Privacy Policy

This Privacy Policy explains what personal information we collect through our website, why we collect it, how we use it, with whom we share it, and what rights you have in relation to it. It should be read together with any engagement letter or service agreement we have concluded with you. It applies to our website only. It does not apply to third-party services linked from our website, which are governed by their own terms and privacy policies.

1. Who we are

The website at watsongroup.co.za is owned and operated by The Watson Group (Pty) Ltd, a private company registered in the Republic of South Africa:

• Registered name: The Watson Group (Pty) Ltd
• Registration number: 2014/043789/07
• Location: Pretoria, South Africa
• General contact: roe@watsongroup.co.za
• Privacy contact: wwatson@watsongroup.co.za

In this Policy, references to "we", "us" and "our" are to The Watson Group (Pty) Ltd.

We are the responsible party (data controller) in respect of the personal information described in this Policy, in terms of the Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, other data protection legislation. Our Information Officer — who also fulfils the function of Data Protection Officer ("DPO") — is Wesley Watson, contactable at wwatson@watsongroup.co.za.

2. Definitions

In this Policy, unless the context indicates otherwise:

• "POPIA" means the Protection of Personal Information Act 4 of 2013, together with any regulations or codes of conduct issued under it.
• "GDPR" means the EU General Data Protection Regulation (Regulation (EU) 2016/679) and, where applicable, the UK GDPR, together with any national implementing legislation.
• "personal information" (or "personal data") means any information relating to an identified or identifiable natural person, as defined in POPIA and, where applicable, the GDPR.
• "processing" means any operation performed on personal information, including collection, storage, use, disclosure, transfer and deletion, as defined in POPIA and, where applicable, the GDPR.
• "you" or "your" means the individual whose personal information we process.
• "Site" means the website at watsongroup.co.za, including all pages and content made available through it.

3. What we collect

We collect only the personal information we need in order to respond to you and to provide our services. The categories of personal information we may collect through the Site are set out below.

3.1 Information you provide to us

• Contact form: your name, email address, subject line, the content of your message, and your indication of whether you are available for a virtual introduction meeting.
• Email, telephone or other direct contact: your contact details and the content of your communications with us.
• Engagement information: where you engage us for services, the information necessary to provide those services — which may include company details, financial information, and other material relevant to the engagement — will be governed by our separate engagement letter with you.

3.2 Information collected automatically

• Technical data: when you visit the Site, our hosting infrastructure may process limited technical information such as your IP address, browser type, device type, and request logs, for the purposes of delivering the Site securely and reliably. These logs are retained only for a limited time.
• Font loading: the Site loads web fonts from Google Fonts. When your browser requests these fonts, Google receives your IP address and browser user-agent. No cookies are set by this request. Google's handling of this data is governed by Google's own privacy policy.

The Site has no user accounts, no payment processing, and no newsletter at the time of this Policy's publication. It is not intended for children. Please do not send sensitive personal information (such as identity numbers, bank account details, or health information) through the contact form. Where we need such information for an engagement, we will request it through a secure channel and explain why it is required.

4. How we use your information and our lawful bases

We process personal information only where we have a lawful basis to do so under POPIA (Section 11), the GDPR (Article 6) or other applicable law, as the case may be. The purposes and lawful bases for our processing are set out below.

Where we rely on our legitimate interests, we have carried out a balancing assessment and are satisfied that those interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests at any time — see Section 8 below.

5. Direct marketing

We do not currently operate a newsletter or send unsolicited marketing communications. If we introduce marketing communications in future, we will do so in compliance with POPIA Section 69 and, where applicable, the GDPR. In particular:

• We will only send electronic marketing communications to you where you have given us your prior express consent (opt-in), or where you are an existing client and the communication relates to similar services, in which case you will be given the opportunity to opt out on each occasion.
• You may withdraw your consent, or opt out of marketing communications, at any time.
• We will not sell, rent or otherwise make your personal information available to third parties for their own marketing purposes.

Where you have an active engagement with us, we may send you service communications relating to that engagement (such as responses to your questions, confirmations, or documents). These are not marketing communications and are not affected by any marketing preference you may record.

6. Cookies and similar technologies

The Site itself does not set cookies and does not store tracking data on your device. There is no analytics service, no advertising, and no cross-site tracking in operation on the Site at the time of this Policy's publication.

Two categories of third-party request may nevertheless be made when you visit the Site:

• Google Fonts. When a page loads, your browser requests font files from Google's servers. Google receives the IP address and browser user-agent of the request. This is a technical operation, not a tracking mechanism, and no cookies are set by it. Google's privacy terms apply.
• FormSubmit. When you submit the contact form, the information you enter is transmitted to FormSubmit (formsubmit.co), a form-handling service, which forwards your message to our mailbox at wwatson@watsongroup.co.za. FormSubmit may process limited technical information (such as your IP address) as part of delivering the submission. See Section 7 below.

If we later introduce cookies, analytics, or other tracking technologies, we will update this Policy and, where required by law, obtain your consent before any non-essential cookie is set.

7. Who processes information on our behalf

The following third-party service providers may process personal information on our behalf, as operators (processors) under POPIA or as processors under the GDPR. Each is engaged under terms requiring them to process personal information only on our instructions and to apply appropriate security measures:

• FormSubmit (formsubmit.co): handling of contact-form submissions and forwarding them to our mailbox.
• Our email service provider: the mailbox where your enquiry arrives.
• Our website hosting provider: delivery of the Site and maintenance of request logs.
• Google Fonts: serving web fonts used by the Site.

