POPIA Notice

Effective date: 2026-05-02 · Version 1.0

Draft — pending legal review. This is a baseline POPIA Section 18 / Section 55 notice. Sections marked [To be confirmed] require input from the responsible party before publication. The nominated information officer must also be registered with the Information Regulator of South Africa prior to launch.

This notice is given in compliance with the Protection of Personal Information Act, 4 of 2013 (“POPIA”), and complements our Privacy Policy. It explains who is responsible for your personal information at Cerafin, how to contact our information officer, and how to exercise your rights as a data subject under POPIA.

Responsible party

Cerafin (Pty) Ltd (Registration No. [To be confirmed on incorporation]) is the responsible party in terms of POPIA s1 for personal information processed through the Cerafin platform at cerafin.co.za.

Information officer (POPIA s55)

Our nominated information officer is responsible for ensuring compliance with POPIA, dealing with requests for access to information, and engaging with the Information Regulator.

Name: [Information Officer name to be confirmed]
Designation: [Role title to be confirmed — e.g. Chief Executive Officer / Director]
Email: privacy@cerafin.co.za
Telephone: [Contact number to be confirmed]
Postal address: [Registered office address to be confirmed on incorporation]

The information officer must be registered with the Information Regulator. We will publish the registration confirmation reference here once issued.

Your rights under POPIA

As a data subject you have the following rights:

To be notified about collection of your personal information (POPIA s18).
To request confirmation of and access to records of your personal information (s23).
To request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, misleading or unlawfully obtained information (s24).
To object, on reasonable grounds, to the processing of your personal information (s11(3)).
To lodge a complaint with the Information Regulator (s74).

How to exercise your rights

Email our information officer at privacy@cerafin.co.za with the subject line “POPIA request”.
Include your name, the email address linked to your Cerafin account, and a description of the right you wish to exercise.
We will acknowledge your request within 7 calendar days and respond within 30 calendar days, or sooner where required.
If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (contact details below).

Right to erasure of an entire workspace

If you request deletion of an entire company workspace (sometimes called the “right to be forgotten”), the request goes through our Erasure Request flow:

The request is logged with a 14-day cooling-off / soft-delete window.
An administrator approves the request, after verifying you are the account owner.
If not cancelled, the workspace data is hard-deleted at the end of the cooling-off window. Audit-log entries demonstrating the action are retained for the legal retention period.
Records that we are required by law to retain (for example tax records under the Tax Administration Act) are retained for the legally required period and then destroyed.

Information Regulator (South Africa)

Website: inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za

Updates to this notice

We may update this notice from time to time. The version and effective date at the top of the page reflects the current revision. Please check back for changes.