Privacy policy

1. Who we are

This site is operated by Service with Flair (Pty) Ltd ("Service with Flair", "we", "us"), a private company registered in the Republic of South Africa.

• Registration number: 2016/285551/07
• Address: Postnet Suite #26, Private Bag X1, Gansbaai, Western Cape, 7220
• Telephone: 010 630 0216
• General enquiries: info@swflair.co.za
• Website: https://swflair.co.za

We are the responsible party for the personal information described in this policy, as that term is used in POPIA.

2. Information Officer

Our Information Officer, appointed under section 55 of POPIA, is Chris Daubert, contactable at legal@swflair.co.za or on 010 630 0216.

Direct any question, request or complaint about personal information to the Information Officer in the first instance.

3. What we collect, and why

We collect only what we need for a stated purpose. We do not sell personal information, and we do not share it for anyone else's marketing.

3.1 When you contact us

Through the contact form or by email or telephone, we collect your name, surname, company name, email address, telephone number, the enquiry type you select, and whatever you write in your message.

Purpose: to answer you, to route your enquiry to the correct person, and to keep a record of what was asked and answered.

Lawful basis: your consent in submitting the form, and our legitimate interest in responding to business enquiries.

3.2 When you send a verification certificate for review

We collect your name, surname, company name, email address, telephone number, and the document you upload. Your consent is recorded with a date and time stamp.

Purpose: to carry out the free scorecard review you asked for and to come back to you with the outcome.

Lawful basis: your explicit consent, and the performance of a service you requested.

Note on content. A verification certificate is a business document about a company. If it happens to contain personal information — the names of directors or shareholders, for example — we treat that with the same care as anything else in this policy and use it only for the review.

3.3 When you use the level checker

The level checker runs entirely in your browser. Your answers are not transmitted to us or stored anywhere, unless you separately choose to send us your certificate.

3.4 When you download a document

We count how many times each file is downloaded. That count is not linked to you and we do not know who downloaded what.

3.5 When our consultants engage with you as a client

In the course of a B-BBEE engagement we may process personal information about your employees, learners, beneficiaries and suppliers — including identity numbers, demographic information required by the Codes, payroll and training records.

Purpose: to perform the contracted work, to compile the evidence a SANAS-accredited verification agency requires, and to meet obligations imposed by the B-BBEE Act, the Skills Development Act and the Employment Equity Act.

Lawful basis: the performance of our contract with you, and compliance with an obligation imposed by law.

Where we process this information on your instruction, we act as an operator under POPIA and you remain the responsible party. Our engagement terms set out the security and confidentiality obligations that apply.

3.6 Technical information

Our web server records the usual technical details of a request — IP address, browser type, the page requested, and the date and time. This is kept for security and diagnostics.

4. Special personal information

B-BBEE work necessarily involves information about race, and sometimes about disability. POPIA classifies both as special personal information.

We process it only where POPIA permits — with the data subject's consent, or because processing is necessary to comply with an obligation of international public law or to achieve a lawful purpose of affirmative action or protection of the rights of persons previously disadvantaged by unfair discrimination, as contemplated in section 27 of the Act.

We do not use this information for any purpose other than the B-BBEE, skills development and employment equity work it was collected for.

5. Cookies and similar technologies

This site sets a single session cookie, and only when it needs one — to keep a form submission attached to the right visitor, to protect forms against cross-site request forgery, and to keep a consultant signed in to the dashboard. It expires when you close your browser.

We do not use advertising cookies and we do not run third-party tracking or advertising networks on this site.

Web fonts are loaded from Google Fonts. Your browser makes a request to Google's servers to fetch them, and Google may log that request. If that concerns you, blocking third-party requests in your browser will not break this site.

If we add analytics in future, this policy will be updated before it goes live.

6. Who we share information with

We share personal information only where it is necessary, and only with:

• SANAS-accredited verification agencies, where a verification requires it
• Accredited training providers, where a learner must be enrolled
• SETAs and government departments, where a statutory submission requires it
• Our hosting and email providers, who process data on our instruction under contract
• Professional advisers, where we are obliged to take advice
• A regulator, court or law enforcement authority, where the law requires it

We do not sell, rent or trade personal information. Ever.

7. Cross-border transfer

Our website and email are hosted in South Africa. Where a service provider processes information outside the Republic, we do so only where section 72 of POPIA permits — where the recipient is subject to a law or agreement giving substantially similar protection.

8. How long we keep it

• Contact enquiries: three years from the last contact, unless a client relationship has begun
• Certificate reviews and uploaded documents: twelve months, unless we are engaged, in which case the engagement terms govern
• Client engagement records: five years after the engagement ends, which is the period the B-BBEE verification cycle and general commercial prescription require
• Records we are obliged by law to keep: for the period the law prescribes
• Server logs: not longer than twelve months

We delete or de-identify personal information once the purpose has been achieved and no law requires us to keep it.

9. How we protect it

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. Ours include:

• Encrypted connections (HTTPS) across the whole site
• Documents you upload are stored outside the public web folder and can only be retrieved by an authenticated consultant
• Uploaded files are validated by their actual contents, not their filename
• Passwords stored only as one-way cryptographic hashes — nobody at Service with Flair can read your password
• Access to the dashboard restricted by individual named account and role
• Protection against cross-site request forgery, clickjacking, content injection and automated abuse

No system is perfectly secure. If a compromise occurs that creates a reasonable belief that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as section 22 of POPIA requires.

10. Your rights

Under POPIA you have the right to:

• Be told whether we hold personal information about you, and to be given a copy of it
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
• Object, on reasonable grounds, to our processing
• Withdraw a consent you previously gave, without affecting processing already carried out lawfully
• Object to direct marketing at any time
• Not have a decision affecting you made solely by automated means
• Complain to the Information Regulator
• Institute civil proceedings for a breach of your rights under the Act

To exercise any of these, contact our Information Officer at legal@swflair.co.za. We will respond within a reasonable period and in any event within the periods the Act allows. We may need to verify your identity first.

11. Direct marketing

We send marketing communications only to people who have asked for them, or to existing clients about services similar to those we already provide — as section 69 of POPIA permits. Every such message carries a way to stop receiving them, and we act on that immediately.

12. Access to information (PAIA)

We maintain a manual under section 51 of the Promotion of Access to Information Act 2 of 2000. To request it, or to make a request for access to a record, contact our Information Officer.

13. Children

This site is not directed at children, and we do not knowingly collect the personal information of a child as defined in POPIA except where a learner under 18 is enrolled in a learnership on a client's instruction — in which case we process it in accordance with section 35 of the Act and with the consent of a competent person.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed. Material changes will be brought to the attention of anyone we hold information about.

15. Complaints

Please raise a complaint with our Information Officer first — most things are resolved quickly that way. If you are not satisfied, you may complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za