Privacy Notice

Website and General Business Privacy Notice

Version 1.1 | Effective date: 05 October 2026 | Review: annually or after material change

1. Purpose of this Privacy Notice

SAS Consulting respects the privacy of individuals and organisations whose personal information it processes. This Privacy Notice explains, in clear terms, what information SAS Consulting may collect, why it is used, how it is protected, when it may be shared, and how a data subject may exercise rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

This Notice is intended to meet the transparency requirements of section 18 of POPIA and applies to personal information processed through the SAS Consulting website as well as relevant business communications and service interactions.

2. Who is responsible for the information?

The responsible party is Christelle Hermann T/A SAS Consulting. Christelle Hermann is the Information Officer and is responsible for overseeing the handling of personal information within SAS Consulting.

3. Personal information we may collect

Depending on how you interact with SAS Consulting, we may process the following categories of information:

• Name and surname or other identifying information.
• Company or business name and professional role/contact information.
• Email address and telephone/cellphone number.
• Information contained in an enquiry, quotation request, service instruction or other correspondence.
• Documents and supporting information that you voluntarily provide or that are reasonably necessary for a service requested from SAS Consulting.
• Business, financial, employee, B-BBEE, skills-development or Employment Equity information where relevant to an agreed consulting service.
• Technical website information such as IP address, browser/device information and server logs where these are generated by the website or hosting environment.

4. How we collect personal information

• Directly from you, for example when you submit the website contact form, email SAS Consulting, telephone the business, communicate through WhatsApp, or provide information for an agreed service.
• From your authorised representatives or organisations where information is legitimately provided to SAS Consulting for an agreed service.
• From public or lawful business sources where reasonably necessary for a legitimate business or compliance purpose.

5. Why we process personal information

SAS Consulting may process personal information for purposes including:

• Responding to website and other business enquiries.
• Preparing quotations, proposals and service instructions.
• Providing agreed consulting services, including B-BBEE, skills-development/SDF, Procurement Support and related compliance services.
• Communicating with clients, suppliers, verification agencies, SETAs, training providers and other relevant parties where necessary for an agreed service or lawful business purpose.
• Maintaining client, supplier, financial, administrative and compliance records.
• Meeting legal, regulatory, tax, accounting or professional obligations.
• Protecting SAS Consulting systems, records, clients and business interests and managing security incidents where necessary.
• Improving the website or services where appropriate and lawfully permitted.

6. Lawful basis for processing

SAS Consulting processes personal information only where a lawful basis under POPIA applies. Depending on the circumstances, the relevant basis may include taking steps at the request of a data subject before entering into a contract, performing a contract, complying with a legal obligation, protecting a legitimate interest, or obtaining consent where consent is the appropriate basis.

Where consent is relied upon, it may be withdrawn subject to any lawful processing that took place before withdrawal and to any processing that remains permitted or required by law.

7. Is providing information voluntary or mandatory?

Website enquiries are generally voluntary. However, certain information may be necessary to respond to an enquiry or to provide a requested service. If necessary information is not provided, SAS Consulting may be unable to respond fully, prepare a quotation or perform the requested service. Where information is required by law or is necessary to perform an agreed service, SAS Consulting will explain this where reasonably practicable.

8. Recipients and sharing of personal information

Personal information will not be sold. SAS Consulting may disclose or make information available where reasonably necessary for the purpose for which it was collected, to perform an agreed service, to use authorised service providers, to comply with law, or where otherwise lawfully permitted.

• Authorised SAS Consulting users who require access for their duties.
• Technology and service providers used for email, cloud storage, website hosting, document transfer or other business functions, where relevant.
• Verification agencies, SETAs, training providers, clients, suppliers, professional advisers or other service participants where disclosure is necessary for the relevant service and is lawful.
• Courts, regulators, law-enforcement authorities, SARS or other public bodies where disclosure is required or lawfully permitted.

9. International processing and transfers

Some technology and service providers used by SAS Consulting may store or process personal information outside South Africa. Where a cross-border transfer or processing arrangement applies, SAS Consulting will take reasonable steps to ensure that the transfer is permitted under POPIA, including section 72 where applicable.

