POPIA statement

Effective August 2026. Asibonge Legacy Group recognises privacy and information governance as components of corporate risk, cybersecurity, stakeholder trust and responsible business. This statement describes the principles ALG applies to Group-level processing of personal information, and the procedure available to data subjects.

ALG is committed to processing personal information lawfully, reasonably and in a manner that does not unjustifiably infringe privacy. The Information Officer is responsible for encouraging compliance with POPIA, dealing with requests, cooperating with the Information Regulator, and supporting the implementation and ongoing improvement of an appropriate compliance framework. POPIA governance is integrated with corporate governance, legal, risk, cybersecurity, human resources, procurement, records management and internal assurance rather than treated as a standalone website exercise.

Accountability

Assign responsibility, maintain governance oversight, register the Information Officer, document processing and monitor compliance.

Processing limitation

Collect and process only information that is adequate, relevant and not excessive for a lawful purpose, using a permitted processing justification.

Purpose specification

Define a specific and lawful purpose, notify data subjects as required, and avoid indefinite retention.

Further processing limitation

Use information for compatible purposes unless further processing is otherwise authorised by POPIA.

Information quality

Take reasonably practicable steps to keep information complete, accurate, not misleading and updated where necessary.

Openness

Maintain documentation and provide appropriate section 18 notifications explaining collection and processing.

Security safeguards

Use reasonable technical and organisational measures and manage operators appropriately.

Data subject participation

Provide practical procedures for access, objection, correction, deletion and other rights.

• Encourage compliance with POPIA across Group-level functions
• Deal with POPIA and PAIA requests and cooperate with the Information Regulator
• Maintain, monitor and continually improve an appropriate POPIA compliance framework
• Ensure personal information impact assessments are performed where appropriate to processing risk
• Ensure the PAIA manual is developed, maintained and made available as required
• Maintain internal measures and systems for processing information and data subject requests
• Promote staff awareness and training on privacy obligations and information security
• Oversee response to security compromises and required notifications
• Ensure appropriate operator and service-provider governance

When ALG collects personal information it takes reasonably practicable steps to make the data subject aware of the information being collected, the source where it is not collected directly, the purpose of collection, whether provision is voluntary or mandatory, the consequences of not providing it, any law requiring or authorising collection, the responsible party's details, relevant recipients or cross-border transfer information, the data subject's rights, and complaint mechanisms.

Website forms therefore carry concise collection notices or a clear link to the privacy policy at the point of submission. Forms collecting materially different or sensitive information use a purpose-specific notice rather than relying only on a general footer link.

Forms and digital processes request only information necessary for the stated purpose, and optional fields are identified where appropriate. New websites, forms, CRM systems, tracking tools, AI-enabled tools and other processing initiatives are reviewed before deployment to identify privacy, security, retention and cross-border implications.

Before a service provider processes personal information on behalf of ALG, the business owner and relevant support functions assess the nature of the processing and the provider's security and confidentiality capability. Contractual terms are proportionate to risk and address confidentiality, security measures, security compromise notification, processing instructions, sub-processors, data location, return or deletion, and reasonable cooperation with ALG's compliance obligations.

ALG seeks to identify reasonably foreseeable internal and external risks to personal information and maintains safeguards appropriate to those risks, verified and improved in response to changes in technology, threat environment, incidents and operational findings.

A suspected compromise of personal information is escalated immediately to the Information Officer and relevant security and legal personnel. Operators must notify ALG without undue delay where information processed on ALG's behalf may have been compromised. ALG assesses containment, evidence preservation, impact, remedial action, notification and lessons learned.

POPIA sets no risk threshold for reporting a security compromise. Responsible parties must report security compromises and notify affected data subjects as required, currently through the Information Regulator's eServices portal.

ALG maintains evidence supporting lawful direct marketing. Where section 69(2) consent is required for unsolicited electronic communication, consent is obtained through a method permitted by the current POPIA Regulations, which expressly provide that opt-out does not constitute consent. Each marketing communication identifies the sender appropriately and provides a practical method to stop future marketing.

