POPIA Compliance

Jaspa Innovate (Pty) Ltd ("Jaspa") takes the protection of personal information seriously and is committed to complying fully with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") and the regulations published thereunder. POPIA became fully effective on 1 July 2021 and governs the processing of personal information by all responsible parties operating in or from South Africa.

This statement sets out how Jaspa gives effect to the eight Conditions for Lawful Processing established under POPIA, and explains your rights as a data subject.

1. Accountability

Jaspa Innovate (Pty) Ltd is the Responsible Party for all personal information processed in the course of its business operations. We have designated a duly appointed Information Officer who is responsible for ensuring our compliance with POPIA and for handling data subject requests.

Information Officer: Sibusiso Ndlovu
Contact: info@jaspa.co.za  |  087 250 0784

2. Processing Limitation

We process personal information only when we have a lawful basis to do so. The lawful grounds on which we rely include:

• Consent: Where you have freely and specifically consented to processing for a defined purpose (e.g. marketing communications)
• Contractual necessity: Where processing is necessary to perform or prepare for a contract to which you are a party (e.g. service delivery)
• Legitimate interest: Where processing is necessary for a legitimate interest pursued by Jaspa that does not override your rights and freedoms
• Legal obligation: Where processing is required to comply with a legal obligation (e.g. SARS tax record-keeping)

We do not process personal information beyond what is necessary for the purpose for which it was collected.

3. Purpose Specification

We collect personal information only for specific, explicitly defined, and lawful purposes. These purposes are communicated to data subjects at the time of collection. We do not process personal information for a secondary purpose that is incompatible with the original stated purpose without obtaining fresh consent.

Primary processing purposes include: service delivery, client communication, invoicing, platform provisioning, and legal compliance. Full details are contained in our Data Usage Policy.

4. Further Processing Limitation

Where personal information is shared with third-party operators (e.g. cloud hosting providers, email infrastructure partners, analytics services), we ensure that such operators process the information solely for the purposes we have specified and under equivalent data protection obligations. We do not sell or share personal information with third parties for their own marketing or commercial purposes.

5. Information Quality

We take reasonable steps to ensure that personal information we hold is complete, accurate, and up to date, having regard to the purposes for which it is held. You may request corrections to your personal information at any time by contacting our Information Officer.

6. Openness

Jaspa maintains this public POPIA Compliance Statement and our Data Usage Policy to inform data subjects about our processing practices. We notify individuals when we collect their personal information and provide clear information about who we are, why we are collecting the information, and their rights.

7. Security Safeguards

We implement appropriate technical, physical, and organisational measures to protect personal information under our control against:

• Unauthorised access, loss, damage, or destruction
• Unlawful or unauthorised processing
• Accidental or unlawful disclosure

Security measures include encrypted HTTPS connections, role-based access controls, two-factor authentication requirements on internal systems, secure password policies, and regular security reviews. Our cloud service providers are vetted for compliance with internationally recognised security standards.

In the event of a security compromise that may affect your personal information, we will notify you and the Information Regulator as required by POPIA within the prescribed timeframes.

8. Data Subject Participation

As a data subject, you have the following rights under POPIA:

• Right of access: You may request details of the personal information we hold about you (POPIA Form 2).
• Right to correction or deletion: You may request that inaccurate, incomplete, or outdated information be corrected or deleted.
• Right to object: You may object to the processing of your personal information on grounds relating to your particular situation, and you have an absolute right to opt out of direct marketing at any time.
• Right to complain: If you believe your rights under POPIA have been infringed, you may lodge a complaint with the Information Regulator of South Africa.

To exercise any of the above rights, contact our Information Officer at info@jaspa.co.za. We will acknowledge your request within 3 business days and respond in full within 30 days.

Information Regulator Contact Details

If you are not satisfied with our response to your data subject request, you have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: inforeg@justice.gov.za
Website: www.inforegulator.org.za

PAIA Manual

In terms of the Promotion of Access to Information Act (PAIA), Jaspa Innovate (Pty) Ltd maintains a PAIA Manual which is available on request. This manual describes how to request access to records held by Jaspa. Contact our Information Officer to obtain a copy.