Protection of Personal Information Act notice

Purpose of this notice

POPIA gives effect to the right to privacy in section 14 of the Constitution. It sets conditions that any organisation must meet before it may process personal information, and it gives people enforceable rights over information held about them.

This notice explains how Rovuwa Holdings complies. Our Privacy Policy covers the practical detail of what we collect and why; this notice covers the statutory framework and your rights. Where the two overlap, read them together.

Terms POPIA uses

Responsible party

Information Officer

Under POPIA the head of a private body is automatically its Information Officer, and may appoint deputies. Ours is registered with the Information Regulator as the Act requires.

The Information Officer encourages compliance with the conditions for lawful processing, deals with requests made to us, works with the Regulator on investigations, and makes sure our compliance framework is developed, implemented and monitored.

The eight conditions for lawful processing

POPIA sets out eight conditions. Here is what each requires and how we meet it.

1. Accountability

We remain responsible for compliance even where an operator does the processing for us. We maintain a record of our processing activities, and our Information Officer reports on compliance to management.

2. Processing limitation

We process information lawfully, in a way that does not unreasonably intrude on your privacy, and only what is adequate, relevant and not excessive for the purpose. We collect directly from you wherever possible. Our forms ask only what we need for the route you selected, which is why the application form changes its questions based on your answers rather than asking everyone everything.

3. Purpose specification

We collect for specific, explicitly defined and lawful purposes, and we tell you the purpose at the point of collection. We do not keep records longer than necessary — retention periods are published in our Privacy Policy.

4. Further processing limitation

If we ever want to use your information for something new, that new purpose must be compatible with the original one, or we come back and ask you.

5. Information quality

We take reasonably practicable steps to keep information complete, accurate, not misleading and up to date. Validation on our forms catches obvious errors at the point of entry, and you can ask us to correct anything at any time.

6. Openness

We maintain documentation of our processing operations, and we notify you — through this notice, our Privacy Policy and the wording on each form — before or as soon as reasonably practicable after we collect your information.

7. Security safeguards

We secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures, identify reasonably foreseeable risks, and verify that our safeguards are effective. Where an operator processes on our behalf, a written contract obliges them to maintain the same standards and to notify us immediately of any compromise. Technical detail is in our Privacy Policy.

8. Data subject participation

You may ask what we hold, ask for a copy, and ask us to correct or delete it. How to do that is set out below.

Section 18 notification

When we collect your personal information, section 18 requires us to make you aware of the following. We are telling you here, and we repeat the relevant parts on each form:

• The information being collected, and that it is collected directly from you unless we tell you otherwise
• The name and address of the responsible party, set out above
• The purpose for which it is being collected, set out in our Privacy Policy
• Whether supplying it is voluntary or mandatory — required fields are marked with an asterisk, and everything else is optional
• The consequence of not supplying it: we may be unable to answer your enquiry, assess your application or register your company as a supplier
• Any law that authorises or requires the collection, such as tax, labour and B-BBEE legislation
• Whether we intend to transfer information to another country, and the level of protection there — covered under cross-border transfers
• The recipients we may share it with, listed in our Privacy Policy
• Your right to object to processing and to lodge a complaint with the Information Regulator

Your rights as a data subject

1. To be notified that your information is being collected, and that it has been accessed by an unauthorised person.
2. To establish whether we hold information about you, and to request the record or a description of it, together with the identity of anyone who has had access to it.
3. To request correction, destruction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and of information we are no longer authorised to retain.
4. To object, on reasonable grounds relating to your particular situation, to processing we base on legitimate interests or the public interest — by submitting the prescribed objection form.
5. To object to direct marketing by unsolicited electronic communication at any time.
6. Not to be subject to a decision with legal consequences based solely on automated processing intended to profile you.
7. To complain to the Information Regulator about an alleged interference with the protection of your personal information.
8. To institute civil proceedings in a court of competent jurisdiction regarding an alleged interference.

How to make a request

1. Email info@rovuwah.co.za with "POPIA request" in the subject line, or write to our Information Officer at the address above.
2. Tell us which right you are exercising and give us enough detail to find your records — the email address you used, and roughly when you dealt with us.
3. We will ask you to verify your identity. This protects you: it stops someone else obtaining your information by pretending to be you.
4. Requests to access or correct information are made on the prescribed POPIA forms. We will send you the correct form, or you can download them from the Information Regulator's website.
5. We respond within 30 days. If a request is complex and we need more time, we will tell you before the 30 days are up, with our reasons.

Direct marketing

Section 69 restricts unsolicited electronic marketing. We only send marketing by email or SMS to people who have given consent, or to existing customers about similar products and services where they were given a chance to opt out when we collected their details. Every message identifies us and includes a way to unsubscribe, and we act on an opt-out immediately. We approach any person for consent only once — if you decline, we do not ask again.

Operators and suppliers

Where a third party processes personal information for us, section 21 requires a written contract obliging them to establish and maintain the security measures in section 19, to process only with our knowledge or authorisation, to treat the information as confidential, and to notify us immediately where there are reasonable grounds to believe it has been accessed by an unauthorised person. We include these terms in our supplier agreements and assess each provider before appointing them.

If you are a supplier applying to work with us, you will be asked to accept equivalent obligations before we share any client or personal information with you.

PAIA manual

The Promotion of Access to Information Act requires private bodies to compile a manual describing the records they hold and how to request access to them. Our manual is available free of charge from our Information Officer at info@rovuwah.co.za, and on request at our registered office.

Complaints

Raise it with our Information Officer first — we would rather fix a problem than have one escalate. If you are not satisfied with how we handled it, you may complain to the Information Regulator on POPIA Form 5, or through its eServices portal.

Related documents: Privacy Policy  ·  Cookie Notice. This notice was last reviewed on 17 September 2026.