Privacy Policy
Who we are
OneStopMusic is the online shop of One Stop Music (Pty) Ltd, trading as One Stop Music / Marshall Music, at Shop 15, Greenlyn Village Centre, Menlo Park, Pretoria, 0084, South Africa. Our website is https://onestopmusic.co.za.
This policy explains what personal information we collect when you use that website, why we collect it, who we share it with, and what you can ask us to do about it. We process personal information in terms of the Protection of Personal Information Act 4 of 2013 (POPIA).
If you would rather talk to a person about anything on this page, call 012 991 6077 or email info@onestopmusic.co.za.
Information you give us
We ask for personal information only through the forms on this site. These are the forms, and exactly what each one asks for:
- Checkout — your name, email address, contact number (optional), delivery address (country or region, street address, town or city, province and postal code), any order notes you write, and any voucher code you apply.
- Account sign-up — your name, email address, phone number and a password. Inside your account you can also save a billing address and a delivery address (first and last name, optional company name, country or region, street address, town or city, province and postal code), and choose whether you want email offers and SMS or WhatsApp offers.
- The enquiry form on our Contact page — your name, email address, phone number (optional) and your message.
- Newsletter sign-up — your email address, and nothing else.
- Product reviews — the name you publish the review under, your rating, and the heading and body of your review. We also record the IP address the review was sent from, so that we can deal with spam and fake reviews.
Information we collect automatically
Like every website, our server records the technical detail of each request — your IP address, the pages you asked for and when you asked for them — so that the site can work, stay online and stay secure.
We also set a small number of cookies. Which ones we set depends entirely on the choices you make in the privacy banner, and those choices are described next.
Cookies and your privacy choices
The first time you visit, a privacy banner asks you to choose. You can change your mind at any time using the Privacy settings button on any page. There are three categories, and they are exactly the three the banner shows you:
- Essential — needed for the site to work: your basket, staying signed in, and security. These cannot be switched off.
- Analytics — helps us see which pages and products people actually use, so we can improve them. Off until you allow it.
- Marketing — lets us measure our advertising and show you offers that are relevant rather than random. Off until you allow it.
Analytics and marketing storage are switched off by default. Nothing in those two categories runs until you allow it, and if you choose Essential only, nothing in them runs at all.
Analytics and advertising
We use Google Tag Manager (container GTM-PRMPKWKK) to load our measurement and advertising tags. Those tags are given analytics or advertising consent only once you have granted the matching category in the privacy banner — before that, they are told explicitly that consent is denied.
We use what this tells us to understand which pages and products people look at, and to measure whether our advertising is worth running. We do not use it to make automated decisions about you.
Paying for your order
At checkout you can choose from the payment methods we offer:
- PayGate — card or EFT
- Payflex — pay over time
- EFT or bank transfer
If you pay through PayGate or Payflex, you enter your card or banking details on that provider’s own secure page, under that provider’s own privacy terms. We never see, receive or store your card number or your banking credentials.
Who we share your information with
We do not sell your personal information, and we do not share it for anybody else’s marketing. We share only what is needed to do the thing you asked us to do:
- The payment provider you choose at checkout, so that your payment can be taken.
- The courier or logistics partner delivering your order, so that they have a name, an address and a contact number to deliver to.
- Google, through Google Tag Manager, for analytics and advertising measurement — and only after you have granted those categories.
- Our hosting and email providers, who process the information on our instruction in order to run the site and send the emails you asked for.
- Law enforcement or a regulator, where we are legally required to hand information over.
How long we keep your information
We keep the record of each electronic transaction between you and OneStopMusic for 12 months after the purchase date, and you can view and print those records from your account during that time. After 12 months, keeping your own copy of the purchase record is your responsibility.
How long we keep everything else:
Your account profile — for as long as your account is open. When you close it, we delete the personal information in your profile.
Orders, invoices and tax records — 5 years. We are required to keep these by the South African Revenue Service, so they remain even after an account is closed.
Enquiries you send us — 24 months from the date you sent them.
Your newsletter subscription — until you unsubscribe. You can do that from any newsletter we send you, or in My Account.
Analytics records — 14 months. These are only collected if you allow the analytics category in the privacy banner.
If you close your account, we delete the personal information in your profile, except anything we are legally required to keep — tax and transaction records in particular.
Where your information is kept
This website and the database behind it are hosted on a server in Johannesburg, South Africa, operated by Absolute Hosting (Pty) Ltd. Your personal information is stored in South Africa.
Some information does leave South Africa, and POPIA requires us to say so plainly:
Cloudflare — we use Cloudflare to deliver this website and to protect it from attack. Cloudflare is a United States company running a global network, so requests to our site pass through infrastructure that may sit outside South Africa.
Google — if you allow the analytics or marketing categories in the privacy banner, Google Tag Manager and the Google services it loads send measurement data to Google, which processes it outside South Africa. If you choose Essential only, none of this happens.
Both companies operate under published data-processing terms intended to give your information a comparable level of protection to the one POPIA requires.
Your card and banking details are handled by PayGate and Payflex, both South African payment providers, on their own secure pages. We never receive or store them.
How we protect your information
The whole site runs over HTTPS, so what you send us is encrypted in transit. Card transactions are handled by our payment providers under their own encryption, and we do not store or have access to card numbers or raw payment data.
Access to customer information is limited to the staff who need it to fulfil orders and answer your questions. Your account password is yours alone — please do not share it, and tell us immediately if you think somebody else has it.
Your rights under POPIA
POPIA gives you the following rights over the personal information we hold about you:
- To be told what personal information we hold about you, and to be given a copy of it.
- To have information that is wrong, misleading or out of date corrected, and to have information we no longer have a reason to keep deleted.
- To object, on reasonable grounds, to us processing your information.
- To withdraw a consent you gave us — by unsubscribing from our newsletter, turning off the analytics or marketing categories in the privacy banner, or switching off email and SMS offers in your account.
- To not receive unsolicited direct marketing, and to tell us to stop.
- To complain to the Information Regulator if you believe we have handled your information unlawfully.
To exercise any of these, email info@onestopmusic.co.za or write to us at the store address above. We will ask you to confirm who you are before we act, so that nobody else can request your information. Some of it you can do yourself at any time: your name, phone number and addresses, and your email and SMS marketing choices, are all editable in My Account.
Information Officer and complaints
Every organisation in South Africa has an Information Officer who is responsible for POPIA compliance. Under the Act, the head of a private body is its Information Officer unless somebody else has been formally designated, and that is the position here.
Privacy requests and questions should be sent to info@onestopmusic.co.za, marked for the attention of the Information Officer, or posted to us at the store address above. We will ask you to confirm who you are before we act on a request, so that nobody else can obtain your information.
If you are not satisfied with how we have handled a privacy request, you may complain to the Information Regulator (South Africa). Its current contact details and complaint forms are published on its website at inforegulator.org.za.
Changes to this policy
If we change how we handle personal information, we will update this page and change the date below. Please look at it from time to time.
Last updated: 27 August 2026.