ProductionRun Privacy Policy
Version 2026-10-v1 · Effective 18 October 2026
1. Who we are
ProductionRun is operated by AfroQuest Brand Managers (Pty) Ltd (registration number 2026/622999/07), the responsible party for the personal information described in this policy.
Business address: 5 Loerie Road, Randpark Ridge, Randburg, 2169, South Africa
Website: https://production-run.afroquest.dev/
2. Our Information Officer
Our Information Officer is Edgar Dzimiri. He was appointed on 5 August 2026, and our organisation is registered with the Information Regulator (registration 2026-069311).
- Email: privacy@afroquest.co.za
- Phone: +27 79 092 9972
Our PAIA manual is at https://production-run.afroquest.dev/paia-manual.
3. What personal information we collect, and where it comes from
| Who | What we collect | Source |
|---|---|---|
| Customers | Email address and password (stored only as a secure hash by our authentication provider); name, phone number and delivery address or location you give us; your production requests, specifications and deadlines; artwork files you upload; messages on a job; quotes, orders and payment records; call-back requests and reasons you give for cancelling. | You |
| Customers paying online | Payment status and the reference, amount, fee and buyer name and email that PayFast sends us to confirm a payment. We never receive or store your card details. | PayFast |
| Suppliers and their representatives | Business details (legal and trading name, registration and VAT numbers); contact person's name, email and phone; services, capacity, turnaround and availability; banking details; bank confirmation letters; collection address; price lists; records of quotes, jobs and payments; acceptance records for the Supplier Network Agreement (version, time, IP address and browser). | You, your bank letter |
| Creatives / designers | Name (shown publicly only as first name and surname initial), profile, services, portfolio images and the contact details you choose to publish. | You |
| Administrators and staff | Name, email address, role, and records of actions taken in the platform (for example approvals and payments recorded). | ProductionRun |
| Website visitors | Technical information our hosting provider processes to deliver and protect the site (such as IP address and browser type). Settings saved on your device (for example light or dark mode, and an unfinished quote draft). | Your device |
We do not knowingly collect special personal information (such as health or religious information), or information about children.
4. Why we use it, and on what lawful basis
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Creating your account and keeping it secure | Needed to provide the service you asked for (contract) |
| Quoting, producing and delivering your order, including sharing job details with the producer doing the work | Contract |
| Taking payments through PayFast, reconciling them, refunds and paying suppliers | Contract; legal obligation (accounting and tax records) |
| Checking artwork is printable, and checking supplier documents and proofs of production | Contract; our legitimate interest in quality and preventing fraud |
| Verifying supplier banking details before paying them | Legitimate interest in preventing fraud; contract |
| Customer support, call-backs and handling complaints | Contract; legitimate interest |
| Improving the service using cancellation reasons and feedback | Legitimate interest |
| Meeting legal and regulatory obligations | Legal obligation |
| Marketing messages | Only with your consent (see section 14) |
5. What you must give us, and what is optional
To request a quote you must give an email address and enough detail to produce and deliver the job. To be paid as a supplier you must give accurate business and banking details. If you don't provide this information, we cannot provide the service. Everything else, such as a phone number for a call-back or optional profile details, is up to you.
6. Sharing with producers (suppliers)
ProductionRun works as a white-label service. When a job is awarded, the producer receives only what it needs to make and deliver the job: the specification, approved artwork files and, where needed, delivery or installation details. Producers do not see your payment details. Customers do not see producers' identities or banking details. Producers must keep your information confidential and use it only for your job, under the data-protection terms in their agreement with us.
7. Payments through PayFast
Online payments are processed by PayFast (a South African payment provider). You enter card or bank details on PayFast's own pages, under PayFast's privacy policy. PayFast tells us whether the payment succeeded, along with the details listed in section 3.
8. Service providers who process information for us
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | European Union (Ireland) |
| Lovable / Cloudflare | Website hosting and delivery | Global network |
| Resend | Sending account and notification emails | United States |
| PayFast | Payment processing | South Africa |
| AI service via Lovable's AI gateway (OpenAI) | Automated checks of artwork files, proof-of-production photos and supplier bank letters | United States |
We share only what each provider needs, under their terms of service and data-processing terms.
Uber Direct courier booking is built but switched off. If we switch it on, delivery details needed for a booking will be shared with the courier, and we will update this policy first.
9. Cookies and similar technologies
We use only what the site needs to work: sign-in session storage, and settings saved on your device (theme and quote drafts). We do not currently use advertising or analytics cookies. If we add analytics, such as Google Analytics, we will update this policy first, and it will not use personal details such as your name or email.
10. Transfers outside South Africa
Some providers store or process information outside South Africa: our database is hosted in the European Union, and our email and AI providers are based in the United States. We use providers that are bound by data-protection laws or agreements giving protection substantially similar to POPIA, as section 72 of POPIA requires.
11. How we protect your information
Access to information is restricted by role on our servers. For example:
- Producers see only their own jobs.
- Banking details and supplier documents are visible only to authorised administrators.
- Files are kept in private storage and opened through short-lived links.
Bank-detail changes must be re-verified before any payment, and payment and settlement records cannot be edited after the fact. Connections are encrypted (HTTPS). No system is completely secure, but we keep these measures under review.
12. How long we keep information
We keep personal information only as long as needed for the purposes in this policy, or as the law requires (POPIA section 14). Where the law sets a minimum period, we keep records for at least that period:
| Records | How long |
|---|---|
| Accounting and financial records: quotes accepted, invoices, payments, refunds, supplier settlements | At least 7 years (Companies Act 71 of 2008, section 24), which also covers the 5-year periods in the Tax Administration Act (section 29) and the VAT Act (section 55) |
| Supplier agreements and acceptance records | For the duration of the supplier relationship, then at least 7 years |
| Other categories: account details after an account is closed, artwork files after delivery, job messages, unsuccessful quote requests, supplier bank letters | Under review. We will publish set periods here. Until then we keep them only while needed for the purposes above. |
When information is no longer needed, we delete it or de-identify it.
13. Your rights
Under POPIA you may:
- ask whether we hold your personal information, and request a copy;
- ask us to correct or delete information that is inaccurate, out of date or unlawfully held;
- object to processing based on our legitimate interests, and to direct marketing;
- withdraw consent where we rely on it;
- lodge a complaint with the Information Regulator.
Email privacy@afroquest.co.za. We may need to confirm your identity first. Some information must be kept by law, for example transaction records. Formal requests for access to records are handled under our PAIA manual.
14. Direct marketing
We send service messages about your account, quotes and orders. These are not marketing. We send marketing only if you opt in, you can opt out at any time, and opting in is never a condition of using ProductionRun. We do not currently send marketing messages.
15. If there is a security compromise
If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. We will tell you what happened and what you can do to protect yourself.
16. Complaints to the Information Regulator
Please contact us first so we can try to help. You may also complain to the Information Regulator (South Africa): https://inforegulator.org.za · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg · complaints: POPIAComplaints@inforegulator.org.za
17. Changes to this policy
We will update this policy when our practices change. The version and effective date appear at the top, and important changes will be highlighted on the website or sent to account holders.