privacy-policy

ComplyPath (Pty) Ltd
Registration Number: 2026/429764/07
Information Officer: Trevor Pascall(Director)
Last updated: June 2026

1. Introduction

ComplyPath (Pty) Ltd (“ComplyPath”, “we”, “us”, “our”) is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This Privacy Policy explains how we collect, use, store and protect your personal information when you use the ComplyPath platform at complypath.co.za (“the Platform”).

ComplyPath is registered with the Information Regulator of South Africa as a responsible party.

2. Information We Collect

2.1 Information you provide directly

• Account information: your name, email address and password when you register
• Business information: your business name and details provided during assessments
• Assessment responses: your answers to compliance assessment questionnaires across POPIA, B-BBEE, Employment Equity, OHS, COIDA and Labour Law
• Payment information: processed securely by our payment provider — we do not store card details

2.2 Information collected automatically

• Usage data: pages visited, features used, time spent on the Platform
• Device information: browser type, operating system, IP address
• Cookies: session cookies required for Platform functionality

3. How We Use Your Information

We use your personal information to:

• Create and manage your account
• Provide compliance assessments and scores
• Generate corrective action guidance
• Send you assessment results by email
• Send service notifications including payment confirmations and subscription updates
• Improve the Platform based on usage patterns
• Comply with our legal obligations

We will not use your personal information for direct marketing without your explicit consent.

4. Legal Basis for Processing

We process your personal information on the following grounds under POPIA:

• Contract: processing necessary to provide the services you have subscribed to
• Legitimate interest: improving the Platform and preventing fraud
• Legal obligation: compliance with South African law
• Consent: where we ask for your consent for specific processing activities

5. Sharing Your Information

We do not sell your personal information. We share your information only with:

• Service providers who assist us in operating the Platform, including our hosting provider (xneelo), email service provider (Brevo) and payment processor — all bound by data processing agreements
• Legal authorities where required by law or court order
• Professional advisors such as auditors and attorneys, bound by confidentiality obligations

6. Data Storage and Security

Your personal information is stored on servers located in South Africa (Johannesburg). We implement appropriate technical and organisational measures to protect your information including:

• Encrypted connections (HTTPS/TLS)
• Password hashing
• Access controls limiting staff access to personal information
• Regular security monitoring

No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

7. Retention

We retain your personal information for as long as your account is active and for a period of 5 years thereafter, or as required by applicable law. Assessment data is retained to allow you to track your compliance progress over time.

8. Your Rights Under POPIA

As a data subject you have the right to:

• Access your personal information held by us
• Correct inaccurate or incomplete information
• Delete your personal information (subject to legal retention obligations)
• Object to the processing of your personal information
• Lodge a complaint with the Information Regulator at inforeg.org.za

To exercise any of these rights, contact our Information Officer at trevor@complypath.co.za. We will respond within 30 days.

9. Cookies

The Platform uses session cookies that are essential for Platform functionality. These cookies do not track you across other websites and are deleted when you close your browser. We do not use advertising or tracking cookies.

10. Third-Party Links

The Platform may contain links to third-party websites including government portals and regulatory bodies. We are not responsible for the privacy practices of those websites.

11. Children

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on the Platform with the revision date. Material changes will be notified to you by email.

13. Contact and Complaints

Information Officer
ComplyPath (Pty) Ltd
Registration Number: 2026/429764/07
Cape Town, South Africa
Email: trevor@complypath.co.za
Phone: 062 107 7946

Information Regulator of South Africa
Website: inforeg.org.za
Email: inforeg@justice.gov.za
Tel: 010 023 5207