Enterprise reporting and rewards programme and related events
Privacy and Information Handling Policy
1 Purpose and application
Indalo Inclusive South Africa NPC (Indalo, we or us) operates voluntary enterprise development programmes, including its enterprise reporting and rewards platform, and related events such as IGNITE NEXT AFRICA. This policy explains how we handle personal information about applicants, enterprise representatives, participants, beneficiaries and event attendees. It also sets requirements for Indalo personnel and service providers. Only the activities relevant to your participation apply.
2 Responsible party and contact
Indalo is the responsible party for the processing it determines. Contact the Information Officer through info@indaloinclusive.org.za or 012 844 0135. Postal and physical contact: The Innovation Hub, Enterprise Building, Unit L14, 1 Mark Shuttleworth Street, Lynnwood, Pretoria, 0081, South Africa. A reward supplier may separately be responsible for information it needs to provide its own service; its privacy notice will also apply.
3 Information we collect
We collect identity and contact details, organisation and representative details, sector and location, account identifiers, registration decisions and communications. For the rewards programme, we collect enterprise profiles, monthly financial, economic, social and environmental indicators, supporting evidence, reviews, points, tier and redemption records. For events, we collect booking details, dietary or accessibility requests, QR or access codes and attendance records. Technical records may include IP addresses, device/browser information, security logs and essential session information.
4 Sources and minimum necessary information
We mainly collect information from you, your authorised enterprise representative, and your use of our services. We may receive verification or fulfilment information from programme staff and relevant providers. We will explain any materially different source and purpose where required. Required fields will be marked. Without essential details, we may be unable to register you, verify a report or fulfil a reward. Optional marketing, publicity and sensitive-information choices do not determine membership eligibility.
5 Voluntary participation
Joining is your choice. You may decline optional information or leave by contacting us. Leaving does not reverse processing already lawfully undertaken, remove legally required records or automatically cancel an existing reward-supplier contract. Supplying monthly reports is a condition of earning reporting points, rather than a legal obligation to participate.
6 Purposes and lawful grounds
We use information to assess eligibility; create and secure accounts; administer registrations and event entry; receive and verify reports; allocate points; manage rewards; respond to enquiries and complaints; prevent misuse; monitor enterprise progress; and meet lawful reporting and recordkeeping obligations. We identify an appropriate POPIA ground for each activity, including consent, performance of an agreement, a legal obligation or a properly assessed legitimate interest. We do not rely on blanket consent for every activity.
7 Sensitive information and information about others
Dietary and accessibility requests may reveal health, disability or religious information. We seek separate, specific consent where needed and share only practical requirements with relevant staff or providers. Do not upload identity documents, health records or identifiable employee/beneficiary data unless specifically requested through an approved secure process. Use aggregate counts wherever possible. An enterprise must have authority and a lawful basis to provide other people’s information and give them the relevant notice. We do not knowingly enrol under-18 account holders; any children’s information requires a separately approved lawful process and competent-person involvement where applicable.
8 Who receives information
Authorised programme staff, reviewers and event coordinators receive information needed for their duties. Approved developers, hosting, storage, communications and support providers may process limited information under written operator arrangements and confidentiality obligations. Reward providers receive the minimum details necessary for an authorised redemption, such as contact, eligibility and voucher details. Sponsorship does not entitle a partner to the participant database, raw monthly reports or marketing lists.
9 Partner reporting and disclosures
Funders and partners will ordinarily receive genuinely de-identified, aggregated programme results, with small groups suppressed where necessary to prevent identification. Identifiable case studies, referrals or reports require a disclosed lawful basis and separate permission where appropriate. We do not sell personal information. We may disclose information when lawfully required by a court, regulator or other competent authority, and keep such disclosures proportionate.
10 Communications and publicity
Operational messages cover registration decisions, access codes, reporting reminders, security and reward fulfilment. Optional electronic marketing uses a separate opt-in unless another lawful statutory route applies, and includes a simple opt-out. Refusal does not reduce programme eligibility. Identifiable promotional interviews, testimonials and featured photographs require a separate choice; attending an event alone is not unlimited permission to use your likeness. Event photography notices will explain available objections and practical arrangements.
