7 October 2026
The Tenth: Privacy notice
Who we are
The Tenth is the tenth Bona Bona Platinum Auction, on 13 March 2027, with Piet du Toit Wildbedryf. This notice explains how we handle the personal information of sellers and their people and of the auction team who use the site, on thetenth.auction.
- Responsible party: Bona Bona Wildlife, N12, Klerksdorp. In this notice "we" means Bona Bona.
- Information Officer: Tarryn van der Berg, tarryn@bonabona.co.za, +27 82 769 4101. Write to them with any question about your information.
- Operator: Twisted Toast Digital, Johannesburg, builds and runs the site for us under a written agreement. It uses your information only on our instructions.
What we collect
We collect only what we need to run the auction and produce its catalogue. POPIA protects businesses' information as well as people's, so this covers both.
- Your business details: Business name, contact person, telephone and fax numbers, email address, area, logo and a PDF of your logo for print and the details of the entity you sell under: Its registered name, VAT number and postal and physical address.
- Your ID and banking details: The ID or passport number of the person your entity sells under and the bank account the auction pays you into: The account holder, bank, branch code, account number and account type. Your account's main user enters them and the auction team can also enter or correct them for you.
- Your name: Your first and last name, which the auction team or your account's main user enters with your invitation and you confirm or complete when you first sign in.
- Your sign-in: The email address you sign in with and the links and codes we send to it. Our sign-in provider also records the device, browser and IP address of each sign-in, for security.
- Your entries: What you tell us about each animal you offer, such as species, numbers, measurements, pedigree, DNA results, pregnancy status and availability.
- Photographs and video links you add to your entries. Photographs are stripped of camera and location data when we process them.
- A record of changes: Who changed what and when, so we can answer for every change to the catalogue.
- Your acceptance: When you accepted the terms of use and this notice and which version of each.
We do not take payments or card details on this site.
Why we use it
We use your information to run The Tenth with you and for nothing unrelated. Each use rests on a ground in section 11 of POPIA.
| What we do | Why we may |
|---|---|
| Let you sign in and keep your business details | To carry out our agreement with you as a seller |
| Link each lot to the right seller, invoice you and settle your sales, using your entity's details, ID number and banking details | To carry out our agreement with you and our legal obligations to keep tax records |
| Receive, review and accept your entries and make them into auction lots | To carry out our agreement with you |
| Print and publish the catalogue and list your lots on the auction platform | To carry out our agreement with you and your consent when you submit an entry |
| Send you messages about your entries and the auction | To carry out our agreement with you |
| Keep the site secure and keep a record of every change | Our legitimate interest in a safe, accountable auction |
| Keep records the law requires | Our legal obligations |
We will not use your information to market anything else to you without your consent.
What we publish
Only entries we accept are published. Drafts, withdrawn entries and entries we decline are never published. Your ID number, banking details, VAT number and addresses are never published.
- The printed catalogue, handed out and posted to buyers, carries each accepted lot: Its animals' details, photographs and your business name and area. The guest sellers page also carries your contact person, telephone numbers and logo.
- The digital catalogue and the auction platform carry the same lot details and photographs and any changes made after printing, up to the start of the auction.
A printed catalogue cannot be recalled once it is handed out. If you ask us to stop publishing something, we stop wherever we still can.
Who we share it with
We never sell your information. We share it only with the people and services the auction needs, each for the purpose shown.
| Who | What they do for us | Where they hold it |
|---|---|---|
| Twisted Toast Digital | Builds and runs the site | South Africa |
| Vercel | Hosts the site and stores photographs | Frankfurt, Germany |
| Neon | Holds the database | Frankfurt, Germany |
| Clerk | Handles sign-in | United States |
| Google Workspace | Sends the site's email | United States |
| Our catalogue printer | Prints the catalogue | South Africa |
| Wildswinkel | Runs the auction platform where buyers see and bid on lots | South Africa |
Your ID number and banking details go to nobody outside the auction team and Twisted Toast Digital, other than as the services above hold the site's data.
We also share information when the law requires it.
Where it is stored
Some of the services above hold your information outside South Africa, in the European Union and the United States. Section 72 of POPIA allows this when the receiver is bound by law or a written agreement that protects it as well as POPIA does.
Each service abroad is bound that way: The European Union's data protection law covers those in Europe and a written data protection agreement covers those in the United States. Your information also travels encrypted between you, the site and each service.
How long we keep it
We keep your information only as long as the auction and the law need it, then delete it or remove what identifies you.
| Information | Kept until |
|---|---|
| Accepted lots, their photographs and the record of changes | Up to five years after the auction, as the auction's record |
| Drafts and declined or withdrawn entries | Up to one year after the auction |
| Your business details and sign-in | Until you ask us to delete them, or two years after your last sign-in |
| Your ID and banking details | Until your sales are settled, then as long as the tax law requires invoicing records, up to five years after the auction |
| Backup copies | Until 13 March 2028 |
The printed catalogue is outside our control.
How we keep it safe
The database itself decides who may see what, so a mistake on a page cannot show one seller's information to another.
- Sign-in is by invitation only, with a link sent to your email (or a code from the same email) and no password to steal.
- Each seller sees only their own business and entries. Only the auction team sees all entries.
- Only your account's main user and the auction team see your ID and banking details. Everyone else on your account sees your business details but not these.
- Your ID number and bank account number are shown only as their last four characters. Only the auction team can see them in full and each time they do, it is recorded.
- A change to your banking details is confirmed with you by telephone before any payment.
- Every change is recorded with who made it and when.
- Photographs go first to a private store, where they are checked and rebuilt before anyone else sees them.
- Information is encrypted between you and the site and encrypted where it is stored, to the AES-256 standard.
- The database is backed up and we test that the backups restore.
If your information is ever exposed, we will tell you and the Information Regulator as soon as we reasonably can, as section 22 of POPIA requires.
Cookies
The site uses only the cookies it needs to keep you signed in. It uses no advertising or tracking cookies.
We measure how fast pages load, without cookies and without identifying you.
Your rights
You can ask us at any time what we hold about you and have it corrected or deleted. Write to our Information Officer and we will answer within 30 days.
- See it: Ask for a copy of the information we hold about you (POPIA section 23).
- Correct or delete it: Your account's main user can change most of your business details on the portal. For anything else, ask us (section 24).
- Object: Ask us to stop using it for a purpose based on our legitimate interest (section 11(3)).
- Withdraw consent: Where we rely on your consent, you can withdraw it. This does not undo what was lawfully done or printed before.
If you are unhappy with our answer, you can complain to the Information Regulator: POPIAComplaints@inforegulator.org.za, 0800 017 160 or 010 023 5200, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191 (the Regulator's contact page).
Changes to this notice
This notice was last changed on 7 October 2026. If we change how we use your information, we will update it here and tell sellers by email before the change takes effect.