POPI Act Compliance

1. Introduction

As a South African company, Spekboom Tree (Proprietary) Limited is committed to full compliance with the Protection of Personal Information Act 4 of 2013 ("POPI Act").

This page outlines how we comply with POPI Act requirements and your rights as a data subject under South African law.

3. POPI Act Principles We Follow

We process personal information in accordance with all eight POPI Act conditions:

4. Your Rights Under POPI

As a data subject, the POPI Act gives you these rights:

5. Cross-Border Data Transfers

We transfer personal information outside of South Africa to countries including:

• European Union: Supabase (database hosting) - Adequacy recognized
• United States: SendGrid, Twilio, Google, Sentry - Using Standard Contractual Clauses
• Nigeria: Paystack (payment processing) - Regional proximity

As required by Section 72 of POPI, we ensure adequate protection through:

• Adequacy decisions by the Information Regulator or EU Commission
• Standard Contractual Clauses approved for international transfers
• Processor commitments to equivalent protection standards

See our Data Processing Agreement for full details of all international processors.

6. Security Safeguards

To comply with Section 19 of POPI, we have implemented comprehensive security measures:

7. Data Breach Notification

In compliance with Section 22 of POPI, if a data breach occurs that compromises your personal information:

• We will notify the Information Regulator as soon as reasonably possible
• We will notify affected data subjects without undue delay
• Notifications will include the nature of the breach and remedial measures
• We will take immediate steps to mitigate risks and prevent further breaches

8. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected:

• Active accounts: Duration of account + 6 months
• Financial records: 7 years (as required by tax law)
• Marketing consent: Until consent is withdrawn
• Communication logs: 1 year for service quality

After retention periods expire, we securely delete or anonymize your information.

9. Children's Privacy

Our services are intended for users aged 18 and above. We do not knowingly collect personal information from children without parental consent as required by Section 35 of POPI.

If we become aware that we have collected information from a child under 18 without proper consent, we will delete that information promptly.

10. Filing a Complaint

If you believe we have not handled your personal information in accordance with POPI, you have the right to lodge a complaint:

11. Updates to This Page

We may update this POPI compliance statement from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page shows when the most recent update occurred.