Your information. Your rights.

Our approach to personal information

Tshimoloho Advisory Services processes personal information for legitimate and defined purposes connected with our business activities, website, communications, services and relationships with clients, prospective clients, suppliers and other stakeholders.

We aim to process personal information in a manner that is appropriate to the purpose for which the information was collected and consistent with applicable South African law.

Personal information we may process

Depending on the nature of an interaction with Tshimoloho, personal information may include:

• Names and contact information;
• Email addresses and telephone numbers;
• Organisation or business information;
• Professional or business correspondence;
• Information supplied in enquiries, requests, proposals or other communications;
• Information required to manage a client, supplier or business relationship; and
• Technical information reasonably required for the operation and security of our digital platforms.

The particular information processed will depend on the nature and purpose of the interaction.

Purpose of processing

We may process personal information where reasonably necessary to:

• Respond to enquiries and requests;
• Communicate with prospective and existing clients or stakeholders;
• Assess and respond to business or project requirements;
• Provide, manage and support our services;
• Manage contractual and business relationships;
• Operate, secure and maintain our website and technology environment;
• Maintain appropriate business and administrative records; and
• Comply with applicable legal or regulatory obligations.

Website contact enquiries

When you use the contact form on this website, you choose to provide information to Tshimoloho so that we can understand and respond to your enquiry.

The form currently requests your name, email address, area of interest and description of your requirement. Your organisation and telephone number may also be provided.

Information supplied through the form should be limited to information reasonably relevant to the enquiry.

Processing principles

In handling personal information, Tshimoloho seeks to apply appropriate information-protection principles, including:

• Processing information for lawful and appropriate purposes;
• Limiting processing to information reasonably required for those purposes;
• Taking reasonable steps to maintain appropriate information quality where necessary;
• Maintaining reasonable safeguards for personal information;
• Avoiding unnecessary retention of personal information; and
• Respecting applicable rights of data subjects.

Security safeguards

Tshimoloho takes reasonable technical and organisational measures designed to protect personal information against loss, unauthorised access, misuse, alteration or disclosure.

Appropriate safeguards may include access controls, identity and authentication controls, system security, secure communications, administrative controls and other measures appropriate to the relevant technology and processing activity.

Security controls are considered in relation to the nature of the information, the systems involved and the risks associated with the processing.

Service providers and third parties

Tshimoloho may use technology, communications, hosting, professional or other service providers where reasonably necessary to conduct our business or provide our services.

Personal information may therefore be processed through third-party systems where required for the relevant business purpose.

We may also disclose personal information where required or permitted by applicable law or a lawful request from an authorised authority.

Retention of information

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, legitimate business requirements, contractual requirements or applicable legal and regulatory obligations.

The appropriate retention period may therefore differ depending on the nature of the information and the purpose for which it is processed.

Your rights

Subject to POPIA and other applicable law, a data subject may have rights relating to the processing of their personal information, including the right to:

• Request confirmation of whether personal information is held about them;
• Request access to personal information in accordance with applicable procedures;
• Request correction or updating of inaccurate personal information;
• Request deletion or destruction where the applicable legal requirements are met;
• Object to certain processing in circumstances provided for by law; and
• Raise concerns regarding the processing of personal information.

These rights are subject to applicable legal requirements, exceptions and procedures.

Requests relating to personal information

Where you make a request concerning personal information, we may need sufficient information to identify the relevant records and reasonably verify the identity or authority of the person making the request.

This helps protect personal information against unauthorised disclosure or alteration.

Complaints and concerns

If you have a concern regarding the way Tshimoloho has processed personal information, you may contact us so that the matter can be considered and addressed appropriately.

POPIA also provides mechanisms for complaints to the Information Regulator of South Africa, subject to the applicable procedures.