Legal & Compliance
POPIA Notice
1. Responsible Party
Incendio Digital Labs (Pty) Ltd
Registration number: 2026/340430/07
25 Longmere Street, Schonenberg Estate, Somerset West, Western Cape, 7130
2. Information Officer
In terms of section 55 of POPIA, the following person has been designated as Information Officer:
Name: Deon van Vuuren
Email: deon@incendiogroup.co.za
Telephone: +27 87 061 7777
The Information Officer is responsible for ensuring compliance with POPIA within Incendio Digital Labs (Pty) Ltd and for handling data subject requests and complaints.
3. Categories of Data Subjects and Personal Information Processed
Website Enquirers
Personal information collected when an enquiry is submitted through our website:
- Name and surname
- Email address
- Telephone number (where provided)
- Organisation name (where provided)
- Enquiry content and type
Clients and Prospective Clients
Where a professional relationship is established or contemplated, we may process additional personal information including:
- Identity and registration documents (as required by FICA and applicable compliance frameworks)
- Contact and address information
- Financial information relevant to the mandate
- Correspondence and matter-related documentation
4. Purpose of Processing
We process personal information for the following purposes:
- Responding to enquiries and assessing the suitability of a professional relationship
- Providing professional services coordination, digital services, and implementation support
- Compliance with legal and regulatory obligations (including FICA, tax legislation, and professional standards)
- Maintaining records required by law
- Communicating service-related information
We do not process personal information for direct marketing purposes without a separate, specific consent.
5. Legal Basis for Processing
Processing is conducted on the following grounds under POPIA:
- Consent: Where you have submitted an enquiry or provided explicit consent to specific processing
- Contractual necessity: Where processing is necessary to perform services you have engaged us to provide
- Legal obligation: Where processing is required to comply with applicable law
- Legitimate interest: Where processing is in our legitimate business interest and does not override your rights and interests
6. Recipients of Personal Information
Your personal information may be shared with:
- Van Vuuren and Co Attorneys Incorporated: Where a matter is mandated to or coordinated with that firm
- Microsoft Corporation: As operator of our Microsoft 365 and Power Automate infrastructure (data processing agreement in place)
- Regulatory authorities: Where disclosure is required by law
We do not sell, rent, or trade personal information to any third party.
7. Transfers Outside South Africa
Our email and productivity infrastructure is operated by Microsoft on servers that may be located outside South Africa. Microsoft maintains appropriate safeguards and certifications (including ISO 27001 and SOC 2) as required under section 72 of POPIA for cross-border transfers.
8. Retention Periods
| Category | Retention period |
|---|---|
| Enquiry records (no engagement) | 12 months from last communication |
| Client correspondence and matter files | 5 years from matter closure |
| Financial records | 5 years (as required by the Companies Act and tax legislation) |
| FICA/compliance records | 5 years from end of business relationship |
9. Rights of Data Subjects
Under POPIA, you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate, incomplete, or outdated information
- Deletion: Request deletion of information no longer necessary for the purpose for which it was collected (subject to legal retention requirements)
- Objection: Object to the processing of your personal information on legitimate grounds
- Withdrawal of consent: Where processing is based on consent, withdraw that consent at any time
To exercise any of these rights, submit a written request to our Information Officer at info@incendiogroup.co.za. We will respond within 30 days.
10. Complaints
If you are not satisfied with how we have handled your personal information or your rights request, you may lodge a complaint with the Information Regulator of South Africa:
Email: inforeg@justice.gov.za
Website: www.inforegulator.org.za
Telephone: +27 10 023 5207
11. Security
We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. In the event of a data breach that poses a risk to data subjects, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.