Privacy policy

This notice explains what personal information Ulfhednar Co. collects when you use this website, why we collect it, who we share it with, and what you can tell us to do with it. It is written to meet our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA).

Who is responsible for your information

We are the responsible party for the personal information described here.

Trading as: Ulfhednar Co.
Physical address (head office): 5000 16th Ave S, Minneapolis, Minnesota 55417-1206, United States
Distribution centres: Gauteng, South Africa
Telephone: +1 612 722 2055
Email: info@ulfgear.com
Website: https://www.ulfgear.com

What we collect

Account details: Your name, email address and password. Passwords are stored only as a salted scrypt hash - we cannot read your password, and neither can anyone who obtains a copy of our database.
Organisation details: If you register or are invited as part of an organisation: the organisation name, your role in it, and who invited or approved you.
Order details: Delivery address, contact phone number, what you ordered, what you paid, and the status of the order.
Artwork you upload: Logos, images and design layouts you place in the design studio, together with the placements and sizes you choose. We keep these so you can reorder the same layout and so we can reproduce it accurately.
Enquiries: The name, email and message you submit through a quote request or contact form.
Technical information: Your IP address, used to rate-limit sign-in, sign-up and password-reset attempts so the site cannot be brute-forced, and standard server logs for diagnosing errors.

What we never collect

We never see, receive or store your card details. Card numbers, expiry dates and CVV codes are entered on PayFast's own secure payment pages, not on this site. All we receive back from PayFast is a confirmation that a payment succeeded or failed, and a payment reference.

Why we process your information

To perform our contract with you - creating your account, taking and fulfilling your order, producing your branding, arranging delivery, and handling returns.
To meet legal obligations - keeping tax and accounting records of sales.
For our legitimate interests - securing the site against abuse, preventing fraudulent orders, and diagnosing faults.
With your consent - responding to a quote request or enquiry you chose to send us.

We do not sell your personal information, and we do not use it for automated decision-making or profiling.

Cookies and tracking

This site is deliberately light on this front. It sets exactly one cookie: ulf_session, a first-party, HTTP-only session cookie that keeps you signed in. It is strictly necessary - without it you could not stay logged in - and it contains a random session token, not your personal details.

Your shopping cart and any half-finished form you have typed are kept in your own browser's local storage on your device. They are not sent to us until you actually place an order, and clearing your browser data removes them.

We run no analytics, no advertising pixels and no third-party trackers of any kind. Nothing on this site reports your browsing back to Google, Meta or anyone else. The site's Content-Security-Policy blocks third-party scripts outright.

Who we share it with

Only the operators we need to run the business, and only with what they need:

PayFast (Payfast (Pty) Ltd, South Africa) - to take payment. They receive your order reference, amount, name and email.
Couriers and delivery partners - your name, delivery address and phone number, so they can deliver to you.
Our email and hosting providers - who process and store data on our behalf under contract, and may not use it for their own purposes.
Third-party manufacturers and decorators, where an item is produced or branded off-site - they receive your artwork and the production specification, not your contact or payment details.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Cross-border transfers

Our website and database are hosted in South Africa. Where an email or delivery provider processes information outside South Africa, we only use providers who are subject to laws or binding agreements offering protection substantially similar to POPIA.

How long we keep it

Account information - for as long as your account is open, and then as needed to resolve anything outstanding.
Order and payment records - at least 5 years, as South African tax law requires.
Saved artwork and layouts - until you delete them or ask us to.
Sign-in rate-limiting records and server logs - a short rolling window only.

How we protect it

The entire site is served over HTTPS with HSTS enforced.
Passwords are stored as salted scrypt hashes, never in plain text.
Sessions use HTTP-only cookies that JavaScript cannot read, and every password change invalidates all existing sessions.
Sign-in, sign-up and password-reset attempts are rate-limited per IP address.
A strict Content-Security-Policy, X-Frame-Options: DENY and nosniff are set on every response.

No system is perfectly secure. If a breach ever affects your personal information, we will notify you and the Information Regulator as POPIA requires.

Your rights

Under POPIA you have the right to:

ask what personal information we hold about you, and get a copy of it;
have information that is wrong or incomplete corrected;
ask us to delete information we no longer have a lawful reason to keep - note that we must keep order and tax records for the periods above;
object to processing based on our legitimate interests;
withdraw consent where processing is based on consent; and
complain to the Information Regulator.

To exercise any of these, email info@ulfgear.com from the address on your account. We will respond within a reasonable time and may need to confirm your identity first. You can also update your own account details at any time under your account.

Complaining to the Regulator

Information Regulator (South Africa): inforegulator.org.za
Complaints: complaints.IR@justice.gov.za
General enquiries: enquiries.IR@justice.gov.za

Changes to this notice

We will update this page if what we do with your information changes, and change the "last updated" date at the bottom. Material changes affecting how we use information you have already given us will be emailed to account holders.