edit your name/phone, download the farm records available there, or lodge a privacy or account-closure request. This download does not necessarily include every infrastructure log or record held outside this website; contact us for a fuller access request. Email admin@oakridgefarm.online if you cannot sign in. Do not email an ID copy unless we have explained why a proportionate identity check is needed.
We may need to verify your identity and clarify the request. We will explain any lawful reason for retaining or restricting access to information, and respond under applicable POPIA/PAIA procedures. A deletion request is not an automatic erasure of required transaction records.
Complaints
You may contact us first, but this does not prevent you from approaching the Information Regulator South Africa directly: inforegulator.org.za, enquiries@inforegulator.org.za, telephone 010 023 5200. The Regulator provides POPIA objection, correction/deletion and complaint forms.
Changes and browser storage
We date our notices and record the versions acknowledged when you create an account or submit a request. Material changes will be brought to your attention when relevant. See cookies and device storage for session and draft controls. This notice does not waive any statutory rights.