Privacy Policy (POPIA)

Last updated: 4 October 2026

This policy explains what personal information JBay Waves collects when you use this website, why we collect it, who we share it with and the rights you have under South Africa's Protection of Personal Information Act, 2013 (POPIA). We collect as little as we need, we never sell personal information, and we only send marketing emails to people who ask for them.

1. Who we are

The responsible party for this website is JBay Waves, a surf brand based in Jeffreys Bay, Eastern Cape, South Africa. For any privacy question or request, contact our Information Officer at jbaywavess@gmail.com.

This policy covers this website. Our online store at jbaywaves.store runs on Shopify and has its own privacy policy, which applies to anything you do there, including orders and payments.

2. What we collect and why

When you subscribe, we collect your email address, your name if you choose to give it, where on the site you signed up, and a record of your consent: the consent wording you agreed to, the date and time, and a hashed version of your IP address. We use double opt-in, so we also record when you confirm your subscription, and when you unsubscribe. We use this information to send the newsletter and to show that you asked for it.

Contact form

When you send us a message, we collect your name, email address, subject and message, plus a hashed version of your IP address to help block spam. We use this only to reply to you and deal with your enquiry.

Free guide downloads

Some free guides ask for your email address so we can send you a download link. We use your address to send that email, and we only add you to the newsletter if you tick the box to subscribe and then confirm. We also keep a count of downloads for each guide.

The AI surf assistant

If you type a question into the "Ask the surf AI" assistant, the question is sent to Anthropic, the provider of the Claude AI model, to generate an answer. Please don't include personal details in your questions. We don't save the text of your questions in our database, but an answer may be cached for a limited time so that an identical question doesn't need a new request. To prevent abuse, we limit the number of questions per day using a hashed version of your IP address.

Hashed IP addresses and security

Where we need to recognise repeat visits for spam prevention and rate limiting, we store a one-way hash of your IP address rather than the address itself. Like almost every website, our hosting provider's servers may also keep standard technical logs, which can include IP addresses, for security and troubleshooting.

Usage statistics

We count page views per page per day, without linking them to individuals, and we record anonymous events such as clicks through to the store or downloads so we can see what is useful.

3. Cookies and browser storage

Essential session cookie. One cookie keeps your session working and protects forms against misuse. The site can't work properly without it, so it doesn't need consent.
Analytics cookies (optional). If we turn on Google Analytics, its cookies are only set after you accept them in our cookie banner. You can say no and the site works exactly the same.
Your preferences. Your chosen units (feet or metres, km/h, knots or mph, °C or °F), favourite spots and cookie choice are saved in your own browser's local storage. They stay on your device and are not sent to us.

4. Our lawful basis

We process personal information on the grounds POPIA allows: your consent (the newsletter and optional analytics cookies), taking the steps you ask for (replying to a message or sending a guide), and our legitimate interest in keeping the site secure and free of spam. You can withdraw your consent at any time, and this won't affect processing that happened before.

5. Direct marketing

We only send marketing emails, such as the newsletter, to people who have opted in and confirmed their subscription. Every email includes an unsubscribe link that works with one click, and you can also ask us to remove you by emailing our Information Officer.

6. Who we share information with

We share personal information only with service providers (operators) who help us run the site, and only as far as they need it:

Our hosting provider, which stores the website, its database and server logs.
Our email sending provider, which delivers newsletters, confirmation emails and download links.
Anthropic, which receives the questions typed into the AI assistant in order to generate answers. Our AI forecast summaries are created from forecast data only.
Google Analytics, only if it is enabled and you have accepted analytics cookies.
Open-Meteo, which supplies our forecast data. Our server requests forecasts for surf spot locations; no personal information is sent.
OpenStreetMap, whose servers deliver the map tiles you see on our surf maps. As with any image loaded from another site, your browser shares your IP address with their servers when it requests the tiles.
Shopify, whose servers may deliver product images shown on our pages. When you click through to the store, Shopify's own privacy policy applies.

We may also disclose information where the law requires it. We never sell or rent personal information.

7. Information sent outside South Africa

Some of our operators, including Anthropic and Google, process information outside South Africa. Where this happens, we take reasonable steps to make sure the recipient is bound by laws, binding corporate rules or agreements that give your information a level of protection similar to POPIA, as the Act requires.

8. How long we keep information

Newsletter: while you are subscribed. If you unsubscribe, we keep a minimal record of your address and unsubscribe date so we don't email you again.
Contact messages: for as long as needed to deal with your enquiry and any follow-up.
Rate-limit records: short-lived counters that reset automatically, usually within a day.
Technical and error logs: only as long as needed for security and troubleshooting.

When we no longer need information, we delete it or make it anonymous.

9. How we protect your information

We use reasonable technical and organisational measures to protect personal information, including encrypted connections where available, hashed passwords and IP addresses, protection against form misuse, and an admin area restricted to authorised people. No website is perfectly secure, but if a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

10. Your rights

Under POPIA you have the right to:

ask whether we hold personal information about you, and request a copy of it;
ask us to correct or update information that is inaccurate or out of date;
ask us to delete information we no longer have a lawful reason to keep;
object to the processing of your information, including for direct marketing;
withdraw your consent at any time;
lodge a complaint with the Information Regulator.

To make a request, email our Information Officer at jbaywavess@gmail.com. We may need to confirm your identity before acting on it, and we will respond within a reasonable time.

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You may also complain to the Information Regulator of South Africa. Its current contact details and complaint forms are published on its website, inforegulator.org.za.

11. Children

This website is aimed at a general audience of surfers and ocean lovers. We don't knowingly collect personal information from children under 18 without the consent of a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy when the site or the law changes. The date at the top shows when it was last revised, so please check back from time to time.

13. Contact us

Questions about this policy or your personal information? Email our Information Officer at jbaywavess@gmail.com or use our contact page.