Privacy policy

Effective August 2026. This policy explains how Asibonge Legacy Group (Pty) Ltd collects, uses, stores, shares and protects personal information when you visit the website, communicate with us through it, apply for opportunities, submit a business or supplier enquiry, or otherwise provide personal information to ALG at Group level.

It is intended to give effect to the principles of the Protection of Personal Information Act 4 of 2013 (POPIA) and should be read together with any service-specific terms, contractual documents and notices presented at the point of collection.

The operating companies within the group are separate registered legal entities. Where an enquiry is transferred to or handled by one of them, that entity acts as a separate responsible party and issues its own privacy notice. This policy governs processing by Asibonge Legacy Group (Pty) Ltd and does not replace the privacy obligations of those entities.

Responsible party

Asibonge Legacy Group (Pty) Ltd, registration number 2018/198210/07

Head office

Unit 15, Sunninghill Office Park, 16 Peltier Drive, Sunninghill, Sandton, 2191, South Africa

Privacy and data subject requests

info@asibongelegacygroup.co.za, for attention of the Information Officer

This policy may apply to website visitors, prospective customers, customer representatives, suppliers and service providers, tender or procurement contacts, job applicants, employees interacting with website systems, business owners, strategic partners, investors or funders, media contacts, professional advisers and other persons who communicate with ALG through the website.

POPIA protects personal information relating to identifiable living natural persons and, where applicable, identifiable existing juristic persons. ALG applies appropriate confidentiality and information-governance standards to business records even where a particular record does not constitute personal information under POPIA.

Identity and contact

Name, surname, job title, organisation, email address, telephone number, physical or postal address and preferred contact method.

Business and corporate

Company name, registration details, role, sector, procurement information, service interest, tender or supplier details and correspondence.

Website and technical

IP address, browser and device information, operating system, referral source, date and time of access, pages visited, approximate location derived from technical data, cookie identifiers and security logs.

Enquiry and relationship

Content of contact forms, service enquiries, requests for proposals, meeting requests, correspondence, complaints, feedback and records of interaction.

Supplier and procurement

Vendor details, contact persons, tax or VAT information, banking details, quotations, compliance records, B-BBEE documentation and other onboarding information where necessary.

Recruitment

CVs, employment history, qualifications, references, contact details, interview records, screening information and other information voluntarily provided by applicants.

Financial and transaction

Where relevant to Group-level transactions: invoices, payment references, banking details, tax information, commercial terms and records required for accounting or audit purposes.

Special personal information

Only where justified and lawful. Such information is not collected merely because a person visits the website.

• Directly from you when you complete a website form, send an email, telephone us, submit a CV, request a proposal, register as a supplier, respond to a survey or otherwise communicate with ALG
• Automatically through standard web-server logs, security technologies and cookies or similar technologies
• From an organisation you represent, where it provides your business contact details for a legitimate business purpose
• From public sources, professional directories, public registers or business platforms where the information is lawfully available and relevant to a legitimate business purpose
• From service providers or professional advisers acting on our behalf, where permitted by law and subject to appropriate safeguards
• From an operating company in the group where a matter requires Group-level governance, coordination, risk management, legal oversight or stakeholder management

Responding to enquiries

To take steps at your request, manage a business relationship or pursue legitimate business interests in responding to stakeholders.

Corporate communication

Legitimate interests in corporate communication and, where required for direct marketing, consent or an existing-customer basis permitted by POPIA.

Supplier, tender and procurement

Contractual steps, legal obligations, due diligence, fraud prevention and legitimate procurement interests.

Recruitment and talent

Steps connected with potential employment, legitimate recruitment interests, legal obligations and consent where required for specific screening.

Governance, risk and compliance

Compliance with law, internal governance, audit, risk management, legal claims, investigations and protection of rights.

Website security and availability

Legitimate interests in protecting systems, preventing abuse, detecting incidents and maintaining website performance.

Analytics and improvement

Consent where required for non-essential cookies, and legitimate interests in understanding aggregated website use, subject to appropriate controls.

Recordkeeping

Legal obligations, audit requirements, contractual needs and protection of legal rights.

ALG will not process personal information in a manner incompatible with the purpose for which it was collected unless the further processing is permitted by law or appropriately authorised.

ALG does not sell personal information. We may disclose it where reasonably necessary and lawful to the following categories of recipient.

• Operating entities within the group where an enquiry or business opportunity relates to that operation, subject to purpose limitation and access controls
• IT, hosting, cloud, cybersecurity, communications, website, analytics and document-management providers acting as operators or service providers
• Professional advisers including lawyers, auditors, accountants, insurers, consultants and risk advisers
• Banks, payment service providers and financial institutions where relevant to a legitimate transaction
• Government authorities, regulators, law-enforcement agencies, courts or other bodies where disclosure is required or permitted by law
• Business counterparties in connection with a proposed investment, acquisition, disposal, restructuring, joint venture or other corporate transaction, subject to confidentiality and lawful processing requirements
• Any person you authorise us to share information with

Where a third party processes personal information on our behalf, ALG will seek to use operators that provide appropriate security and confidentiality commitments. Operator arrangements should address the nature and purpose of processing, confidentiality, security safeguards, incident notification, authorised sub-processing, retention or return of information, and reasonable assurance or audit rights where appropriate to the risk.

