Website Privacy Terms & POPI Act Compliance Policy
A public notice for all visitors to the GADASWORX website
In terms of the Protection of Personal Information Act 4 of 2013 (POPIA)
Company | Gadas Holdings (Pty) Ltd t/a GADASWORX |
Document title | Website Privacy Terms & POPI Act Policy |
Audience | All website visitors, clients, users and members of the public |
Version | 1.0 |
Effective date | April 2025 |
Review date | April 2026 |
Governing law | Republic of South Africa |
Information Officer | Ms. K. Lindt |
Privacy email | privacy@gadasworx.co.za |
Website | www.gadasworx.co.za |
1 Introduction & Purpose
Gadas Holdings (Pty) Ltd t/a GADASWORX (“GADASWORX”, “we”, “us”, “our”) is committed to protecting the privacy and personal information of every person who visits our website, uses our services, or interacts with us in any way.
This Website Privacy Policy has been prepared in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and sets out plainly:
- What personal information we collect when you visit our website
- Why we collect it and how we use it
- Your rights regarding your personal information
- How to contact us or lodge a complaint
By continuing to use our website, clicking ‘Accept’ on our cookie notice, or submitting any form on our site, you acknowledge that you have read and understood this Policy and consent to the processing of your personal information as described herein.
If you do not agree with any part of this Policy, please do not use our website.
Definitions
The following terms are used throughout this Policy:
Term | Definition |
Cookies | Small text files stored on your device by your browser when you visit a website. |
Data Subject | The natural or juristic person to whom personal information relates — i.e., you, the visitor. |
Information Officer | The GADASWORX person registered with the Information Regulator, responsible for POPIA compliance. |
Operator | A third party who processes personal information on our behalf (e.g. hosting provider, email platform). |
Personal Information | Any information that can identify you — name, email address, IP address, device identifiers, etc. |
Processing | Any action taken with personal information: collecting, storing, sharing, deleting, and more. |
Responsible Party | GADASWORX — the entity that determines how and why your personal information is processed. |
Special Information | Sensitive personal data such as health, race, religion, biometrics, sexual orientation, or criminal history. |
POPIA / POPI Act | Protection of Personal Information Act 4 of 2013. |
Information Regulator | The independent South African authority that enforces POPIA. |
Scope & Application
This Policy applies to:
- All visitors to www.gadasworx.co.za, regardless of location
- Anyone who submits a contact form, application, enquiry, or request through our website
- Anyone who subscribes to our newsletter or marketing communications
- Anyone whose personal information is collected via cookies or tracking technologies on our website
This Policy must be read together with any other terms and conditions or specific notices presented to you at the time of data collection.
Lawful Basis for Processing
We only collect and use your personal information where we have a lawful basis to do so under POPIA. This includes:
- Consent — you have given us clear, specific, and voluntary consent (e.g. accepting our cookie notice or subscribing to communications)
- Contract — we need your information to provide a service you requested or to respond to your enquiry
- Legal obligation — we are required by law to collect or retain certain information
- Legitimate interest — we have a legitimate business reason that does not override your rights (e.g. website security monitoring)\
Conditions for Lawful Processing (POPIA Chapter 3)
GADASWORX processes your personal information in accordance with all eight conditions for lawful processing set out in Chapter 3 of POPIA:
Accountability
GADASWORX takes responsibility for all personal information on our website and ensures all processing conditions are met at all times.
Processing limitation
We only collect personal information that is necessary for the purpose stated. We collect directly from you wherever possible.
Purpose specification
We tell you clearly why we are collecting your information at the time of collection. We do not retain it beyond what is necessary.
Further processing limitation
Your information will not be used for a purpose incompatible with why it was originally collected, unless you consent.
Information quality
We take reasonable steps to ensure your information is accurate, complete, and up to date.
Openness
This Policy and our cookie notice explain exactly what we collect, why, and who may receive it.
Security safeguards
We apply technical and organisational security measures to keep your information safe from unauthorised access or loss.
Data subject participation
You can request access to, correction of, or deletion of your personal information at any time.
Categories of Personal Information Collected
When you use our website, we may collect the following types of personal information:
Information you provide directly
- Full name and email address (via contact or application forms)
- Phone number and physical or postal address (if provided)
- CV / résumé and employment history (via job application forms)
- Identity or passport number (where required for applications)
- Message content and enquiry details
Information collected automatically
- IP address and approximate geographic location
- Browser type, version, and operating system
- Device identifiers and screen resolution
- Pages visited, time spent, and navigation paths
- Referral source (how you found our website)
- Cookie identifiers and session data
We do not collect Special Personal Information (e.g. health, race, religion, biometrics) through our website unless explicitly required and separately consented to.
Purpose of Processing
Purpose of Processing
- Responding to enquiries, quote requests, and contact form submissions
- Processing job applications and recruitment activities
- Sending you communications you have subscribed to or requested
- Improving the performance, design, and content of our website
- Measuring website traffic and user behaviour (analytics)
- Personalising your experience on our website
- Detecting and preventing fraud, abuse, or security threats
- Complying with legal obligations under POPIA and other applicable legislation
- Sending direct marketing material (only where you have consented or opted in)
Your Rights as a Data Subject
Under POPIA, you have the following rights in relation to your personal information held by GADASWORX:
Right of access
You may request a copy of the personal information we hold about you and details of how we use it.
Right to correction
You may ask us to correct inaccurate, outdated, or incomplete personal information.
Right to deletion
You may request that we delete your personal information if it is no longer necessary, was obtained unlawfully, or you withdraw consent.
Right to object
You may object to the processing of your personal information, including for direct marketing.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect lawful processing that already occurred.
Right to complain
You may lodge a complaint with GADASWORX’s Information Officer or directly with the Information Regulator of South Africa.
