Privacy Policy | POPIA Check
Last updated: 18 October 2026
1. Who We Are
POPIA Check ("we", "us", "our") is a business privacy self-assessment and public website evidence-review platform. We are the Responsible Party in respect of all personal information collected through this platform.
2. Personal Information We Collect
When you use our assessment tool, we collect:
- Full name and work email address
- Company name and contact details
- Assessment responses and compliance scores
- Website URL (for the website compliance scanner)
- IP address and browser metadata (for security and analytics purposes)
3. Purpose of Processing
We process your personal information to:
- Produce and email your assessment report
- Support a legal or website partner discussion only when you request and authorise sharing
- Improve our services and assessment accuracy
- Fulfil our legal and contractual obligations
4. Lawful Basis
Processing is conducted on the basis of your consent (given at submission) and, where applicable, to fulfil a contractual obligation with you.
5. Sharing of Information
We do not sell your personal information. We may share it with:
- Our technology service providers used to host the platform, prepare reports and deliver requested emails
- The named legal or website partner you select, only after you explicitly authorise sharing the relevant full report and your contact details. Legal handovers include all business assessment answers. Website handovers include the website findings and evidence. Opening or sharing a referral link alone does not authorise a report handover.
- Regulatory bodies, where required by law
6. Technology Providers and International Processing
The platform uses Base44 for application hosting and storage, Resend for requested report and enquiry emails, and Firecrawl where enhanced retrieval of public website pages is needed. Google Analytics is optional and remains disabled until you accept analytics. These services may process information outside South Africa. The countries, provider contracts and applicable safeguards for international transfers require confirmation by the platform operator; this notice does not claim that publication alone establishes compliance with section 72. Public website addresses submitted for scanning may be sent to Firecrawl. Do not submit private URLs or URLs containing personal information or access tokens.
7. Data Retention
We retain business assessment and website report information to provide your report and support any authorised referral. The applicable retention period and deletion exceptions can be requested from the privacy contact. You can request deletion using the contact details below. We assess deletion requests against any applicable legal retention duties. Draft answers stay in your browser session for up to 24 hours.
8. Your Rights Under POPIA
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your information
- Object to processing
- Lodge a complaint with the Information Regulator
9. Information Regulator Contact
The Information Regulator (South Africa)
Website: https://inforegulator.org.za/
Use the current complaint and contact routes published by the Information Regulator.
10. Contact Us
To exercise any of your rights or for privacy queries, please contact us at: privacy@popiacheck.co.za
Website Reports and Consent
You can scan a public website and download its report without supplying your name or email address. Emailing a copy requires the contact details you enter and your processing permission. Sharing with a named legal or website partner is a separate action. We do not use a report request as consent for marketing. Account holders can change Email Preferences in their profile. With analytics permission, we record when a PDF download is requested against that report; this does not confirm that a file was saved. We use aggregate report, email-request and authorised-handover records to monitor service operation. Report answers, contact details, private report URLs and access tokens are not included in our custom Google Analytics event properties. For privacy requests or marketing objections, use the Contact page and identify your request; do not send a report access token in an initial enquiry.