Information Security and Data Handling Policy

This policy sets out how Readers Warehouse classifies, protects, retains and disposes of information, including personal information processed under the Protection of Personal Information Act, 2013 (Act 4 of 2013) ("POPIA") and information received from marketplace partners. It is published at a permanent address so that customers, partners and reviewers can confirm the version in force at any time.

1. Scope and responsibilities

This policy applies to all information held or processed by Readers Warehouse, in every system and on every device, and to every employee, contractor and third party with access to it. It covers the Readers Warehouse Portal and its supporting infrastructure, and information received through marketplace and fulfilment integrations.

The directors are accountable for information security. Day-to-day responsibility for the portal, its hosting and this policy rests with To-a-T Software Services as appointed technical provider. A named Incident Management Point of Contact is appointed and listed in section 14.

2. Data classification

Every item of information is classified, and the classification determines how it must be handled.

Class	What it covers	How it must be handled
Public	Information published deliberately, such as this policy and catalogue listings.	No restriction.
Internal	Operational information with no personal data, such as stock levels and product costs.	Authenticated access only.
Confidential	Commercial terms, supplier pricing, employee records.	Role-based access, encrypted at rest and in transit.
Restricted	Personal information, and all marketplace partner information including buyer name, shipping address and contact details.	Named-role access only, encrypted at rest and in transit, every access logged, retained for the minimum period and then destroyed.

Marketplace partner information is classified Restricted in all cases. It is never copied to spreadsheets, email, file shares or portable media.

3. Lawful processing under POPIA

Personal information is processed only for a defined purpose with a lawful basis, and only to the extent that purpose requires. A processing record is maintained recording, for each processing activity: the purpose, the lawful basis, the categories of data subject and personal information, the recipients, the retention period and the security controls applied.

Personal information is processed for order fulfilment and delivery, customer service, and the legal and tax records a business is required to keep. It is not sold, and it is not used for any purpose incompatible with the one for which it was collected. The processing record is reviewed with this policy at each annual review.

4. Access control

Access is granted on least privilege and by named individual. Shared and generic logins are prohibited, so every action traces to one person.

• Every account is unique to a person, created only on written approval, and tied to the employment or contract record.
• Access to Restricted information requires an explicit role. Viewing a buyer shipping address requires a dedicated fulfilment role granted to named dispatch staff only.
• Database access uses least-privilege logins limited to stored procedures. No user or service holds direct table rights over personal information.
• Multi-factor authentication is mandatory for infrastructure, remote access and any account that can reach Restricted information.
• Access is re-certified quarterly by the business owner, and revoked on the day a person leaves or changes role.
• Restricted information is reachable only from company-owned, asset-registered devices, over a VPN requiring multi-factor authentication and a device certificate. Personal devices cannot connect.

5. Encryption in transit and at rest

All traffic to the portal is HTTPS only, using TLS 1.2 or better with HSTS. Plain HTTP is redirected and never serves data.

At rest, data is held in a SQL Server database on private infrastructure. The database is protected by Transparent Data Encryption using AES-256, columns holding personal information carry a further AES-256 column-level encryption, and the underlying storage volumes are AES-256 encrypted.

Key material is held in a managed key service as customer-managed keys, rotated at least annually, and reachable only by the application's service identity and named administrators. No key, password or token exists in source code, configuration files or documentation; secrets are held in a managed secret store and fetched at runtime. Secret scanning runs on every code change and blocks a release on a hit.

6. Retention and secure destruction

Personal information is kept only as long as its purpose and the law require, and is then destroyed rather than archived.

Information	Retention	Then
Marketplace buyer personal information (name, shipping address, contact details)	30 days from shipment	Hard-deleted by a scheduled job, including any audit copy. Not recoverable.
Order records without personal information (order ID, SKU, quantity, date, value)	As required for tax and audit	Retained for reconciliation. Carries no personal information.
Security and access logs	24 months	Expired automatically.
Backups	Per lifecycle rule	Expired on schedule. Backups inherit the 30-day purge, so a restore cannot reintroduce expired buyer data.

Destruction is by deletion of the record and its encrypted copies. Nothing is written to portable media. Decommissioned storage is securely erased or destroyed.

