How Sgananda Group collects, processes, stores, and protects personal information in compliance with the Protection of Personal Information Act 4 of 2013.
Sgananda Group’s Information Officer is Edward Shezi (Managing Director), registered with the Information Regulator. Contact: edward@sganandagroup.co.za.
Identifying information (names, contact details), financial information for invoicing, employment records (staff), and client engagement records. Special personal information is processed only on the bases set out in POPIA section 27.
We process personal information on one or more of the bases in POPIA section 11: your consent, performance of a contract to which you are a party, compliance with our legal obligations, or our legitimate interest where it does not outweigh your rights.
You have the right to: access information held about you, request correction or deletion of inaccurate or unnecessary information, object to processing, withdraw consent (where consent is the lawful basis), and lodge a complaint with the Information Regulator (inforegulator.org.za).
We implement reasonable technical and organisational measures to safeguard personal information. Where a security compromise is identified, we notify the Information Regulator and affected data subjects within 72 hours of discovery.
Personal information is retained only as long as necessary for the purpose of processing or as required by law (tax records: five years under section 29 of the Tax Administration Act).
When you submit the contact form at /contact, the four fields you complete (name, organisation, email, and brief) are transmitted over an HTTPS connection to FormSubmit (formsubmit.co), a transactional form-handling service operated by Mohamed Boukheir. FormSubmit formats the submission as an email and forwards it directly to the Sgananda Group bid office Gmail inbox. FormSubmit does not retain the content beyond the delivery action.
FormSubmit is hosted in the United States. The Sgananda destination mailbox is hosted by Google Workspace or Google Mail, also in the United States. Under POPIA section 72, we satisfy the cross-border processing conditions because (a) you have granted your consent through the form's consent checkbox, (b) the receiving parties are subject to data-protection standards under contractual and statutory safeguards, and (c) the transfer is necessary for the performance of pre-contractual measures at your request. You may withdraw consent and request deletion of your brief at any time by emailing the Information Officer.
We do not use the form for marketing. We do not share submission content with any third party beyond the technical processor named above. Briefs are retained for the duration of the consequent engagement and for three years thereafter, after which they are securely destroyed.
The website uses two privacy-respecting third-party services. Each is disclosed below.
Bunny Fonts (fonts.bunny.net) serves the website’s typography. Bunny Fonts is operated by BunnyWay d.o.o. (Slovenia) under GDPR-equivalent conditions. The service does not log IP addresses for analytics or marketing purposes; it processes the IP only for the seconds required to serve the font files. Bunny operates an edge POP in Johannesburg, so font requests from South African visitors are served in-region in most cases.
Plausible Analytics (plausible.io) collects aggregated visit statistics so we know which pages are read and how visitors arrive. Plausible does not use cookies, does not track individuals across sites, does not collect personal information, and does not require a consent banner under POPIA or GDPR. The data Plausible collects is page URL, referring URL, browser type, operating system, country (not city), and the time of the visit. Plausible is hosted in the European Union under GDPR. Aggregated reporting is available to Sgananda’s Information Officer on request.
The Sgananda Group section 51 PAIA Manual is available at /paia-manual.