POPIA notice

01Responsible party and Information Officer

Lumaxio Consult is a private body and a responsible party under the Act. The Information Officer is the principal consultant of the practice, who is accountable for compliance and for responding to data subject requests.

02Section 18 processing notification

Section 18 requires that a data subject be told certain things when personal information is collected. This notice serves that purpose for everyone who enquires, contracts with or supplies information to the practice.

• Information collected. Name, organisation, role, contact details, correspondence, engagement records, contracting and billing details, and any personal information contained in material supplied for an engagement.
• Source. Directly from you in almost every case. Occasionally from public sources when preparing for a first conversation or a market advisory engagement.
• Purpose. Responding to enquiries, delivering the engagement, invoicing and record keeping, and meeting obligations imposed by law.
• Whether supply is voluntary or mandatory. Voluntary. Withholding contact details or engagement material means the practice cannot respond to an enquiry or deliver the work.
• Recipients. Operators providing cloud storage, email, video conference and accounting services, a supervised technical specialist where a deliverable requires one, professional advisers where necessary, and public authorities where the law compels disclosure.
• Cross-border transfer. Cloud platforms may store information outside South Africa, on the bases permitted by section 72.
• Your rights. Access, correction, deletion, objection, withdrawal of consent, and complaint to the Information Regulator.

03The eight conditions for lawful processing

Chapter 3 of the Act sets eight conditions. Each is addressed as follows.

• Accountability. The Information Officer is accountable for compliance, reviews this notice annually, and holds the practice's internal compliance manual.
• Processing limitation. Information is processed lawfully, minimally, and on a section 11 justification. It is collected directly from the data subject except in the limited circumstances described above.
• Purpose specification. Information is collected for the specific, explicitly defined purposes stated in this notice, and is destroyed or de-identified once the purpose and the retention period have passed.
• Further processing limitation. Information is not used for a purpose incompatible with the one for which it was collected. Client material is never repurposed for the practice's own analysis, marketing or product development.
• Information quality. Reasonable steps are taken to keep information complete, accurate and current, having regard to the purpose it serves.
• Openness. This notice and the privacy policy are published on this website, and the practice will say what it holds about a person on request.
• Security safeguards. Encryption, multi-factor authentication, restricted access, confidentiality obligations on operators, and breach notification in terms of section 22.
• Data subject participation. Any person may ask what is held about them, and may require correction or deletion. The procedure is set out below.

04Processing on behalf of a client

Where the practice processes personal information on a client's behalf, for example staff records reviewed during a competency assessment or user data examined in a systems review, the client remains the responsible party and the practice acts as an operator under sections 20 and 21.

• Processing is carried out only on the client's documented instruction.
• The information is treated as confidential and is not disclosed unless the law requires it.
• Section 19 security measures are applied to the material for the duration of the engagement.
• The client is notified immediately where there are reasonable grounds to believe the information has been accessed by an unauthorised person.
• The material is returned or destroyed at close-out, unless the Statement of Work says otherwise.

05Making a request

Data subjects may exercise their rights using the forms prescribed under the Act and its Regulations, or by plain written request to the Information Officer. The prescribed forms are these.

• Form 2. Objection to the processing of personal information, under section 11(3).
• Form 3. Request for correction or deletion of personal information, or destruction of a record, under section 24(1).
• Form 5. Complaint to the Information Regulator, under sections 74 and 75.
• Access to a record. A request for access to a record held by the practice is made in writing to the Information Officer, setting out the record sought and the right it is required for.

Send requests to . Proof of identity may be requested before a response is given. Requests are answered within thirty days, and where an extension is unavoidable the reason is given in writing. A prescribed fee may apply to an access request, and it will be quoted before any work is done.

06Security compromise

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, section 22 applies. The Information Regulator is notified, and so is every affected data subject, as soon as reasonably possible after the compromise is discovered. Notification is delayed only where a public body responsible for detecting crime says a delay is needed to protect an investigation.

The notification sets out what is known about the compromise, the likely consequences, the measures taken or proposed in response, and what the affected person can do to limit the effect. Where the Regulator identifies the responsible person, that identity is passed on.

07Complaints to the Information Regulator

Any person may complain to the Information Regulator that the practice has contravened the Act. Raising the matter with the Information Officer first is usually quicker, but it is not a precondition. The Regulator charges nothing for lodging a complaint.

08Review

This notice is reviewed annually and whenever the Act, its Regulations or the guidance issued by the Information Regulator changes materially. It is read together with the practice's privacy policy, the confidentiality provisions of each Statement of Work, and any non-disclosure agreement in force between the practice and a client.