POPIA Policy

Her Legacy Consulting is a responsible party for the purposes of POPIA in respect of the personal information collected through this website. This policy explains the basis on which we process that information and the conditions we follow to keep it lawful, secure and limited to what our consulting practice genuinely needs.

POPIA sets out eight conditions that any responsible party must satisfy when processing personal information. We apply each of them to the information collected through our consultation and corporate enquiry forms as follows.

The categories of personal information we process are name and surname, town or area, contact details, service interest and any message you provide through our forms. The lawful basis for this processing is your consent, given by voluntarily submitting the form, and it is necessary for us to take steps at your request before entering into a consulting engagement with you.

We also generate a one way hashed fingerprint derived from a visitor's IP address for the sole purpose of rate limiting and spam prevention. This is a technical security measure rather than a means of identifying you, and the underlying IP address itself is not retained.

We retain enquiry and engagement information only for as long as reasonably necessary to fulfil the purpose for which it was collected, or as required by law, whichever is longer. Information that is no longer needed is deleted or de-identified.

We apply reasonable technical and organisational safeguards appropriate to the nature of the information we hold, including restricting access to our database, using secure transmission for form submissions, and applying spam and rate limiting controls that reduce the risk of automated abuse of our forms.

Where any service provider that supports the operation of this website or its transactional email, such as a hosting or email delivery provider, processes personal information from outside South Africa, we take reasonable steps to ensure that provider is subject to a level of protection for personal information that is at least equivalent to the conditions set out in POPIA, whether through contractual commitments or by relying on a jurisdiction recognised as offering adequate protection.

Where a third party service provider processes personal information on our behalf, for example to deliver transactional email or to host our database, that provider acts as an operator under POPIA. We only use operators that undertake to process personal information in accordance with our instructions and to maintain appropriate security safeguards, and we do not authorise operators to use the information for their own independent purposes.

Under sections 23 and 24 of POPIA, you have the right to establish whether we hold personal information about you, to request access to that information, and to request that we correct, update or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained. Under section 11(3), you have the right to object, on reasonable grounds, to the processing of your personal information, and to object to processing for purposes of direct marketing.

You may exercise any of these rights by telling us clearly what you would like us to do through our consultation form. Please describe your request, including enough detail (such as your name and the approximate date of your enquiry) for us to locate the relevant record. We do not publish a phone number or email address for this purpose; the form is our channel for all such requests, and we will respond to you using the contact details you provide.

If you believe we have processed your personal information unlawfully, or that we have not adequately addressed a request you have made, you have the right to lodge a complaint with the Information Regulator (South Africa), the body established under POPIA to oversee compliance with the Act. Details of how to lodge a complaint are available on the Information Regulator's official website at https://inforegulator.org.za. We encourage you to raise any concern with us first, through our consultation form, so that we can try to resolve it directly.

Her Legacy Consulting has designated an Information Officer responsible for compliance with POPIA in accordance with the Act. Requests relating to the Information Officer's function, including access and correction requests, should be submitted through our consultation form as described above, and will be directed to the Information Officer accordingly.