To exercise any of these rights, contact our Information Officer:
privacy@gadasworx.co.za | |
Response | Within 30 business days of receipt |
Retention & Destruction of Records
We keep your personal information only for as long as is necessary for the purpose it was collected, or as required by law.
Enquiry / contact form data | 12 months from last interaction |
Job application data | 6 months if unsuccessful; duration of employment if appointed |
Newsletter subscription data | Until you unsubscribe |
Website analytics / cookies | Up to 12 months |
Financial transaction records | 5 years (Companies Act / SARS) |
Legal / contractual records | Duration of relationship + 5 years |
When your information is no longer required, it will be securely deleted or de-identified so it cannot be traced back to you.
Security Safeguards
GADASWORX takes the security of your personal information seriously. We implement appropriate technical and organisational safeguards, including:
- SSL/TLS encryption for data transmitted via our website
- Password protection and access controls on all systems storing personal data
- Role-based access permissions for staff
- Regular security assessments and vulnerability testing
- Employee privacy and data security training
- Secure deletion procedures for data no longer required
While we take all reasonable precautions, no internet transmission is completely secure. We cannot guarantee absolute security, but will notify you and the Information Regulator if a breach occurs.
Third-Party Operators & Transborder Flows
GADASWORX takes the security of your personal information seriously. We implement appropriate technical and organisational safeguards, including:
Third-party service providers (operators)
We may share your personal information with trusted third parties who assist us in operating our website, including:
- Web hosting and cloud infrastructure providers
- Email marketing and communication platforms
- Analytics providers (e.g. Google Analytics)
- Payment processors (where applicable)
All operators are bound by written data processing agreements and may only process your information as instructed by us and in accordance with POPIA.
Transborder transfers
Where data is transferred outside South Africa, we ensure the recipient country provides an adequate level of protection equivalent to POPIA, or we obtain your explicit consent before the transfer.
We do not sell, rent, or trade your personal information to any third party.
We never sell your personal information. Ever.
Direct Marketing
We will only send you marketing communications if you have opted in or subscribed. Each communication will include a clear and easy way to unsubscribe.
To opt out at any time:
- Email us at privacy@gadasworx.co.za with the subject line “Unsubscribe”
- Click the unsubscribe link in any marketing email you receive from us
Once you opt out, we will remove you from all marketing lists within 5 business days.
Cookies & Online Tracking
Our website uses cookies and similar technologies. A cookie is a small file stored on your device that helps us recognise you and improve your experience.
Essential cookies | Required for the website to function. Cannot be switched off. No personal data stored. |
Analytical cookies | Help us understand how visitors use our site. Data is anonymised and aggregated. |
Marketing cookies | Used to show you relevant content and measure campaign effectiveness. |
Preference cookies | Remember your settings and choices to personalise your experience. |
On your first visit to our website, a cookie consent banner will ask for your permission. You may:
- Accept all cookies
- Decline non-essential cookies
- Manage preferences via your browser settings at any time
Disabling certain cookies may affect website functionality. For more information about cookies, visit www.allaboutcookies.org.
Breach Notification
If a security incident results in unauthorised access to or loss of your personal information, GADASWORX will:
- Investigate the breach promptly and take immediate corrective action
- Notify the Information Regulator as soon as reasonably possible
- Notify you directly if the breach is likely to result in a real risk of harm to you, unless notification would impede a criminal investigation
To report a suspected security incident, contact us immediately at privacy@gadasworx.co.za
Information Officer
GADASWORX has appointed a designated Information Officer who is responsible for:
- Encouraging and maintaining POPIA compliance
- Handling all requests from data subjects (you)
- Liaising with the Information Regulator
- Ensuring this Policy remains current and accurate
Information Officer | Ms. K. Lindt |
privacy@gadasworx.co.za | |
Telephone | +27(0)87 265 6592 |
Physical address | 140 West Street, Sandton, 2196 |
Response time | Within 30 business days of receipt of request |
Information Regulator of South Africa
Website | www.inforegulator.org.za |
inforeg@justice.gov.za | |
Telephone | 010 023 5207 |
Complaints & Enforcement
GADASWORX has appointed a designated Information Officer who is responsible for:
- Encouraging and maintaining POPIA compliance
- Handling all requests from data subjects (you)
- Liaising with the Information Regulator
- Ensuring this Policy remains current and accurate
We will acknowledge your complaint within 5 business days and respond fully within 30 business days.
Policy Review & Updates
We review this Policy at least once a year or whenever:
- There are changes in applicable legislation or regulatory guidance
- We introduce new website features or data collection practices
- A security incident or data breach occurs
- Directed by the Information Regulator
When this Policy is updated, we will revise the effective date at the top of the document and, where appropriate, notify you by email or a website notice. We encourage you to review this Policy periodically.
Continued use of our website after a Policy update constitutes acceptance of the revised terms.
Governing Law
This Policy is governed by the laws of the Republic of South Africa, including:
- Protection of Personal Information Act 4 of 2013 (POPIA)
- Electronic Communications and Transactions Act 25 of 2002 (ECTA)
- Consumer Protection Act 68 of 2008
- Companies Act 71 of 2008
Any dispute arising from or related to this Policy shall be subject to the jurisdiction of the South African courts.
Quick Reference — Your Privacy at a Glance
What we collect | Name, email, phone, IP address, cookies, usage data, and any information you submit via forms. |
Why we collect it | To respond to you, improve our website, process applications, comply with law, and send communications you requested. |
Who we share it with | Trusted operators (hosting, email, analytics) under written agreements. We never sell your data. |
How long we keep it | Only as long as necessary — see Section 9 for specific periods. |
Your rights | Access, correct, delete, object, withdraw consent, and complain. Contact privacy@gadasworx.co.za. |