Privacy policy

The S-Chassis Owners Club of South Africa (“the club”, “we”, “us”) runs sxoc.co.za. This policy explains what personal information we collect, why we collect it, who sees it, how long we keep it and what your rights are under South Africa's Protection of Personal Information Act 4 of 2013 (POPIA). We have tried to write it in plain language. By creating an account or using the site you confirm that you have read it. Our terms of use apply as well.

1. Who is responsible

The club's administrators run this site and are the “responsible party” under POPIA. The club is a volunteer-run community, not a company. Our information officer can be reached at admin@sxoc.co.za. Send questions, requests and complaints about your information there.

2. What we collect

Information you give us

• Your account: a username, your email address, and a password. The password is stored only in scrambled (hashed) form, so nobody, including us, can read it. We also record when you joined and when you accepted this policy.
• What you post: forum posts, replies, likes, private messages, photos and attachments, guides, parts suggestions, and anything else you write or upload.
• Registry details: your car's model, year, colour, engine, modifications, ownership history and dyno figures, plus province and town only. Never your street address. A chassis or VIN number, if you give one, is visible only to you and the moderators; it is used to spot duplicate entries and to help trace stolen cars.
• 3D models you share: the STL file, its description and any photo. Anyone who can see the model page can read the details; only signed-in members can preview and download the file.
• If you turn on two-factor sign-in: an encrypted key for your authenticator app and scrambled (hashed) one-time recovery codes. Neither can be read by us.
• Messages to us: if you email us, we keep the correspondence so we can help you.

Information collected automatically

• A sign-in cookie that keeps you logged in (see “Cookies” below), and the date you were last active.
• Technical logs: our web server and Cloudflare may log IP addresses and browser details for security and fault-finding. We also use IP addresses briefly, in the server's memory, to limit sign-up and login attempts.
• How many times a thread or manual has been viewed or downloaded (a count, not who did it).
• Who downloaded a shared 3D model: when a signed-in member downloads a model shared by another member, we record their username and the time. Administrators can see this list; it is used to show how popular a model is and to deal with abuse. The record is kept as long as the model is on the site.

Information we do not collect

We do not collect your ID number, bank or card details, precise location or street address. Location data (EXIF/GPS) is removed from photos you upload. We use no advertising, no social-media trackers and no analytics that follow you around the web.

3. Why we use it, and our lawful basis

• To run your account and the community: the forum, registry, dyno figures, guides, parts catalogue and messaging. (Your consent, and what is needed to give you the service.)
• To send emails you need: confirming your address and resetting your password. We do not send marketing email.
• To keep the site safe: stopping spam, abuse, fraud and stolen-vehicle listings, and enforcing our terms. (Our legitimate interest, and yours.)
• To meet legal duties, such as responding to a lawful request or a court order.

We only use your information for these purposes. We do not sell it, rent it or use it for advertising, and we do not make automated decisions about you.

4. Who else handles your information

We share information only where it is needed to run the site:

• Hosting and backups: the site runs on a server operated by the club. Encrypted backups are kept and deleted after 30 days.
• Email delivery: account emails are sent through the club's mail server.
• Cloudflare: runs the human check (“Turnstile”) on sign-up and password reset, and may protect the site from attacks, so it sees your IP address and browser details. See Cloudflare's privacy policy.
• YouTube: a few pages show a short video clip embedded from YouTube (using its privacy-enhanced youtube-nocookie.com address). Loading such a page contacts Google/YouTube servers, which can see your IP address and browser details. We do not add this to any page without telling you here. If you prefer not to load it, turn on “reduce motion” or Data Saver in your device; the video is then skipped.
• Public content: anything you post in a public section can be read by anyone, including search engines (see section 6).
• Authorities: we may disclose information where the law requires it or to protect people from serious harm.

Some of these providers operate outside South Africa. Where information leaves the country we only use providers that protect personal information to a standard comparable to POPIA.

5. Cookies

We use a single essential cookie, called sxoc_session, to keep you signed in. It is needed for the site to work, lasts up to 30 days and is removed when you sign out. We may also save small preferences on your device (for example guides you saved for offline reading). We do not use advertising or tracking cookies, so there is no cookie banner. The Cloudflare human check and the YouTube video, where present, may set their own technical cookies; these are covered by their providers' policies.

6. Public and members-only content

Much of the forum, the registry and the guides can be read by anyone, including search engines, and may remain in search-engine caches after we remove it. Some sections are for signed-in members only. Think before you post: anything in a public section is public. Private messages are visible only to the people in the conversation; administrators do not read them unless a message is reported to us or the law requires it.

7. Members of the original forum

If you were a member of the club's previous forum, your account, posts and private messages were moved here. Your old password works until you next sign in, when it is replaced with a stronger one, or you can reset it by email. Accounts that were deactivated on the old forum stay deactivated, and an administrator can reactivate them on request. Some old accounts were given a placeholder email address if no valid one was on record; ask us to set the right one.

8. Security

We take reasonable technical and organisational steps to protect your information: passwords are hashed with a modern algorithm, connections are encrypted (HTTPS), the registry's private fields are never shown publicly, backups are encrypted, and only a few administrators have access to the server. No system is perfectly secure. If a breach affects your information in a way that could harm you, we will tell you and the Information Regulator as POPIA requires.

9. How long we keep it

• Your account and content: until you delete your account.
• Accounts that never confirm their email address: removed after 30 days.
• Sign-in sessions: expire after 30 days.
• Backups: kept for 30 days, so data you delete can remain in a backup for up to that long.
• Moderation and security records (for example a note that a post was removed): kept for as long as needed to run the community fairly and safely.

10. Your rights

• See and download your data: Settings → Download my data gives you everything we hold about you.
• Correct it: change your email and password in Settings, and edit your posts, cars and guides yourself.
• Delete it: Settings → Delete my account removes your account, private messages and registry cars. Your forum posts stay so that conversations still make sense, but they are no longer linked to you.
• Object or withdraw consent: you can ask us to stop using your information, or withdraw your consent, at any time. Doing so may mean we can no longer give you an account.
• Ask questions: email admin@sxoc.co.za. We will reply within a reasonable time, and normally within 30 days.

If you think we have handled your information unlawfully, please talk to us first. You may also complain to the Information Regulator (South Africa): inforegulator.org.za, complaints email POPIAComplaints@inforegulator.org.za.

11. Children

The site is for people aged 18 or over. Younger people need a parent or guardian's permission and supervision. If you believe a child has opened an account without permission, tell us and we will remove it.

12. Links to other sites

Some pages (for example Useful links) point to other websites. We do not control them and are not responsible for their privacy practices.

13. Changes to this policy

If we change this policy in a way that matters, we will say so on the site and update the date at the top. Please read the terms of use too. Questions: admin@sxoc.co.za.