Special personal information and personal information of children require enhanced care. ALG does not process such information merely because it is convenient. Processing must have a lawful justification under POPIA and is subject to additional access, security, purpose and retention controls appropriate to the risk.

Before transferring personal information to a recipient outside South Africa, ALG identifies the country, recipient, purpose, data categories and transfer mechanism, and determines how section 72 of POPIA will be satisfied. This assessment is documented for material or recurring cross-border processing arrangements.

ALG maintains an internal retention schedule covering corporate, HR, finance, tax, procurement, customer, supplier, security, website, marketing and privacy records, distinguishing legal minimum periods, operational requirements, litigation holds and information that should be securely deleted when no longer authorised or required.

Confirmation and access

Submit a request to the Information Officer. Access to records is handled in accordance with POPIA and PAIA, including identity verification and applicable PAIA requirements.

Objection to processing

Submit an objection using a form substantially similar to POPIA Form 1, or another reasonably accessible channel permitted by the amended Regulations.

Correction or deletion

Request correction or deletion using a form substantially similar to POPIA Form 2, or another reasonably accessible channel permitted by the amended Regulations.

Direct marketing objection

Object at any time and free of charge, using the unsubscribe or contact channel provided.

Withdrawal of consent

Where processing is based on consent, withdraw it subject to processing already lawfully undertaken and any other lawful basis that may apply.

Complaint

Raise the matter with ALG first, and lodge a complaint with the Information Regulator using its current Form 5 or online complaint process.

Requests are acknowledged and logged promptly. Identity and authority are verified proportionately before disclosing or altering personal information, and requests are routed to the Information Officer and the record owner without unnecessary delay. Any refusal, limitation or retention decision is supported by the applicable legal basis. Correction or deletion requests are actioned and the data subject notified within the periods required by the current POPIA Regulations. Requests and outcomes are retained as compliance records without keeping unnecessary copies of personal information, and no person is disadvantaged for lawfully exercising a privacy right.

General privacy enquiry

info@asibongelegacygroup.co.za. State the privacy issue and include sufficient contact information for a response.

POPIA objection

Information Officer via info@asibongelegacygroup.co.za, using a form substantially similar to the current POPIA Form 1 or another permitted accessible channel.

POPIA correction or deletion

Information Officer via info@asibongelegacygroup.co.za, using a form substantially similar to the current POPIA Form 2 or another permitted accessible channel.

Access to a record under PAIA

Information Officer, using the current PAIA Form 2. Identify the right to be exercised or protected and why the record is required.

Direct marketing opt-out

Unsubscribe mechanism or info@asibongelegacygroup.co.za. No charge. Identify the address or number receiving the marketing.

Complaint to the Information Regulator

Information Regulator eServices or current complaint channel, using the Regulator's current complaint form or process.

ALG may require reasonable proof of identity before disclosing, correcting or deleting personal information, and proof of authority where a representative acts for another person or entity. Verification is proportionate and does not collect more information than necessary. The Information Officer maintains a controlled register of requests, dates, actions, decisions, responsible persons, correspondence and closure.

ALG provides proportionate privacy and information-security awareness to employees and contractors who handle personal information, with role-appropriate training for high-risk functions such as HR, ICT, cybersecurity, procurement, customer management, security operations and legal and compliance. The Information Officer periodically reviews the website, privacy notices, request logs, security compromise records, operator contracts, processing registers, impact assessments, retention schedules and training records to identify gaps and continuous-improvement actions.

Data subject requests

info@asibongelegacygroup.co.za, for attention of the Information Officer

Head office

Unit 15, Sunninghill Office Park, 16 Peltier Drive, Sunninghill, Sandton, 2191, South Africa

Information Regulator

010 023 5200, enquiries@inforegulator.org.za, inforegulator.org.za