Privacy & POPIA notice

This notice explains how Afrique Du Sud K9 (Pty) Ltd ("we", "us", "our") collects, uses, shares and protects your personal information in line with the Protection of Personal Information Act, 2013 (POPIA). Please read it together with the consent line on our contact form.

1. Who we are (the Responsible Party)

The Responsible Party for the personal information described in this notice is:

• Afrique Du Sud K9 (Pty) Ltd
• Company Registration No. 2020/097820/07
• PSIRA Registration No. 3141536
• Headquarters: Brits (postal: Postnet Suite 262, Private Bag X5091, Brits, 0250)
• Office: Shop 1, Ifafi Business Centre, 80 Die Ou Wapad, Ifafi, Hartbeespoort, 0260 (postal: Postnet Suite 397, Private Bag X0001, Ifafi, 0260)
• Email: info@afriquedusudk9.com
• Telephone: 081 014 4395 · 012 023 1751

Under POPIA, a "Responsible Party" is the person or organisation that decides why and how personal information is processed (this is the same concept that other laws call a "controller"). In this notice we are the Responsible Party for any personal information you give us through this website or in the course of being a client.

2. Our Information Officer

POPIA requires every organisation to appoint an Information Officer who is responsible for our compliance with the Act and for handling requests from data subjects (you). The Information Officer is also our point of contact with the Information Regulator.

Until our appointed Information Officer is published here, please direct any privacy queries or data-subject requests to info@afriquedusudk9.com with the subject line "Information Officer". We will route your message to the correct person and respond within a reasonable period.

3. What personal information we collect

We only collect personal information that you choose to give us, or that we genuinely need to deliver our services and meet our legal obligations. In practice this falls into three buckets.

a. From the contact form on this website

When you submit an enquiry through our contact form, we collect:

• First name and surname
• Email address
• Phone number
• Company name (optional)
• The services you are interested in (multi-select)
• Your message (optional)
• Street number, street name, suburb, city, province and postal code (where supplied)

b. From your device or browser

When the form is submitted, the receiving webhook log naturally records technical information such as your IP address and an approximate timestamp. This is incidental to the request and is used for security, abuse-prevention and troubleshooting only.

This website does not set cookies, does not load analytics or tracking scripts, and does not build cross-site advertising profiles. See section 11.

c. From operational interactions (clients)

If you become a client, we collect additional information needed to deliver the security services you have contracted for. Depending on the engagement this may include identification information, site addresses and access details, billing information, and operational records relating to the services performed.

4. Why we collect it (purposes)

We use your personal information for the following purposes:

• To respond to your enquiry and any follow-up questions.
• To quote, contract and deliver the security services you have asked us about.
• To maintain customer records and to respond to operational or incident matters arising from the services.
• To meet our legal, regulatory and PSIRA-compliance obligations, and to keep records required by tax and other laws.

We do not use your personal information for unrelated marketing without your separate consent.

5. The lawful basis under POPIA (Section 11 conditions)

POPIA allows us to process personal information only if at least one of the lawful grounds in Section 11 applies. Depending on the situation, we rely on:

• Consent. When you tick the consent box on the contact form, you give us consent to contact you and to process your information in line with this notice. You can withdraw that consent at any time (see section 10).
• Contract. Processing is necessary to take steps at your request to enter into a contract for security services, or to perform a contract once it is in place.
• Legal obligation. Processing is necessary to comply with the law — for example PSIRA requirements, tax law, anti-money-laundering obligations, or lawful instructions from regulators.
• Legitimate interests. Processing is necessary for our legitimate interests in running the business — for example quoting, internal records, fraud prevention and securing our premises and systems — provided your rights and interests are not overridden.

6. Who we share it with (recipients & operators)

Under POPIA, a service provider that processes personal information on our behalf is called an "Operator" (other laws call this a "processor"). We share personal information with the following categories of recipients, only as far as is necessary for the purposes above:

• CRM and document-workflow system (managed service). Enquiries submitted through the contact form are routed into a customer-relationship and document-workflow system that runs on physical servers located in Afrique Du Sud K9's own office in Hartbeespoort, on hardware owned by Afrique Du Sud K9, operated by Afrique Du Sud K9 personnel on Afrique Du Sud K9 premises. A third-party service provider, Geekly IT, is contracted only to set up, configure and remotely manage these systems on our own infrastructure — Geekly IT does not host or store this data.
• Service providers. Where needed for the engagement, we may share information with our webmail provider, accountants, payroll provider, insurers, banks, attorneys and external auditors. Each is required to keep your information confidential and use it only for the agreed purpose.
• Law enforcement and regulators. We may share information with the South African Police Service, PSIRA, the Information Regulator, courts or other authorities when we are required by law to do so.
• Successors or restructuring. In the event of a sale, merger or restructuring of our business, personal information may transfer to a successor entity under appropriate safeguards and on the same terms as this notice.

