Privacy Policy.

What we collect, why we collect it, who else gets to see it, and what you can make us do about it.

Last updated 21 September 2026

• Who we are
• What we collect
• What we don't do
• Card details
• Who else sees it
• Cookies
• How long we keep it
• Your rights
• Security

01 / Who we areThe people holding your information

Gapped Performance is a carbon fibre and performance parts business in South Africa. When this policy says we, it means us. When it says you, it means anyone who uses gappedperformance.com.

Registered name

Gapped Performance (Pty) Ltd

Registration number

2022/697110/07

Address

128 Starling Street, Lenasia South, Johannesburg, 1829

Information Officer

Sheldon Govender

Email

sheldongovender6@gmail.com

WhatsApp

+27783297240

This policy is written to meet the Protection of Personal Information Act (POPIA) and the Electronic Communications and Transactions Act.

02 / What we collectEverything we hold, and why

If you create an account

Your name, email address, phone number and delivery address, plus your password.

We need these to know who you are, to send you the part, and to talk to you about your order. Your password is never stored as you typed it: it is put through a one-way hash, which means nobody here can read it, us included. If you forget it, we can reset it, not look it up.

If you place an order

What you bought and which options you chose, the total, your delivery address, the date, and a reference number from our payment provider.

We need this to build and ship your part, and to keep proper records of what we sold. South African tax law requires us to keep invoice records for five years, so an order history outlives an account.

If you write a review

Your name, your rating, your headline and what you wrote. A review only goes public after we have read it. Reviews show the first name you gave your account, so if you do not want your full name on the site, put a first name only.

Just by visiting

Our host records the usual server logs: your IP address, what you asked for, when, and which browser you used. That is how any web server works and how we would spot someone attacking the site.

03 / What we don't doThe short section

04 / Card detailsWe never see them

Payments are handled by Peach Payments. When you pay, you are handed to their checkout, you enter your card details on their system, and they tell us only whether the payment succeeded and give us a reference.

Your card number, expiry date and CVV never touch this server and are never stored by us. We could not leak them if we tried, because we do not have them. Peach Payments are PCI-DSS compliant and handle that data under their own privacy policy.

05 / Who else sees itThe full list

• Peach Payments — to take the payment. They get the amount, a reference, and whatever you type into their checkout.
• Hostinger — our web host. The site and its data sit on their servers, so they hold it the way any landlord holds what is in the building.
• Google Fonts — the site loads two typefaces from Google's servers, which means Google sees your IP address when a page loads. Nothing else is sent.
• The courier — your name, address and phone number, so they can deliver the part. Nothing else.
• SARS or a court — if the law requires it.

That is the complete list. If you click through to our WhatsApp, Facebook or Instagram, you are on their platform under their terms, but nothing about you is sent to them from this site unless you click.

06 / CookiesTwo, both necessary

A session cookie keeps you logged in while you move between pages, and a cart cookie remembers what is in your basket. Both are marked HttpOnly and SameSite, which means scripts cannot read them and other sites cannot borrow them.

There are no advertising or tracking cookies, which is why this site has never shown you a cookie banner. You can clear these two in your browser whenever you like; you will simply be logged out and your basket will empty.

07 / How long we keep it

• Your account — until you ask us to delete it.
• Orders and invoices — five years, because tax law says so. This applies even after an account is deleted, and the record is reduced to what the law needs.
• Reviews — until you ask us to remove them.
• Server logs — held by our host on their own schedule, normally weeks.

08 / Your rightsWhat you can make us do

POPIA gives you the right to:

• Ask what we hold about you, and get a copy.
• Have anything wrong corrected.
• Have your information deleted, except records the law makes us keep.
• Object to how we are using it.
• Withdraw consent you gave us earlier.
• Complain to the Information Regulator if we handle it badly.

Email sheldongovender6@gmail.com and we will deal with it. It costs you nothing, and we will reply within 30 days. If we cannot do what you asked, we will tell you plainly why.

If you are not happy with how we handled it, you can take it to the Information Regulator of South Africa, whose contact details are on inforegulator.org.za. You do not need our permission to do that.

09 / SecurityWhat we actually do

• The whole site runs over HTTPS, so what you send is encrypted in transit.
• Passwords are hashed, never stored in a readable form.
• Customer and order data is stored outside the public web folder, so it cannot be reached by guessing a web address.
• The admin side is behind a password with its own session that expires when idle.
• Card data is never held here at all.

No website can promise it will never be breached, and we are not going to pretend otherwise. If something happens that puts your information at risk, we will tell you and the Information Regulator, as POPIA requires.

10 / Changes

If we change this policy we will change the date at the top. If the change is significant, such as adding a service that receives your data, we will say so on the site rather than quietly editing the page.