Privacy Policy.

This is the Privacy Policy of Datazone (Pty) Ltd, registration number 2026/108479/07, of 63 Protea Road, Claremont, Cape Town, Western Cape, 7708 (Datazone, we, us or our). It applies to visitors to the Datazone website, applicants for Market Access, approved Premium+ users and persons who communicate with us (you or your).

Use of the public website is also subject to the Website Terms of Use. Use of Premium+ is subject to the separate Premium+ Access Terms. We may update this Policy from time to time. The updated version will be published with its effective date and, where practical, material changes will be notified.

1. What personal information do we collect?
2. “Personal information” has the meaning given to it in the Protection of Personal Information Act 4 of 2013 (POPIA) and includes information relating to an identifiable natural or juristic person.
3. Depending on how you interact with us, we may collect your name and surname; business email address and phone number; employer, role or professional affiliation if provided; Market Access request, date, status and decision; account identifier and authentication information; acceptance records; sign-in, password-reset, session, security and audit logs; IP address, device and browser information; product-usage events; support correspondence; communication preferences; and any other information you choose to provide.
4. Please do not provide information that is not reasonably required for your Market Access request or use of Premium+. If you provide information about another person, you must be authorised to do so.

1. How do we use cookies and similar technologies?
2. We may use cookies and similar technologies that are strictly necessary to operate authentication, security and user sessions. These technologies help recognise an authorised session, protect accounts and maintain the operation of Premium+.
3. If we introduce analytics, advertising or other non-essential technologies, we will update this Policy and the website interface to explain their purpose and duration and provide any choice required by applicable law. You may configure your browser to block cookies, but blocking necessary cookies may prevent sign-in or use of Premium+.

1. Why do we collect personal information?
2. We process personal information for specific, lawful and clear purposes, including to receive and assess Market Access requests; communicate the outcome; create, authenticate, secure and administer named-user accounts; provide and improve Premium+; reset credentials; provide support; maintain audit and security records; prevent misuse or credential sharing; enforce applicable terms; comply with legal obligations; maintain ordinary business records; and establish, exercise or defend legal rights.
3. We may use de-identified or aggregated information for research, service improvement, analytics and publications where individuals are not identifiable.

1. On what legal grounds do we process personal information?

We process personal information where necessary to take steps at your request, perform an access arrangement, comply with law, or pursue Datazone’s or a third party’s legitimate interests subject to your rights. Where consent is the appropriate legal ground, including optional electronic marketing, you may withdraw it at any time. Withdrawal does not affect processing already lawfully undertaken.

1. How do we collect personal information?
2. We generally collect information directly from you when you submit a Market Access request, activate or use an account, correspond with us or request support. We may also receive business contact information from your organisation, an authorised representative, an event interaction or a service provider supporting the access process, where lawful.
3. The production service may automatically record authentication, session, security and usage information reasonably necessary to administer and protect Premium+.

1. What if you do not provide the information we need?
2. You are not legally required to apply for Market Access. However, information identified as required is necessary to assess your request and administer an approved account. If you do not provide it, we may be unable to evaluate the request, issue credentials, communicate the outcome or provide Premium+.
3. Optional information and optional direct-marketing consent may be declined without affecting the assessment of your Market Access request.

1. Do we disclose personal information to third parties?
2. We may disclose personal information to authorised Datazone personnel and operators that need it for the stated purposes, including providers of hosting, authentication, email, communications, customer support, analytics and security. We may also disclose information to auditors, insurers, professional advisers, law-enforcement or regulatory authorities where lawfully required, and parties to a genuine corporate transaction subject to appropriate safeguards.
3. Our operators may process personal information only for authorised purposes under appropriate contractual and security requirements. Datazone does not sell personal information or share it with third parties for their own marketing purposes.

1. Will we transfer personal information across borders?

Some systems or operators may process information outside South Africa. Where this occurs, Datazone will comply with POPIA’s requirements for cross-border transfers and use reasonable contractual, organisational and technical safeguards. The production hosting, operator locations and transfer arrangements must be confirmed before launch and this Policy updated if necessary.

1. How do we store, retain and delete personal information?
2. We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, an applicable legal or contractual requirement, security and audit needs, or the establishment, exercise or defence of legal claims.
3. When information is no longer lawfully required, we will delete, destroy or de-identify it in a manner that prevents reconstruction. The retention periods for unsuccessful requests, approved accounts, acceptance records, access logs and support correspondence will be recorded in Datazone’s approved retention schedule before launch.

1. How do we protect personal information?
2. We use appropriate, reasonable technical and organisational measures designed to prevent loss, damage, unauthorised destruction, access, processing or disclosure. Measures may include access controls, encrypted transmission, authentication safeguards, logging, monitoring, backups and operator controls.
3. No internet service is completely secure. You must protect your credentials, use a strong unique password, sign out of shared devices and notify us promptly if you suspect that your account or personal information has been compromised.

1. Can you access or correct your personal information?
2. Subject to POPIA, PAIA and other applicable law, you may ask whether we hold personal information about you; request access to it; request correction, deletion or destruction where the requirements are met; object to processing on permitted grounds; withdraw consent where processing depends on consent; and object to direct marketing.
3. We may require reasonable proof of identity and may refuse or limit a request where law permits, including where disclosure would prejudice another person’s privacy or confidential information. If we decline a request, we will provide reasons where required.

1. How do we use personal information for marketing?

We will use your contact details for electronic marketing only where permitted by law. Where prior consent is required, marketing consent will be requested separately and will not be a condition of Market Access. Each marketing communication will provide a reasonable way to opt out. Operational communications concerning an application, account, security or the service are not marketing.

1. What happens if there is a security compromise?

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Datazone will investigate and notify the Information Regulator and affected persons as soon as reasonably possible, subject to any lawful direction or permitted delay. If Datazone acts as an operator for another responsible party, it will notify that responsible party immediately where required by POPIA.

1. What about third-party websites and content?

This Policy does not apply to third-party websites linked from Datazone’s website or Premium+. Those third parties are responsible for their own privacy practices. A link or reference does not mean that Datazone endorses or controls the third party.

1. Is automated decision-making used?

Market Access requests are intended to be reviewed by Datazone personnel. Datazone does not intend to make a decision based solely on automated processing that has legal or similarly significant effects unless the safeguards required by law are implemented and explained to the affected person.

1. Enquiries and complaints
2. Datazone’s Information Officer has not yet been formally appointed and registered. Until the formal appointment details are published, privacy enquiries, objections and requests may be sent to insights@datazone.co.za or delivered to Datazone at 63 Protea Road, Claremont, Cape Town, Western Cape, 7708, marked “Privacy Enquiry”.
3. Appointment and registration of the Information Officer, and publication of the officer’s contact details, must be completed as part of the production compliance process.
4. You may also complain to the Information Regulator (South Africa). Current contact details and prescribed forms are available at https://inforegulator.org.za/. At the date of this Policy, POPIA complaints may be directed to POPIAComplaints@inforegulator.org.za. These details should be verified before publication.