We do not sell your personal information.

7. Cross-border transfers

Our website hosting (Xneelo) operates from within the Republic of South Africa, and our automation, CRM and document-workflow systems are hosted on-premises at Afrique Du Sud K9's office in Hartbeespoort. Personal information collected through this website is processed inside the Republic.

If we ever need to send personal information to a recipient or operator outside South Africa, we will first assess that transfer against Section 72 of POPIA — which requires, in summary, that the recipient is subject to a law, binding rules or a binding agreement providing an adequate level of protection, or that you have consented, or that one of the other conditions in Section 72 applies.

8. How long we keep it

We do not keep personal information for longer than we need it. Our default retention periods are:

• Enquiries that do not become contracts: kept for up to 24 months for follow-up and re-engagement, after which the record is deleted or anonymised.
• Active client records: kept for the duration of the service relationship, and then for the period required by tax law — currently 5 years after the last transaction, in line with the Tax Administration Act — after which the record is deleted or archived in a restricted form.
• Operational records relating to security incidents: kept for as long as required by PSIRA, the South African Police Service or other regulators, or for as long as the record may reasonably be needed in connection with the incident.

9. How we protect it

We apply reasonable technical and organisational measures to keep your personal information secure and confidential. These include:

• Encrypted transport. The whole website is served over HTTPS, enforced at the server (.htaccess).
• Access controls. Enquiries and client records can only be read by authorised personnel who need them to do their job.
• Reputable hosting. Our website and operator services run on established South African providers with their own security posture.
• Vetted, trained personnel. As a PSIRA-registered security operator, our staff are vetted and bound by confidentiality undertakings. Privacy and information-handling form part of our operational training.
• Incident response. If a security breach occurs that is likely to cause harm to a data subject, we will notify the Information Regulator and the affected data subjects as required by section 22 of POPIA.

No system can be made completely secure, but we take reasonable steps to protect your information and to keep our controls under review.

10. Your rights as a data subject

POPIA gives you a number of rights in respect of your personal information. In plain English, you have the right to:

• Ask us what personal information we hold about you, and to receive a copy.
• Ask us to correct or update information that is incomplete, inaccurate or outdated.
• Ask us to delete or destroy information that we are no longer entitled to keep.
• Object, on reasonable grounds, to our processing of your information.
• Withdraw any consent you have given us, at any time (this will not affect anything we lawfully did before you withdrew it).
• Lodge a complaint with the Information Regulator (see section 12).

To exercise any of these rights, please email our Information Officer at info@afriquedusudk9.com with the subject line "Information Officer — Data Subject Request". For formal access requests under the Promotion of Access to Information Act, 2000 (PAIA), the prescribed PAIA Form 2 procedure applies; our PAIA manual is available on request.

11. Cookies and tracking

This website sets no cookies, runs no analytics scripts, and does no third-party tracking or advertising profiling. The site is a static HTML, CSS and JavaScript site with no embedded social-media trackers or advertising tags.

If this changes in future — for example because we add a feature that genuinely requires a cookie — we will update this notice and, where required, ask for your consent before any non-essential cookies are set.

12. Information Regulator (South Africa)

If you are not satisfied with how we have handled your personal information, you can lodge a complaint with the Information Regulator (South Africa):

• The Information Regulator (South Africa)
• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 (verify)
• Tel: 010 023 5200 · Toll-free: 0800 017 160 (verify)
• General enquiries: enquiries@inforegulator.org.za (verify)
• POPIA complaints: POPIAComplaints@inforegulator.org.za (verify)
• Website: https://inforegulator.org.za/ (verify)

13. Changes to this notice

We may update this notice from time to time — for example to reflect changes in the law, our services, or the operators we use. The "Last updated" date at the top of this page will always show the current version.

If we make material changes that significantly affect how we process your personal information, we will take reasonable steps to bring those changes to your attention before they take effect — for example, by emailing active clients.

14. How to contact us