Last updated: [Date]
[Business Name] is committed to protecting your personal information and processing it responsibly in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).
This page explains how we approach the collection, use, storage and protection of personal information and how you may exercise your rights under POPIA.
1. Responsible Party
For purposes of POPIA, the responsible party is:
[Business Name]
Email: [Email Address]
Telephone: [Telephone Number]
Address: [Business Address, if applicable]
The responsible party determines why and how personal information is processed.
2. Information Officer
Our Information Officer is:
Name: [Information Officer Name]
Email: [Information Officer Email]
Telephone: [Telephone Number]
The Information Officer is responsible for overseeing matters relating to the protection of personal information.
3. Personal Information We May Collect
Depending on how you use this website and our services, we may collect information including:
- Name and surname
- Email address
- Telephone number
- Billing information
- Customer account information
- Booking and appointment information
- Transaction and payment status
- Correspondence and enquiries
- IP address and technical website information
- Information collected through Google Analytics 4
- Any other information you voluntarily provide to us
We aim to collect only information that is reasonably necessary for the purpose for which it is required.
4. Why We Process Personal Information
We may process personal information for purposes including:
- Creating and managing customer accounts
- Processing bookings and appointments
- Providing services requested by you
- Communicating regarding appointments or purchases
- Processing payments
- Responding to enquiries
- Maintaining business and accounting records
- Improving the website and our services
- Analysing website usage
- Preventing fraud and misuse
- Complying with legal or regulatory obligations
We will not use personal information for purposes that are incompatible with the reason it was originally collected, unless permitted by law or with appropriate consent.
5. Booking and Account Information
Where you create an account or make a booking through this website, we may collect information necessary to manage your account and provide the requested service.
This may include your contact details, appointment information, booking history and payment status.
You are responsible for keeping your account login information secure.
6. Payment Information
Payments made through this website are processed by an independent payment provider.
Payment provider: [Payment Provider Name]
We do not store your complete credit or debit card information on this website.
The payment provider may process personal information required to complete your transaction in accordance with its own privacy and security policies.
7. Google Analytics 4
This website uses Google Analytics 4 (GA4) to understand how visitors use the website.
GA4 may collect technical and usage information such as:
- Pages visited
- Time spent on the website
- Device and browser type
- Approximate geographic location
- Referral source
- Website interactions
This information is used for website analytics and improvement.
8. Sharing of Personal Information
We do not sell personal information.
We may share information with third-party service providers where this is reasonably necessary to operate the website or provide our services.
These may include:
- Website hosting providers
- Booking and appointment platforms
- Payment processors
- Email service providers
- Website maintenance providers
- Google Analytics
- Professional advisers where necessary
These third parties may act as operators or independent responsible parties depending on the service they provide.
We may also disclose personal information where required by law.
9. Operators
Where another service provider processes personal information on our behalf, we take reasonable steps to ensure that the information is handled appropriately and protected against unauthorised access, loss, misuse or disclosure.
10. Cross-Border Processing
Some of the technology providers used by this website may store or process information outside South Africa.
Where personal information is transferred across borders, we take reasonable steps to ensure that it is processed in accordance with applicable data protection requirements.
11. Security of Personal Information
We take reasonable technical and organisational measures to protect personal information against:
- Loss
- Damage
- Unauthorised access
- Unauthorised disclosure
- Destruction
- Alteration
- Misuse
However, no internet-based system can be guaranteed to be completely secure.
12. Security Compromises
If we become aware of a security compromise involving personal information, we will take reasonable steps to investigate and address the incident.
Where required by law, affected individuals and the relevant authorities will be notified.
13. Retention of Personal Information
Personal information will not be retained for longer than reasonably necessary for the purpose for which it was collected, unless:
- Retention is required by law
- The information is required for legitimate business or accounting purposes
- A longer retention period is agreed to
- The information is required for the establishment, exercise or defence of a legal right
When information is no longer required, it may be securely deleted, destroyed or de-identified.
14. Your Rights Under POPIA
Subject to applicable law, you may have the right to:
- Request confirmation of whether we hold personal information about you
- Request access to your personal information
- Request correction of inaccurate or outdated information
- Request deletion or destruction of information where appropriate
- Object to certain processing of your personal information
- Withdraw consent where processing is based on consent
- Lodge a complaint regarding the processing of your personal information
Requests may be submitted to our Information Officer using the contact details above.
We may need to verify your identity before providing access to personal information.
15. Correction or Deletion of Information
If you believe that information we hold about you is inaccurate, incomplete, outdated, excessive or unlawfully obtained, you may request that it be corrected or deleted where permitted by law.
Please contact:
[Information Officer Email]
16. Direct Marketing
We will not use your personal information for electronic direct marketing without an appropriate legal basis.
Where you have consented to receive marketing communications, you may withdraw your consent or unsubscribe at any time.
If the business does not send marketing emails at all, this section can instead say:
We do not currently use personal information collected through this website for unsolicited electronic direct marketing.
For your templates, I would use that second version unless the customer actually has newsletters or marketing.
17. Complaints
If you have a concern about how your personal information has been processed, please first contact our Information Officer so that we can investigate the matter.
You may also have the right to lodge a complaint with the Information Regulator of South Africa.
Information about the Information Regulator and the complaint process is available from the Information Regulator’s official website.
18. Changes to This Notice
We may update this POPIA notice from time to time to reflect changes in our business, website, technology or legal obligations.
The latest version will be published on this website.
19. Contact
For questions, requests or concerns relating to personal information, please contact:
[Business Name]
Information Officer: [Name]
Email: [Email Address]
Telephone: [Telephone Number]