11 Storage and security
Indalo must maintain appropriate technical and organisational safeguards, including restricted role-based access, administrator authentication, secure transmission, protected storage, audit records, controlled evidence access and tested recovery arrangements. Access is limited to authorised duties, reviewed and removed when no longer needed. Operators must notify Indalo promptly of suspected compromises and may not independently reuse programme information. No internet service is completely secure; this does not reduce our legal duties.
12 Hosting and cross border processing
Approved cloud providers may process information in South Africa or abroad. Before use, Indalo must document providers, processing locations, subcontractors and transfer safeguards. Any transfer outside South Africa must meet POPIA section 72, including adequate protection through applicable law or binding arrangements, or another permitted ground. Participants may request information about relevant recipients and safeguards. A technology change does not authorise a new incompatible purpose.
13 Retention and disposal
We retain identifiable information only for as long as necessary for the notified purpose, an applicable law, an enforceable agreement or a properly documented lawful need. Indalo must maintain a retention schedule identifying each record category, purpose, owner, review date and disposal trigger. Account and report records are reviewed when participation ends; financial and redemption records are retained for the applicable accounting, audit or legal period. A complaint or legal hold may require restricted retention until resolved.
14 Event and backup records
Dietary and accessibility details must be removed promptly once the event and related assistance are complete, unless a specific incident, legal duty or separate lawful purpose requires limited retention. Entry codes must be disabled after the event. Registration and attendance records are reviewed separately for justified follow-up and audit needs. Deleted records may remain in access-restricted backups until scheduled overwrite; they must not be restored to routine use without reapplying deletion decisions. Disposal must be secure or information must be irreversibly de-identified.
15 Cookies and automated processing
Essential session and security technologies may be needed to operate the platform. Before introducing optional analytics or advertising tools, Indalo must disclose their purpose, provider and duration and obtain any required choice. Points and tiers may calculate automatically under published rules. You may challenge a calculation or verification outcome and request human review. We will not make a solely automated decision with substantial legal effects unless POPIA permits it and the required safeguards are in place.
16 Your information rights
Subject to lawful exceptions, you may ask whether we hold your personal information, request access and recipient information, seek correction or deletion of inaccurate, excessive, outdated or unlawfully obtained information, object on the grounds permitted by POPIA, and withdraw consent for future consent-based processing. Withdrawal does not affect earlier lawful processing. Some records must be retained despite a deletion request; we will explain the reason and restrict further use where appropriate.
17 Requests and complaints
Send requests to the Information Officer at info@indaloinclusive.org.za. We will verify identity proportionately, assist with prescribed forms where necessary, and respond within applicable statutory periods. Any legally permitted fee will be explained before it is incurred. PAIA may apply to a formal records request; access is subject to lawful protections for others’ information. You may complain directly to the Information Regulator without first exhausting our process: https://inforegulator.org.za or https://eservices.inforegulator.org.za; POPIAComplaints@inforegulator.org.za.
18 Security incidents
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, Indalo will investigate, contain and document the incident and notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to POPIA’s permitted qualifications. Notifications will explain relevant consequences, response measures and protective steps. Report suspected exposure promptly to info@indaloinclusive.org.za; do not circulate the exposed records.
19 Accountability and changes
The Information Officer oversees implementation, staff guidance, operator controls, retention, rights requests and incident response. Staff must keep records confidential and report misuse. We will publish dated policy updates and give appropriate advance notice of material changes. New consent will be sought where required; continued participation does not itself authorise a new incompatible use of information. The Terms and Conditions do not waive privacy rights or Indalo’s statutory accountability.
20 Participant privacy choices
At registration, acknowledge that this policy has been made available. Record optional choices separately and leave them unticked by default: Indalo marketing; named-partner marketing or referrals; featured publicity; and any special personal information consent. Explain each purpose and withdrawal route at the point of collection. Keep the wording, version, date and evidence of any consent. Access to essential services must not be conditional on unrelated optional consent.
Legal framework
This policy is intended to operate consistently with the Protection of Personal Information Act 4 of 2013 (especially sections 11–25, 26–35, 69, 71 and 72), the Promotion of Access to Information Act 2 of 2000 and applicable electronic communications law. Official texts and guidance: www.gov.za/documents/protection-personal-information-act; www.justice.gov.za/paia/paia.htm; inforegulator.org.za. Mandatory law prevails over any inconsistent wording.