Privacy policy

01Who this policy applies to

Lumaxio Consult is the responsible party for the personal information described here, as that term is used in the Protection of Personal Information Act 4 of 2013. The practice determines the purpose of and means for processing that information, and is accountable for it.

This policy covers three groups of people. Visitors to this website, people who make an enquiry by email, and clients and their nominated representatives during an engagement. Where a client is itself a responsible party and the practice processes information on its behalf, the practice acts as an operator and the client's own privacy policy governs that processing.

All questions about this policy go to the Information Officer at .

02What personal information is processed

Website visitors

This website sets no cookies, runs no analytics or tracking scripts, and carries no contact form. Nothing you do on the site is recorded by the practice. The web host records standard server log data, including IP address, browser type and pages requested, for security and availability purposes.

People who enquire

• Identifying details such as name, job title and organisation.
• Contact details such as email address and, where you supply it, a telephone number.
• Enquiry content, meaning whatever you choose to write in your message.

Clients

• Engagement records including correspondence, meeting notes, briefs and deliverables.
• Contracting and billing details including entity details, billing contacts, VAT registration where applicable, and banking details supplied for payment.
• Any personal information contained in client material supplied to the practice for the purpose of the engagement, such as staff names in a competency assessment or user records in a systems review.

Special personal information as defined in section 26 of the Act, and the personal information of children, are not sought and are not processed unless a specific engagement requires it and a lawful basis under sections 27 to 35 applies.

03How it is collected

Personal information is collected directly from you, in almost every case. It reaches the practice when you send an email, speak in a scheduled session, sign a Statement of Work, or supply documents and data for an engagement.

Limited information may be collected from public sources, such as an organisation's own website or a public professional profile, when preparing for a first conversation or a market advisory engagement. Where information about you is collected from a source other than you, section 18 of the Act requires that you be notified, and the practice will do so unless one of the exceptions in section 18(4) applies.

04Why it is processed, and on what basis

Personal information is processed only for the purposes set out below, each of which is supported by one of the justifications in section 11 of the Act.

• Responding to enquiries and establishing whether there is a fit between what you need and what the practice delivers. Basis, your consent and the steps taken at your request before entering a contract.
• Delivering an engagement, including analysis, drafting and the production of deliverables. Basis, performance of the contract recorded in the Statement of Work.
• Invoicing, payment and financial record keeping. Basis, performance of the contract and compliance with obligations imposed by law.
• Meeting statutory obligations, including tax and company record keeping. Basis, compliance with an obligation imposed by law.
• Protecting the legitimate interests of the practice, such as maintaining records of advice given and defending a claim. Basis, legitimate interests under section 11(1)(f).

Information is not used for any purpose incompatible with the one for which it was collected, and it is not sold, rented or traded.

05Third party services used on this site

This site loads typefaces from Google Fonts. Your browser requests those files directly from servers operated by Google, which means your IP address and browser details are visible to Google when a page loads. That is a transfer of limited technical information outside South Africa. It is the only third party request the site makes.

If you would prefer that no request leaves for a third party, the typefaces can be served from the practice's own domain instead. Email the Information Officer and it will be arranged.

Scheduling a consultation

The booking links on this site open a scheduling calendar operated by Calendly, a third party provider, on its own domain. Nothing is sent to that provider simply by loading a page here. If you choose to book, the name, email address and any details you enter are collected by it under its own privacy terms, and the booking details are then passed to the practice so that the meeting can be held.

If you would rather not use an outside scheduling service, email the practice directly and a time will be arranged by correspondence instead.

06Who information is shared with

Personal information is not disclosed to third parties for their own purposes. It is shared only in the circumstances below, and only to the extent necessary.

• Service providers acting as operators, including cloud storage, email hosting, video conference and accounting providers. Each processes information only on the instruction of the practice and under a confidentiality obligation, as required by sections 20 and 21 of the Act.
• A technical specialist working under direct supervision on build intensive deliverables such as reporting systems, bound by the same confidentiality obligations that apply to the practice.
• A scheduling provider, where you choose to book a consultation through the calendar linked on this site, limited to the booking details you enter there.
• Professional advisers, such as an accountant or attorney, where necessary and under professional privilege or confidentiality.
• A public authority, where disclosure is required by law, a court order or a valid regulatory demand.

07Transfers outside South Africa

Cloud services used by the practice, including document storage and video conference platforms, may store or process information on servers outside South Africa. Section 72 of the Act permits such a transfer where the recipient is subject to a law, binding rules or an agreement that upholds principles of lawful processing substantially similar to those in the Act, where you have consented, or where the transfer is necessary to perform a contract with you.

Where an engagement calls for information to stay within South Africa, or within a nominated jurisdiction, say so at the outset and the arrangement will be recorded in the Statement of Work.

08Security safeguards

Section 19 of the Act requires appropriate, reasonable technical and organisational measures. The measures in place are these.

• Access to client material is limited to the principal consultant and, where an engagement requires it, a supervised technical specialist.
• Devices are protected by full disk encryption, strong authentication and current security patching.
• Cloud platforms are protected by multi-factor authentication.
• Document transfers use password protection and encrypted platforms where the sensitivity of the material requires it.
• A formal non-disclosure agreement is executed before an engagement at the client's request, using the client's document or the practice standard.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the Information Regulator and the affected data subjects will be notified as soon as reasonably possible, as section 22 requires.

09How long information is kept

Client data is not retained beyond the conclusion of an engagement unless retention is specifically agreed or required by law. In practice that means the following.

• Enquiries that do not become engagements are deleted within twelve months.
• Engagement working files and client source data are returned or deleted at close-out, subject to anything agreed in the Statement of Work.
• Final deliverables and the contract record are kept for five years from the end of the engagement, so that advice given can be evidenced and a claim defended.
• Financial and tax records are kept for the period required by South African tax and company law, currently five years.

10Your rights

Under sections 5, 11(3), 23, 24 and 69 of the Act you may do the following, free of charge unless a prescribed fee applies to an access request.

• Ask what is held about you and request a copy of it.
• Ask for correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• Object to processing that rests on legitimate interests, on reasonable grounds relating to your situation.
• Withdraw consent at any time, where processing rests on consent. Withdrawal does not affect processing already carried out.
• Complain to the Information Regulator, or bring civil proceedings under section 99.

Send any request to . Requests are acknowledged within five business days and answered within thirty days. Proof of identity may be requested first, so that information is not disclosed to the wrong person. Prescribed forms are set out on the POPIA notice page.

11Direct marketing

The practice sends no unsolicited electronic marketing. Section 69 of the Act permits direct marketing by electronic means only with consent, or to an existing customer in respect of similar services where an opportunity to opt out was given at the time the details were collected. Where any newsletter or update is issued, it goes only to people who asked for it, and every message carries an unsubscribe instruction that is honoured immediately.

12Complaints

Raise the matter with the Information Officer first, at . Most concerns are resolved quickly and directly. If the response does not satisfy you, you may complain to the Information Regulator, which does not charge for this.

13Changes to this policy

This policy is reviewed annually and whenever the way information is handled changes materially. The version number and effective date at the top of this page show which version applies. Where a change materially affects clients in an active engagement, they are notified directly.