Privacy Notice — Protection of Personal Information Act, 2013
| Document Code | PRP-POPIA-Privacy-Notice-v2.0 |
|---|---|
| Document Title | Privacy Notice |
| Version | 2.0 |
| Effective Date | July 2026 |
| Review Date | March 2027 |
| Classification | PUBLIC |
| Document Owner | Information Officer — Johan Jordaan |
| Legal Framework | POPIA Act 4 of 2013; POPIA Regulations 2018 |
1 Who We Are
PRP Solutions (Pty) Ltd (“PRP Solutions”, “we”, “us”, “our”) is a responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”). This Privacy Notice explains how we collect, use, store, and protect your personal information.
Our Information Officer can be contacted as follows:
| Information Officer | Johan Jordaan |
|---|---|
| io@prpsolutions.com | |
| Telephone | 086 100 0476 |
| Physical Address | Thirty Twenty-One, Block A Ground Floor, 3021 Winnie Mandela Drive, Bryanston, 2194 |
2 Personal Information We Collect
We may collect and process the following categories of personal information:
- Identification information: full name, identity number, date of birth, gender;
- Contact information: postal address, email address, telephone and mobile numbers;
- Financial information: banking details, payment history, credit information (where applicable and consented to);
- Employment information: employer name, job title, employment history (for service relationships);
- Communication records: correspondence, enquiries, support tickets;
- Technical information: IP addresses, browser type, cookies, usage data collected through our website and systems;
- Any other personal information you voluntarily provide to us.
We process special personal information (health data, biometric data, etc.) only where we have an explicit legal basis under ss.26–32 of POPIA and with your express consent where required.
3 Why We Collect Your Personal Information
We process your personal information for one or more of the following purposes:
- To provide, manage, and administer our products and services;
- To fulfil contractual obligations to you or to a third party;
- To comply with legal and regulatory requirements (including tax, financial, and employment law obligations);
- To manage our business operations, including credit assessment, fraud prevention, and risk management;
- To respond to your enquiries and complaints;
- To send you relevant information, updates, and communications about our services (subject to your marketing preferences);
- For security, audit, and compliance purposes.
4 Lawful Basis for Processing
We process your personal information only where we have a lawful basis to do so under s.11 of POPIA:
- Your consent (s.11(1)(a));
- Performance of or entry into a contract with you (s.11(1)(b));
- Compliance with a legal obligation applicable to PRP Solutions (s.11(1)(c));
- To protect your vital interests (s.11(1)(d));
- Our legitimate interests or those of a third party, balanced against your rights and interests — a Legitimate Interests Assessment has been performed where this basis is relied upon (s.11(1)(f)).
5 Who We Share Your Personal Information With
We may share your personal information with:
- Our employees, contractors, and authorised agents, on a need-to-know basis;
- Operators (service providers and suppliers) who process personal information on our behalf under written contracts containing equivalent data protection obligations;
- Regulatory authorities, courts, or law enforcement agencies where required by law;
- Credit bureaus, insurers, or financial institutions where necessary for the provision of our services;
- Professional advisors (legal, accounting, auditing) under confidentiality obligations.
We do not sell your personal information to third parties. Any disclosure of personal information to third parties for commercial purposes requires your prior consent.
6 Cross-border Transfers
Where we transfer your personal information to recipients outside South Africa, we do so only where permitted by s.72 of POPIA — that is, where the recipient country provides adequate data protection, where you have consented, or where we have contractually imposed equivalent protections.
7 How Long We Keep Your Personal Information
We retain personal information for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our retention periods are set out in our Data Retention and Destruction Policy (PRP-POPIA-Data-Retention-and-Destruction-Policy-v2.0). When no longer required, personal information is securely deleted or destroyed.
8 Security of Your Personal Information
We implement appropriate technical, physical, and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. In the event of a security compromise affecting your personal information, we will notify you as required by s.22 of POPIA.
9 Your Rights as a Data Subject
You have the following rights under POPIA:
- Right to access: to request confirmation of whether we hold personal information about you, and to access that information (s.23);
- Right to correction: to request correction of inaccurate, incomplete, or outdated personal information (s.24);
- Right to deletion: to request deletion or destruction of personal information we are no longer entitled to hold (s.24);
- Right to object: to object to the processing of your personal information in certain circumstances (s.11(3));
- Right to withdraw consent: to withdraw consent to processing at any time, without prejudice to the lawfulness of processing before withdrawal (s.11(2));
- Right to opt out of direct marketing: to opt out of electronic direct marketing communications at any time, including by registering on the National Opt-Out Register (s.69 of POPIA; s.45 of the ECT Act);
- Right to human review of automated decisions: to request that any decision based solely on automated processing of your personal information be reviewed by a natural person (s.71);
- Right to complain: to lodge a complaint with the Information Regulator (s.73).
To exercise any of these rights, please contact our Information Officer at io@prpsolutions.com. We will acknowledge your request within 5 (five) business days and respond within 30 (thirty) days.
10 Cookies and Online Tracking
Our website uses cookies and similar technologies to improve user experience and analyse usage patterns. We use only the cookies necessary for the operation of our website unless you have provided consent for additional cookies. You may manage your cookie preferences through your browser settings. Our Cookie Policy is available on our website.
11 Direct Marketing
We will only send you marketing communications where you have consented, or where you are an existing customer and we are promoting similar products or services. You may opt out at any time by contacting us at io@prpsolutions.com, using the unsubscribe link in any marketing communication, or registering on the National Opt-Out Register administered by the Information Regulator.
12 Children
Our services are not directed at children under the age of 18. We do not knowingly collect personal information from children without the prior consent of a competent person. If you believe we have inadvertently collected a child’s personal information, please contact our Information Officer immediately.
13 Updates to This Notice
We may update this Privacy Notice from time to time to reflect changes in our processing practices or applicable law. Material updates will be communicated to you. This Notice was last updated in July 2026.
14 Contact and Complaints
For questions or concerns about this Notice or our data protection practices, please contact:
| Information Officer | Johan Jordaan |
|---|---|
| io@prpsolutions.com | |
| Telephone | 086 100 0476 |
| Address | Thirty Twenty-One, Block A Ground Floor, 3021 Winnie Mandela Drive, Bryanston, 2194 |
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:
| Information Regulator | Information Regulator (South Africa) |
|---|---|
| Address | SALU Building, 316 Thabo Sehume Street, Pretoria, 0001 |
| Telephone | +27 (0)10 023 5200 |
| enquiries@inforegulator.org.za |
15 Document Approval
| Role | Name | Date |
|---|---|---|
| Information Officer | Johan Jordaan | 27 July 2026 |
| Chief Executive Officer | Miles Crisp | 27 July 2026 |
16 Document History
| Version | Date | Author | Description of changes |
|---|---|---|---|
| 2.0 | July 2026 | Johan Jordaan | Initial issue |
All rights reserved. Full copyright to this document, its form and content, vests in PRP and is confidential, legally privileged and protected by law. No part of this document may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise or disclosed to third parties without the prior written permission of the copyright owner.