Some technology, cloud, communications or professional service providers may process or store information outside South Africa. Where personal information is transferred across borders, ALG will manage the transfer in accordance with section 72 of POPIA and will consider whether the recipient is subject to a law, binding corporate rules or binding agreement providing an adequate level of protection, or whether another permitted basis applies.

ALG retains personal information only for as long as reasonably required for the purpose for which it was collected, a compatible lawful purpose, a legal or regulatory requirement, contractual or audit needs, or the establishment, exercise or defence of legal rights. Retention periods are managed through applicable legal requirements and internal records schedules rather than a single period for all records.

When information is no longer authorised or required to be retained, ALG will take reasonable steps to delete, destroy, anonymise or de-identify it in a manner appropriate to the record and technology involved.

ALG maintains reasonable technical and organisational measures appropriate to the nature of the information, the systems used and the reasonably foreseeable risks. Depending on the environment these may include role-based access, strong authentication, multi-factor authentication, encryption, endpoint protection, secure configuration, patch management, backups, network controls, logging and monitoring, physical access controls, staff confidentiality obligations, security awareness, supplier due diligence and incident-response procedures.

No internet-based service can be guaranteed completely secure. Please avoid sending highly sensitive information through ordinary website contact forms unless the form is specifically designed and secured for that purpose.

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, ALG will activate its incident-response process and comply with applicable notification obligations. Where required by POPIA, the Information Regulator and affected data subjects will be notified as soon as reasonably possible, subject to lawful delays such as those required by law-enforcement authorities.

This website does not set cookies. It stores nothing on your device: no cookies, no local storage and no session storage, whether strictly necessary, functional, analytical or advertising. It carries no analytics tags, no advertising pixels, no social media trackers and no embedded third-party content.

Because nothing is stored on your device, no cookie consent banner is required and there is no cookie register to publish. Typefaces are served from this website rather than from a third-party font service, so browsing the site does not disclose your IP address to any external party.

The categories below are listed for completeness, so you can see what is not in use. If any of them is introduced in future, this policy will be updated and, where consent is required, a consent mechanism will be implemented before the technology is activated.

Strictly necessary

None in use.

Functional and preference

None in use.

Analytics and performance

None in use.

Marketing and advertising

None in use.

Embedded third-party content

None in use.

Server logs are still generated, as they are for any website, and are described under website and technical information above. Those are records held by ALG and its hosting provider, not technologies stored on your device.

ALG manages electronic direct marketing in accordance with POPIA and the applicable Regulations. Where prior consent is required, ALG will seek it through a reasonably accessible method and will not treat a failure to opt out as consent. Marketing communications provide a practical means to object or unsubscribe, and you may object at any time without charge.

The website is primarily directed at adults and business stakeholders, and ALG does not intentionally use it to collect personal information from children for general marketing purposes. Where a service or programme requires personal information relating to a child, ALG applies the requirements of POPIA, including competent-person consent or another lawful basis, and additional safeguards appropriate to the context.

Special personal information is processed only where justified by POPIA, necessary for a legitimate and lawful function, and subject to appropriate safeguards. It should not be submitted through a general website contact form unless specifically requested for a lawful purpose.

ALG does not intend to make decisions through the public website that produce legal consequences or significantly affect a person solely through automated processing. If such processing is introduced, ALG will assess the requirements of POPIA and implement appropriate safeguards before deployment.

• To be informed when personal information is collected and how it is used
• To request confirmation of whether ALG holds personal information about you and, subject to applicable law, to request access to it
• To request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
• To request destruction or deletion of a record ALG is no longer authorised to retain, subject to lawful retention obligations
• To object, on reasonable grounds where applicable, to certain processing of personal information
• To object at any time to processing for direct marketing by unsolicited electronic communication
• To withdraw consent where processing is based on consent, without affecting processing that was lawful before withdrawal
• To lodge a complaint with the Information Regulator and to pursue any other remedy available in law

Requests may be submitted to info@asibongelegacygroup.co.za for attention of the Information Officer. ALG may request sufficient information to verify identity and authority before releasing, correcting or deleting records. An objection may be made using a form substantially similar to the current POPIA Form 1, and a request for correction or deletion using a form substantially similar to the current POPIA Form 2. The amended Regulations permit reasonably accessible channels and provide that such requests are free of charge.

We encourage you to raise a privacy concern with ALG first so it can be investigated and addressed. A complaint may also be submitted to the Information Regulator using the channels and forms it publishes. Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg. Postal: P.O. Box 31533, Braamfontein, Johannesburg, 2017. Telephone 010 023 5200. Email enquiries@inforegulator.org.za. Website inforegulator.org.za, eServices eservices.inforegulator.org.za.

This website may link to external websites. ALG does not control their privacy or security practices, and you should review their privacy notices before providing personal information to them.

ALG may update this policy to reflect changes in law, technology, website functionality, business operations or processing practices. Material changes are reflected by updating the effective date and, where appropriate, by additional notice on the website. Questions may be sent to info@asibongelegacygroup.co.za.