We do not sell, rent or trade personal information. We may disclose personal information where we are required to do so by law, court order, or a lawful request from a competent authority, and where necessary to establish, exercise or defend legal rights.

Third-party links on the Site (if any) are provided for convenience only. We do not control, endorse or assume responsibility for the content, policies or practices of any third-party website or service, and your use of any such service is governed by its own terms and privacy policy.

8. International transfers

Some of our service providers may process personal information outside South Africa, including in the European Union, the United Kingdom and the United States. Where we transfer personal information across borders, we take the steps required by POPIA Section 72 and, where the GDPR applies, Chapter V of the GDPR.

This means that we will ensure, before any transfer, that one of the following applies:

• the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA and the GDPR;
• the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken at your request;
• the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party; or
• you have consented to the transfer, having been informed of the possible risks of the absence of adequate protection.

Where the GDPR applies and the recipient is not in a country benefiting from an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, or equivalent safeguards approved under the GDPR.

9. Your rights

Under POPIA (Sections 5, 11, 23, 24 and 25) and, where it applies to you, the GDPR, you have the following rights in respect of your personal information:

• Right to be notified: you have the right to be notified that we are collecting your personal information, and to be informed of what we do with it.
• Right of access: you may request confirmation of whether we hold personal information about you, and a record of the personal information we hold.
• Right to correction or deletion: you may ask us to correct inaccurate or incomplete information, or to delete information that we are no longer lawfully entitled to retain.
• Right to object: you may object, on reasonable grounds, to processing based on our legitimate interests, and you may object at any time to processing for direct marketing purposes.
• Right to restrict processing: you may request that we restrict the processing of your personal information in the circumstances provided for by law.
• Right to data portability: where processing is based on your consent or on a contract and is carried out by automated means, you may ask us to provide your personal information in a structured, commonly used, machine-readable format.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of any processing carried out before you withdrew.
• Right not to be subject to automated decision-making: see Section 11 below.
• Right to lodge a complaint: you may lodge a complaint with the Information Regulator of South Africa, as set out in Section 14 below.

To exercise any of these rights, contact our Information Officer at wwatson@watsongroup.co.za. We will respond within the period prescribed by the applicable data protection law — under POPIA, within 30 days, and under the GDPR, within one month, extendable by two further months where the request is complex. We will inform you if we need to extend this period.

We may need to verify your identity before actioning a request. Where POPIA's prescribed Form 2 (Request for Access to Record of Personal Information) applies, we will provide it on request. We do not charge a fee for handling a reasonable request, but we may charge the fee prescribed by POPIA where a request is manifestly unfounded, excessive or repetitive.

10. Retention

We retain personal information only for as long as necessary to achieve the purpose for which it was collected, or as required or permitted by law.

11. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or destruction, as required by POPIA Section 19 and, where applicable, the GDPR Article 32. These measures include:

• encryption of data in transit (HTTPS/TLS) across the Site and our communications;
• access controls limiting access to personal information to personnel who require it for their functions;
• the use of reputable service providers bound by written agreements requiring appropriate security measures; and
• regular review of our security posture and the tools we use.

No method of transmission over the internet and no method of electronic storage is completely secure. We cannot guarantee absolute security. Where we become aware of a security compromise that creates a risk to your personal information, we will notify you and the Information Regulator as required by POPIA Section 22, and, where the GDPR applies, the relevant supervisory authority and any affected data subjects as required by Articles 33 and 34 of the GDPR.

12. Automated decision-making and profiling

We do not use your personal information for automated decision-making that produces legal effects concerning you or otherwise significantly affects you, and we do not engage in profiling for marketing or other purposes. Any decisions we make about your engagement with us are made by human beings with appropriate oversight.

13. Children

The Site is not directed at children, and we do not knowingly collect personal information from children. Where you believe that a child has provided us with personal information, please contact our Information Officer at wwatson@watsongroup.co.za and we will take reasonable steps to delete the information.

Under POPIA, a child is a natural person under the age of 18. Where we are required to process a child's personal information, we will do so only with the consent of a competent person (as defined in POPIA), unless otherwise permitted by law.

14. Complaints

If you believe that we have processed your personal information unlawfully, or if you are unhappy with how we have handled your information, please contact our Information Officer first at wwatson@watsongroup.co.za, so that we have the opportunity to resolve the matter directly.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority, namely:

• The Information Regulator of South Africa
  JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
  Email: complaints.IR@justice.gov.za
  Website: inforegulator.org.za

Where the GDPR applies to the processing in question, you also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or the place of the alleged infringement.

15. Changes to this Policy

We may update this Policy from time to time as our services evolve, as our use of technology changes, or as the law changes. The date at the top of the page indicates the current version. Where changes are material, we will take reasonable steps to bring them to your attention — for example, by a notice on the Site, or by direct communication where we hold your contact details. Your continued use of the Site after any modification indicates your acceptance of the updated Policy.

16. Contact

For any question about this Policy, or to exercise any of your rights, please contact:

• Information Officer / Data Protection Officer: Wesley Watson
• Email: wwatson@watsongroup.co.za
• General enquiries: roe@watsongroup.co.za
• Postal address: Pretoria, South Africa