POPIA Compliance & Privacy Policy

2. Responsible Party Details

In terms of POPIA, Food Compliance Agency operates as the Responsible Party for the personal information collected for compliance applications and client relationship management.

3. Personal Information We Collect

We process personal information that is necessary to facilitate food safety certification, municipal business trading licenses, and compliance auditing. Depending on your engagement with us, this includes:

• Client & Business Contact Data: Full names, business entity name, CIPC registration number, tax numbers, physical business address, email addresses, and contact numbers.
• Compliance Application Documents: Approved floor plans, zoning certificates, lease agreements, municipal water quality test reports, health inspection reports, and municipal account details.
• Identification Information: Identity documents (ID / Passport) of business owners, managers, or designated food safety representatives as required by local municipal health regulations.
• Trainee Roster Information: Names, ID/Passport numbers, contact details, and assessment records for staff registered under food safety training programs.
• Technical & Session Data: IP addresses, browser specs, device identifiers, and login session tokens when using our secure client portal.

4. Purpose of Processing (POPIA Condition 3)

We process your personal information strictly for specific, explicitly defined, and lawful purposes:

5. Third-Party Disclosures & Limitations

Your personal information is handled with absolute confidentiality. We disclose information only to third parties when essential to fulfill your compliance service:

• Municipalities & Health Authorities: Submission of statutory application documents to relevant South African Metropolitan Municipalities, Local Councils, and Municipal Health Services.
• Authorized Compliance Consultants: Internal compliance specialists bound by strict non-disclosure and privacy obligations.
• Digital Advertising & Audience Match (Customer Match): Pseudonymized, cryptographically hashed contact details (such as SHA256 hashed emails and phone numbers) may be securely processed with digital advertising services (such as Google Ads) strictly for custom audience targeting, exclusion of active clients from paid campaigns, and performance analytics.
• Legal & Regulatory Bodies: When mandated by South African court order, subpoena, or statutory law.

Note on Data Protection: We do NOT sell, rent, trade, or commercially lease client personal information to marketing brokers. Environmental Health Practitioner (EHP) contact details remain proprietary internal information and are safeguarded under company protocol.

6. Security Safeguards (POPIA Condition 7)

We implement robust physical, technical, and organizational security measures to prevent unauthorized access, loss, damage, or unauthorized destruction of personal information:

• Cloud Infrastructure: Hosted on secure Cloudflare edge networks utilizing Cloudflare D1 encrypted database storage and R2 isolated object storage.
• Encryption: All web submissions and client portal communications are encrypted in transit using industry-standard TLS 1.3 / HTTPS.
• Access Controls: Role-Based Access Control (RBAC) enforced via cryptographically signed JWT tokens for administrative access.
• Observability & Audit Logs: Active system logging and observability monitoring to detect and prevent security anomalies.

7. Data Retention & Destruction

We retain personal information only for as long as necessary to achieve the purpose for which it was collected, or to comply with statutory legal and accounting retention periods (typically 5 years for tax and financial records under South African law). Once retention periods expire or files are formally closed, personal data is securely destroyed or anonymized.

8. Your Rights as a Data Subject

Under POPIA, as a Data Subject you hold specific enforceable rights regarding your personal information:

To exercise any of these rights, please contact our Information Officer in writing at hello@foodcompliance.co.za.

9. Complaints to the Information Regulator

If you believe that Food Compliance Agency has infringed your rights under POPIA or has failed to handle your personal information in accordance with South African law, you have the right to lodge a complaint directly with the Information Regulator (South Africa):