POPIA Compliance

1. About POPIA

The Protection of Personal Information Act, 4 of 2013 (POPIA) is South Africa's primary data privacy legislation. It regulates how organisations collect, use, store, and share personal information about individuals (data subjects).

POPIA gives South Africans the right to privacy and establishes eight conditions for lawful processing of personal information. Bushveld Web Co is committed to upholding all eight conditions in all of our activities.

2. Responsible party

Bushveld Web Co is the responsible party (as defined by POPIA) for all personal information collected through our website, client engagements, and marketing activities.

Business name: Bushveld Web Co
Registration number: [Business Registration Number]
Address: [Business Address]
Email: [Business Email]
Phone: 073 914 6692

3. Information Officer

As required by POPIA, Bushveld Web Co has designated an Information Officer who is responsible for overseeing POPIA compliance and handling data subject requests.

Information Officer: [Information Officer Name]
Contact: sales@bushveldwebco.co.za

Our Information Officer is registered with the Information Regulator of South Africa as required by law.

4. The eight POPIA processing conditions

We process personal information in accordance with all eight conditions set out in POPIA:

• Accountability — We take responsibility for the personal information we hold and have measures in place to ensure compliance.
• Processing limitation — We only collect personal information that is necessary for a specific, lawful purpose.
• Purpose specification — We collect information for a defined purpose and do not use it for unrelated purposes without consent.
• Further processing limitation — Personal information is not shared or processed further in a way that is incompatible with the original purpose.
• Information quality — We take reasonable steps to ensure that personal information we hold is accurate, complete, and up to date.
• Openness — We are transparent about how we collect and use personal information, as set out in our Privacy Policy.
• Security safeguards — We implement appropriate technical and organisational security measures to protect personal information.
• Data subject participation — We respect your rights to access, correct, and delete your personal information.

5. Lawful basis for processing

We process personal information on one or more of the following lawful bases:

• Consent — where you have given us explicit permission (e.g. analytics cookies, marketing communications).
• Contract — where processing is necessary to fulfil a service agreement with you.
• Legal obligation — where we are required by South African law to retain or process certain information (e.g. financial records).
• Legitimate interest — where processing is in our legitimate business interest and does not override your rights (e.g. security monitoring, fraud prevention).

6. Your rights as a data subject

Under POPIA, you have the following rights:

• Right to be notified — you must be informed when we collect your personal information and why.
• Right of access — you may request a copy of the personal information we hold about you.
• Right to correction — you may request that inaccurate or incomplete information be corrected or deleted.
• Right to object — you may object to the processing of your information, particularly for direct marketing purposes.
• Right to complain — you may lodge a complaint with the Information Regulator if you believe your rights have been infringed.

To exercise any of these rights, please submit a written request to sales@bushveldwebco.co.za. We will respond within 30 days. We may need to verify your identity before processing the request.

7. Data security

We implement appropriate technical and organisational security measures to protect personal information against loss, damage, or unauthorised access, including:

• Encrypted data transmission (SSL/TLS).
• Access controls limiting who can view personal data.
• Secure, regularly backed-up server infrastructure.
• Regular security monitoring and patching.

In the event of a security compromise that poses a risk to data subjects, we will notify affected parties and the Information Regulator as soon as reasonably possible, and no later than 72 hours of becoming aware of the breach.

8. Cross-border transfers

Some of the third-party tools we use (such as Google Analytics and cloud storage providers) may process your data outside of South Africa. Where this occurs, we take reasonable steps to ensure that the recipient is bound by comparable privacy standards, consistent with POPIA Section 72.

We do not transfer personal information to countries that do not offer an adequate level of privacy protection without appropriate safeguards in place.

9. How to lodge a complaint

If you believe we have handled your personal information in a manner that does not comply with POPIA, we encourage you to contact us directly first so we can resolve the matter.

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: inforeg@justice.gov.za
• Phone: 010 023 5207