10. Security of personal information

SAS Consulting applies reasonable technical and organisational measures appropriate to the nature and risk of the information it processes. Current controls include:

• Two-factor authentication on the Microsoft and Gmail accounts.
• Windows login PIN protection and automatic screen locking on the main business desktop.
• Microsoft Defender / Windows Security and normal security updates.
• Controlled access to the SAS Consulting OneDrive client filing structure and authorised-user controls.
• Recipient and attachment verification before sending information by email and use of appropriate transfer methods.
• Encrypted backup of the SAS Consulting Documents environment to a disconnected VeraCrypt-protected external SSD, with periodic verification and restoration testing.
• Confidentiality obligations for authorised persons handling SAS Consulting information.

11. Retention of personal information

SAS Consulting does not retain personal information for longer than reasonably necessary for the purpose for which it was collected, unless continued retention is required or authorised by law, necessary for contractual or business recordkeeping purposes, or otherwise lawfully permitted. Website enquiry records may be retained for a reasonable period to maintain an enquiry and communication trail and to support follow-up, quotations, service records and legal or business requirements. Detailed retention and secure destruction controls are governed by the SAS Consulting Retention & Destruction Policy (12.5).

12. Data subject rights

Subject to applicable limitations and verification requirements, a data subject may have the right to:

• Request confirmation of whether SAS Consulting holds personal information about them and request access to that information.
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or request destruction/deletion of a record that SAS Consulting is no longer authorised to retain.
• Object to certain processing of personal information where permitted by POPIA.
• Withdraw consent where consent is the lawful basis for processing, subject to the legal effect of the withdrawal.
• Object to direct marketing by electronic communication and use applicable opt-out mechanisms.
• Lodge a complaint with the Information Regulator where the data subject believes that personal information rights have been interfered with.

Requests should be made in writing to the Information Officer at info@sasconsultingservices.co.za. SAS Consulting may need to verify the requester's identity before releasing or changing information. For access to personal information under section 23 of POPIA, the prescribed process and current forms published by the Information Regulator will be followed.

13. Direct marketing

SAS Consulting does not use information submitted through the website for unsolicited mass marketing. Where electronic direct marketing is undertaken, SAS Consulting will comply with the applicable requirements of POPIA, including any consent and opt-out requirements that apply.

14. Website cookies and analytics

The website may use cookies or similar technical mechanisms that are necessary for operation, security and basic functionality.

SAS Consulting uses Google Analytics to understand how visitors use the website and to improve the website and its services. Google Analytics may collect technical and usage information such as pages viewed, approximate location, browser/device information, referral source, interactions with website content and other website usage data.

SAS Consulting does not intentionally send names, email addresses, telephone numbers, enquiry messages or other directly identifying information submitted through the website contact form to Google Analytics.

Google Analytics is provided by Google and information processed through the service may be stored or processed outside South Africa. SAS Consulting will take reasonable steps to ensure that applicable POPIA requirements relating to third-party processing and cross-border processing are addressed.

Where required, SAS Consulting will implement appropriate privacy controls or consent mechanisms for non-essential analytics or tracking technologies.

Visitors who do not wish to have their activity measured by Google Analytics may use available browser or Google controls for managing analytics measurement.

15. Security compromises

If SAS Consulting becomes aware of a security compromise involving personal information, it will assess and manage the incident in accordance with POPIA and the SAS Consulting Data Breach / Security Compromise Procedure (12.6), including notification requirements that apply to affected data subjects and the Information Regulator.

16. Children and special personal information

The website is not intended to collect personal information from children, and visitors should not submit children's information through the enquiry form unless SAS Consulting specifically requests it and an appropriate lawful basis exists. Visitors should also avoid submitting special personal information through the general website enquiry form unless it is necessary for a specific lawful service.

17. Complaints and the Information Regulator

A data subject may first contact SAS Consulting so that the matter can be considered and addressed. A data subject may also lodge a complaint with the Information Regulator in the prescribed manner.

Information Regulator - South Africa

Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg

Telephone: 010 023 5200

Email: enquiries@inforegulator.org.za

Information Regulator POPIA forms: https://inforegulator.org.za/popia-forms/

18. Changes to this Privacy Notice

SAS Consulting may update this Privacy Notice when its services, website, information processing, technology providers or legal obligations materially change. The current version will be made available on the SAS Consulting website. The Notice will be reviewed at least annually and following material changes.

19. Contact details

Current POPIA forms: Information Regulator POPIA forms