7. Third parties and sub-processors

Personal information is disclosed to a third party only where it is necessary to fulfil the purpose it was collected for, and only under a written agreement imposing confidentiality and security obligations at least equal to this policy.

The categories of recipient are: the cloud hosting provider on whose infrastructure the systems run; delivery and courier partners, who receive only the delivery details needed to complete a delivery; marketplace operators, in respect of orders placed on their platforms; and the appointed software provider, To-a-T Software Services, under a confidentiality agreement. Sub-processors are reviewed before appointment and at each annual review. Personal information is not sold, rented or shared for third-party marketing.

8. Logging and monitoring

Every authenticated request, every error, and every read of a field containing personal information is written to a dedicated log with the user, the action, the record and the timestamp. Infrastructure, operating system and web server logs are shipped to a central log service.

Alerts are raised on failed login bursts, privilege or permission change, bulk reads of personal information and abnormal integration volumes, and are routed to the Incident Management Point of Contact. Logs are append-only, retained for 24 months, and reviewed weekly with the review recorded.

9. Change management and testing

All code is held in version control with protected branches. Work is merged only by pull request with peer review and a passing build. Every database change is a dated, repeatable change script committed alongside the code, so any release can be reproduced or reversed.

Changes move through Development, then Test, then Production, and are approved by the business owner before release. Releases are documented in dated release notes. Personal information is never used in development or testing: those environments hold synthetic data, or production data irreversibly anonymised by a scripted process that keeps no reversible mapping. Developers hold no read access to production personal information.

10. Vulnerability management

Vulnerability scans run at least every 30 days across the application and its hosts, and an independent penetration test is performed annually and after any major architectural change. Static analysis, dependency scanning and secret scanning run on every release; a build carrying an unresolved critical or high finding cannot be released.

Every finding is logged with a severity, a named owner and a due date: critical within 7 days, high within 30, medium within 90, low by the next release. Open findings are reviewed weekly and reported monthly to the directors. A finding is closed only when a re-scan evidences the fix.

11. Incident response

A documented incident response plan is maintained and tested annually. Its steps are:

1. Detect - by automated alert, log review or report.
2. Triage - the Incident Management Point of Contact leads and assigns a severity within 1 hour.
3. Contain - revoke tokens and credentials, disable accounts, isolate affected hosts.
4. Eradicate - remove the root cause.
5. Recover - restore from a verified clean backup.
6. Notify - affected partners within 24 hours of confirming an incident affecting their information, and the Information Regulator and affected data subjects as POPIA requires.
7. Review - within 5 days, with tracked remedial actions.

12. Staff obligations

Every employee and contractor with access to Restricted information acknowledges this policy in writing before access is granted, and again at each annual review. They are required to:

• use only their own named account, and never share credentials;
• access personal information only where a task requires it;
• work only on company-owned, managed devices, and never copy personal information to a personal device, personal email or portable media;
• keep passwords of at least 12 characters with mixed character types, not reuse them, and use multi-factor authentication where required;
• lock unattended devices, and report a lost or stolen device immediately;
• report any suspected incident, phishing attempt or accidental disclosure to the Incident Management Point of Contact without delay.

Failure to comply is a disciplinary matter and may result in dismissal or termination of contract.

13. Data subject rights

Under POPIA a data subject may ask what personal information is held about them, ask for it to be corrected or deleted, object to its processing, or complain to the Information Regulator. Requests should be sent to the contact in section 14 and are answered within the period POPIA allows. Identity is verified before any information is released.

The Information Regulator (South Africa) can be reached at inforegulator.org.za.

14. Contact

Questions about this policy, data subject requests, and security incident reports should be directed to the Incident Management Point of Contact:

Name	Leon Janse van Rensburg
Role	Director, To-a-T Software Services - appointed Incident Management Point of Contact
Email	leon@tatss.co.za
Response	Security communications acknowledged within 24 hours

---

Readers Warehouse Information Security and Data Handling Policy, version 1.0, reviewed August 2026. Next review due August 2027. This document is maintained at https://rwportal.co.za/privacy and the version shown above is the version in force.