Privacy, POPIA and Cookies

1. Who we are and how to reach us

2. What we collect

• *Contact and engagement data: name, email, phone, organisation, role, and the messages you send. Inputs to our navigators, such as your stated needs and priorities, are stored to generate your recommendation and to follow up.
• *Operational data: if you become a client, project records such as statements of work, invoices, deliverables and audit logs.
• *Technical data: IP address, device and browser, pages viewed and timestamps, collected through server logs and cookies.
• *Optional marketing data: newsletter opt-ins, event registrations and campaign responses, where you choose to give them.

3. How we use your information

We use the information above to respond to your enquiry, clarify your needs, prepare a recommendation, and arrange a meeting where you ask for one; to enter into and perform a contract with you or your organisation, including scoping, delivery, billing and support; to operate, secure and improve this site and our services, including aggregated analytics and security monitoring; to meet our legal and regulatory obligations, including tax and financial recordkeeping and POPIA and PAIA requirements; and, where you have opted in, to send marketing, event and thought leadership communications.

4. Use of AI and third-party tools

We use artificial intelligence tools and third-party model providers to help process information, including in the analysis and delivery of our work. Where these process personal information, they act as our operators under written agreements that limit them to our documented instructions and require appropriate, POPIA-aligned safeguards. Some of this processing takes place outside South Africa, under the protections described in the cross-border section below. We apply purpose limitation: AI tools process only what is necessary for the specific task, and we do not use personal information to train third-party AI models without explicit consent.

5. Our lawful basis for processing (POPIA section 11)

• *Consent: when you use our navigation tools and contact forms, you consent to us processing what you submit and contacting you to respond. Marketing consent is separate and is given only by opting in.
• *Contract: to enter into or perform a contract with you or your organisation.
• *Legal obligation: to comply with applicable law.
• *Legitimate interests: to operate, secure and improve our site and services, balanced against your privacy rights.

6. Cookies and similar technologies

South Africa has no standalone cookie statute, so we treat cookies under POPIA and ECTA and as a matter of good practice. Essential cookies are required for core functionality, security and remembering your preferences. Analytics cookies help us measure traffic and performance and improve content, in aggregate. Marketing cookies are used only if you opt in. You can accept or decline non-essential cookies through our cookie controls and change your choice at any time, and you can also manage cookies through your browser settings, though disabling essential cookies may affect how the site works.

7. Where your information comes from

Directly from you, through forms, email and meetings; from your organisation or colleagues when we work under a contract; and automatically from your device when you browse this site, through logs and cookies.

8. Sharing and disclosures

• *Operators: we use reputable cloud, analytics and AI providers under written agreements, as POPIA section 21 requires, that oblige confidentiality, processing only on our instructions, and appropriate security.
• *Partners: for delivery under our governance model, we may share only the data necessary, strictly for the agreed purpose.
• *Legal: we may disclose information where the law requires it, or to protect rights, safety and security.
• *We do not sell personal information.

9. Cross-border transfers (POPIA section 72)

Some providers, including AI and cloud providers, store or process data outside South Africa. Where this happens, we transfer personal information only as POPIA permits, using providers bound by appropriate safeguards such as contractual protections and recognised security standards, or where you have consented or the transfer is necessary to perform our contract with you.

10. Security and breach notification

We apply reasonable technical and organisational measures, including access controls, encryption in transit, environment hardening, monitoring and least-privilege access. No system is completely secure. If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as POPIA section 22 requires.

11. How long we keep information

We keep personal information only as long as necessary for the purposes above, including legal and contractual obligations. Typical periods: enquiries and navigator submissions up to 24 months; client records for the contract term plus the applicable statutory period; billing and tax records for five to seven years or as the law requires.

12. Your rights under POPIA

• *Access: request confirmation of, and a copy of, the personal information we hold about you.
• *Correction and deletion: ask us to correct information that is inaccurate or out of date, or to delete information we are no longer entitled to keep. The prescribed POPIA forms are available on request.
• *Objection: object, on reasonable grounds, to processing we base on legitimate interests, and object at any time to processing for direct marketing. You can object free of charge through accessible channels, including email.
• *Withdraw consent: withdraw marketing or enquiry-based consent at any time.
• *A portable copy: although POPIA does not require it, we will, where reasonably practicable, provide your information in a commonly used electronic format on request.
• *Complain: lodge a complaint with the Information Regulator of South Africa, or institute civil proceedings.

To exercise any of these, email info@satchelandboot.co.za. To reach our Information Officer or request our PAIA manual, use the same address. You can contact the Information Regulator at https://inforegulator.org.za or POPIAComplaints@inforegulator.org.za.

13. Direct marketing

We send marketing or event communications only where the law allows. For electronic marketing we identify ourselves as the sender and include an opt-out in every message, in line with POPIA section 69 and the Information Regulator's Direct Marketing Guidance Note. Where required, we obtain your prior opt-in before sending electronic marketing, and we rely on the existing-customer exception only within its limits. To stop marketing at any time, use the unsubscribe link or email info@satchelandboot.co.za.

14. Automated processing (POPIA section 71)

Our navigation tools generate a recommendation to help us route your enquiry. This is not a decision made solely by automated means that produces a legal effect or similarly significant effect for you, because a person reviews and follows up. You can ask us about any recommendation that affects you.

15. Children

This site and our services are intended for business use. We do not knowingly collect personal information from children under 18 without appropriate authority.

16. Email communications

This policy governs the data-protection and confidentiality terms of our email. Our emails carry a short notice confirming that the communication is confidential and intended only for the named recipient, that it is subject to POPIA, and that our full privacy and legal terms are available on this page. Our liability is governed by our written engagement agreements, not by an email footer.

17. Changes to this policy

We may update this page to reflect changes to our practices or the law. The effective date shows the latest version, and material changes will be signposted on the site.