Privacy Policy

1. Who we are (the Responsible Party)

Under POPIA, the "Responsible Party" is the business that decides why and how your personal information is processed. That is:

2. Our Information Officer

POPIA requires every business to appoint an Information Officer who is responsible for our compliance with the Act and for handling your privacy requests. By default this is the head of the business. Ours is:

3. What information we collect

We only collect what we need. Depending on how you interact with us, this may include:

• Information you give us through our quote form. Your name, business name, email address, website address (if provided), and any details you choose to share about your security concerns.
• Information from contacting us directly. If you email or call us, we keep that correspondence and any information in it.
• Engagement information. If you become a client, we collect the information needed to scope and carry out the agreed security testing, governed by a separate engagement agreement and NDA.
• Basic technical information. Like most websites, our hosting may log standard technical data such as IP addresses for security and to keep the site running. [ADJUST IF YOU ADD ANALYTICS — see section 8.]

We do not deliberately collect "special personal information" (such as health, religion, or race) or the personal information of children through this website. Please don't send us such information through the quote form.

4. Why we collect it, and our lawful basis

POPIA requires us to have a lawful reason to process your information. We use the information above to:

• ›Respond to your quote request and provide the information or proposal you asked for.
• ›Communicate with you about a potential or active engagement.
• ›Carry out agreed security testing services and deliver reports.
• ›Keep records required by law (for example, tax and accounting records).
• ›Keep our website secure and prevent spam and abuse.

Our lawful bases are typically your consent (when you submit the form), the performance of a contract with you (when you're a client), our legitimate interests in running and securing our business, and compliance with our legal obligations.

5. Is giving us your information voluntary?

Yes. Completing our quote form is entirely voluntary. However, if you don't provide the basic details (your name, business, and email), we won't be able to respond to your enquiry or prepare a quote.

6. Who we share your information with

We do not sell your personal information, ever. We share it only where necessary, with:

• Our service providers ("Operators"). Trusted third parties who process information on our behalf and under our instruction — for example our website host, email provider, and any [ADD: CRM, accounting, or other tools you use]. They may only use it to provide their service to us.
• Legal and regulatory bodies. Where we are required by law, court order, or a regulator to disclose information.

7. Where your information is stored (cross-border transfers)

Some of the service providers we use may store data on servers outside South Africa. [REVIEW THIS: confirm where your host and email provider store data.] Where information is transferred outside South Africa, POPIA requires that it be protected by laws, binding corporate rules, or agreements offering an adequate level of protection comparable to POPIA, or that you have consented to the transfer. We take reasonable steps to ensure any such transfer meets these requirements.

8. Cookies and website analytics

This website currently uses only the essential cookies needed for it to function and stay secure. [IMPORTANT: If you later add analytics (such as Google Analytics) or any tracking or marketing cookies, you must update this section AND add a cookie-consent banner that gets the visitor's opt-in before those cookies load — POPIA requires consent for non-essential cookies.]

9. How long we keep your information

We keep your information only for as long as we need it for the purposes above, or as long as the law requires. Quote enquiries that don't become engagements are kept for [e.g. 12 months] and then deleted. Client and financial records are kept for the periods required by South African law [e.g. 5 years for tax records]. [SET YOUR ACTUAL PERIODS.]

10. How we protect your information

We take the security of your information seriously and apply reasonable technical and organisational measures to protect it against loss, unauthorised access, and misuse — including encryption in transit (HTTPS), access controls, and keeping our systems updated. No method of transmission or storage is ever completely secure, but we work hard to protect your data and to respond quickly if something goes wrong.

11. If there is a data breach

If personal information under our control is accessed or acquired by an unauthorised person, POPIA requires us to notify the Information Regulator and you (the affected data subject) as soon as reasonably possible. We have processes in place to do this.

12. Your rights under POPIA

As a data subject, you have the right to:

• Right to Be informed. That we are collecting your information, and to be notified if it is accessed by an unauthorised person.
• Right to Access. Request a copy of the personal information we hold about you.
• Right to Correction. Ask us to correct information that is inaccurate or incomplete.
• Right to Deletion. Ask us to delete or destroy information we are no longer entitled to keep.
• Right to Object. Object to our processing of your information, including for direct marketing, at any time.
• Right to Complain. Lodge a complaint with the Information Regulator (details below).

To exercise any of these rights, contact our Information Officer. We will respond in writing, and where you've asked for a correction or deletion we'll confirm the outcome within 30 days. You can object by any reasonable means — email, phone, or in writing.

13. Direct marketing

We will only send you marketing messages where the law allows it — either because you've consented, or because you're an existing client and it relates to similar services. Every marketing message will include a free and easy way to opt out, and we'll always honour your choice.

14. The Information Regulator

If you believe we have not handled your information lawfully and we haven't resolved it for you, you can complain to South Africa's Information Regulator:

15. Changes to this policy

We may update this policy from time to time as our business or the law changes. The "last updated" date at the top shows when it was last revised. Please check back occasionally.

16. How to contact us

For any privacy question or request, contact our Information Officer at hello@penlabs.co.za.