Privacy Policy

Last updated 8 September 2026. SGO FRF Files is part of AHDev (Pty) Ltd.

This policy explains what personal information SGO FRF Files collects when you visit the site, create an account or buy a file, what we do with it and the choices you have. We collect only what the shop needs to run. We do not sell personal information, and we do not use it for advertising.

Who is responsible

SGO FRF Files is part of AHDev (Pty) Ltd, a company registered in South Africa. AHDev (Pty) Ltd is the responsible party (the controller) for the personal information described in this policy. Questions and requests about your information go to support@sgofrf.com.

The information we collect

Your account

When you register we ask for your name, an email address and a password. The password is stored only as a hash, which cannot be turned back into the password. We also record the country your internet address pointed to when you registered, whether you have verified your email address, and when the account was created.

Orders and payments

For each order we keep the order number, the file bought, the price and currency, the status of the order and when it was paid. When a payment is confirmed we also keep the payment method (Stripe or PayFast), the reference the provider gave the payment, and the confirmation the provider sent us, which can include the name and email address you gave the provider and the amount and fees of the transaction.

We never receive or store card numbers, bank details or wallet credentials. Those are entered on the pages of Stripe or PayFast and stay with them.

Visits to the site

To see how many people visit and where they come from, our server records each page view with the date, the page, the country of the visitor's internet address and a code derived from the internet address and browser. That code is a one-way hash that changes every day, so the same visitor cannot be recognised from one day to the next, and the internet address itself is not stored. Page views by automated crawlers are left out.

Technical and security logs

Like every web server, ours keeps standard access logs with internet addresses, the pages requested, the time and the browser used. Submissions to the account forms that our bot protection refuses are logged with the internet address and browser, and the payment notifications we receive from Stripe and PayFast are logged so that payment problems can be traced.

Messages you send us

If you email us, we keep the message and your contact details for as long as we need them to deal with it.

How we use it

We use this information to:

  • create and secure your account and let you log in;
  • take and confirm payments, deliver the files you buy and keep them available in your account;
  • send the emails the service needs: address verification, password resets and order confirmations. We do not send marketing email;
  • answer your questions and handle refund requests;
  • prevent fraud, abuse and automated misuse of the site;
  • count visitors and see which countries they come from, so that we can improve the catalogue;
  • keep the financial records the law requires; and
  • establish, exercise or defend legal claims.

Our legal grounds

Under the Protection of Personal Information Act (POPIA) and, for visitors in the European Economic Area and the United Kingdom, the GDPR, we process personal information on these grounds:

  • Contract: your account, your orders, the downloads and the emails the service needs.
  • Legal obligation: the tax and accounting records we must keep.
  • Legitimate interests: keeping the site secure, preventing fraud and bots, understanding how the site is used, and defending legal claims, always weighed against your rights.
  • Consent: where the law requires it. You can withdraw consent at any time without affecting what was done before.

Who we share it with

We share personal information only with the services that make the shop work:

  • Stripe when you pay by card, Apple Pay, Google Pay or Link. We send Stripe the order number, the amount and your email address; Stripe collects your payment details on its own pages under its own privacy policy.
  • PayFast when you pay through PayFast. We send PayFast your name, your email address, the order number and the amount; PayFast collects your card or bank details on its own pages under its own privacy policy.
  • Cloudflare if we turn on Cloudflare Turnstile to tell people from bots on the account forms. Cloudflare then receives the technical data the challenge needs, such as your internet address and browser characteristics, under its own privacy policy.
  • Our web host, whose servers in South Africa run the site, its database and the mail server that sends our emails.
  • Authorities and advisers, where the law requires it, or where it is necessary to enforce our terms, protect the site or its customers, or defend legal claims.

If the business is sold or merged, personal information may pass to the new owner under the same protections. We do not sell personal information, and the site uses no advertising networks or analytics services.

Where it is processed

We are based in South Africa and the site is hosted there. Stripe and Cloudflare process information in the United States, the European Union and elsewhere, so your information may leave your country when you pay or complete a challenge. Each of these providers commits to safeguards for such transfers, such as the standard contractual clauses approved by the European Commission, and we share only what the service needs.

Cookies and browser storage

The site sets only the cookies it needs to work, and none for advertising or tracking:

  • Session cookie: keeps you logged in and remembers the state of your visit as you move between pages. It expires after a period of inactivity (two hours by default) or when you log out.
  • Security token (XSRF-TOKEN): protects our forms against cross-site request forgery and lasts as long as the session.
  • Remember me: set only when you tick that box at login, so that you stay logged in on that browser until you log out.
  • Cloudflare Turnstile: may set its own cookies on the account forms while it is enabled, to tell people from bots.

While a payment is being confirmed, the order page also keeps a small counter in your browser's session storage so that it stops refreshing itself after a while. It is removed when you close the tab.

Because none of these are optional, the site shows no cookie banner. You can delete or block cookies in your browser, but you cannot log in or pay without the session cookie.

How long we keep it

We keep personal information only as long as it is needed:

  • Account details: for as long as your account exists. You can delete your account from your profile page at any time.
  • Orders and payments: for at least five years after the transaction, because tax and accounting law requires us to keep financial records. When you delete your account, its paid orders and their payment records are kept for that period but are no longer linked to an account.
  • Unpaid orders: until you delete them from My Orders or we remove them.
  • Visit statistics: indefinitely. They do not identify you.
  • Logs: up to 90 days for server and payment logs, and 30 days for bot-protection logs.
  • Email correspondence: for as long as needed to deal with it and to keep a record of what was agreed.

How we protect it

The site is served over HTTPS. Passwords are hashed, and payment details are handled entirely by Stripe and PayFast. Your personal information and the files you buy are stored outside the public web root and are reachable only through your account. Access to customer records is limited to the people who run the shop.

No system is perfectly secure, so please use a strong, unique password and keep it to yourself. If we learn of a breach that affects your information, we will tell you and the Information Regulator as the law requires.

Your rights

Depending on where you live, you have the right to:

  • ask what personal information we hold about you and receive a copy of it;
  • have it corrected. Your name and email address can be changed on your profile page;
  • have it deleted. Your account can be deleted from your profile page, subject to the records we must keep;
  • object to, or ask us to restrict, certain processing;
  • receive the information you gave us in a portable format;
  • withdraw consent where processing relies on it; and
  • complain to a supervisory authority. In South Africa that is the Information Regulator; in the European Economic Area or the United Kingdom it is your national data protection authority.

To exercise a right, email support@sgofrf.com from the address on your account. We answer within 30 days and may first ask you to confirm your identity.

Children

The site is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has registered, contact us and we will remove the account.

Changes to this policy

We may update this policy as the site changes. The date at the top shows when it was last updated, and we will announce substantial changes on the site or by email to account holders.

Contact

Questions about this policy or about your information go to support@sgofrf.com.