Privacy Notice
How Aluta Consulting Services collects, uses and protects personal information, in terms of the Protection of Personal Information Act.
This notice is a working draft prepared to the structure POPIA requires. Replace every [bracketed] item with your actual details, confirm the processing described matches what you really do, and have it reviewed by a South African attorney before you publish it.
1. Who we are
Aluta Consulting Services ([registered name and company registration number]) is the responsible party for the personal information described in this notice, as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA").
Information Officer: [full name]
Email: info@alutaconsulting.co.za
Registered address: [street address, Durban, KwaZulu-Natal]
Our Information Officer is registered with the Information Regulator as required by section 55 of POPIA.
2. What this notice covers
This notice explains how we collect, use, share and protect personal information when you visit this website, contact us, or engage us for consulting services. It applies to prospective clients, clients, suppliers, job applicants and website visitors.
3. Personal information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact details | Name, work email address, organisation, job title | Our contact form, our booking page, email, business cards, LinkedIn |
| Booking details | The date and time you choose for a call, and anything you add to the booking | Our booking page |
| Enquiry content | What you tell us about your organisation and what you are trying to achieve | You, directly |
| Engagement records | Correspondence, meeting notes, deliverables, invoices and payment details | The course of an engagement |
| Technical data | IP address, browser and device type, pages visited, referring site, and how you scroll and click on each page | Automatically, when you use this website, and through Microsoft Clarity if you accept its cookies |
We do not knowingly collect special personal information (as defined in section 26 of POPIA) or the personal information of children through this website.
4. Why we process it, and on what basis
POPIA requires a lawful justification for every processing activity. Ours are:
| Purpose | Justification (POPIA s11) |
|---|---|
| Responding to your enquiry and arranging a discovery call | Your consent, and steps taken at your request before entering a contract |
| Delivering consulting services and managing the engagement | Performance of a contract |
| Invoicing, accounting and tax records | Compliance with a legal obligation |
| Understanding how the website is used and improving it (Microsoft Clarity) | Your consent, which you give or refuse through the cookie banner |
| Sending occasional updates about our work | Your consent, which you may withdraw at any time |
5. Who we share it with
We do not sell personal information. We share it only with operators who process it on our behalf under written agreements requiring confidentiality and appropriate security, and with professional advisers or authorities where the law requires it. Our operators include:
- Microsoft, which hosts this website (Microsoft Azure), runs our contact form (Microsoft Forms), booking page (Microsoft Bookings) and website analytics (Microsoft Clarity), and stores the responses and bookings in our Microsoft 365 account. Microsoft processes this information on our behalf under its Products and Services Data Protection Addendum.
- [email provider, if not Microsoft 365]
- [accounting software provider]
6. Information sent outside South Africa
Some of our operators store data outside South Africa. Where that happens, we rely on section 72 of POPIA and ensure the recipient is subject to a law, binding agreement or corporate rules providing an adequate level of protection. Our website and supporting systems are hosted in [Azure region, e.g. South Africa North (Johannesburg)].
Contact form responses and bookings are stored in our Microsoft 365 account, in [data location shown in the Microsoft 365 admin centre, e.g. South Africa]. Where Microsoft processes them in another country, it does so under the binding commitments in its Data Protection Addendum, which is the protection we rely on under section 72.
7. How we protect it
As required by section 19 of POPIA, we maintain appropriate, reasonable technical and organisational measures: encrypted devices and backups, access controls limited to staff who need the information, multi-factor authentication on business systems, transport-layer encryption on this website, and confidentiality obligations in every employment and supplier contract. If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 requires.
8. How long we keep it
We keep enquiry records for [24 months] from our last contact with you, engagement records for [7 years] after the engagement ends, and financial records for the period the Companies Act and the Tax Administration Act require. We delete or de-identify personal information once these periods lapse.
9. Your rights
Under POPIA you have the right to:
- be told what personal information we hold about you, and to receive a copy of it;
- have inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information corrected or deleted;
- object, on reasonable grounds, to our processing of your information;
- withdraw consent where our processing relies on it;
- not be subject to a decision based solely on automated processing; and
- complain to the Information Regulator.
To exercise any of these, email info@alutaconsulting.co.za. Requests for access to records follow the procedure in our PAIA Manual.
10. Cookies and analytics
We use Microsoft Clarity to see how visitors use this website – which pages are read, how far people scroll, and where they click or get stuck – so we can improve it. Clarity sets cookies to recognise a returning browser and records these interactions. It cannot see what you enter into the contact form, which Microsoft Forms handles separately. We look at this information in aggregate and do not use it to identify you. Microsoft processes it on our behalf, as described in the Microsoft Privacy Statement.
The contact form and booking page are also provided by Microsoft, which may set its own cookies when you use them.
Clarity only runs if you accept it in the cookie banner shown on your first visit. You can change your choice at any time using “Cookie settings” at the bottom of every page, or block and delete cookies in your browser settings. The website works either way.
11. Complaints
Please raise any concern with our Information Officer first – we would rather fix it directly. If you are not satisfied, you may complain to:
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
P.O. Box 31533, Braamfontein, Johannesburg, 2017
General enquiries: enquiries@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
inforegulator.org.za
12. Changes to this notice
We update this notice when our processing changes. The current version is dated [date].