Privacy Policy

1. Who we are

This website is operated by RSA Consulting, a company registered in the Republic of South Africa ("we", "us", "our").

We are the responsible party as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA") in respect of the personal information described in this policy.

2. What personal information we collect

We collect the following categories of personal information:

• Information you give us directly. When you complete an application form, register for a webinar, or contact us, we collect your name, surname, email address, mobile number, country or province of residence, and the answers you provide to our application questions — which may include information about your current employment status, your available time, and your financial readiness to enrol in a paid programme.
• Information collected automatically. When you visit this website we collect your IP address, browser type and version, device type, operating system, referring URL, the pages you view, the time and duration of your visit, and similar technical information.
• Advertising and campaign identifiers. Where you reach this site from an advertisement or a tracked link, we collect campaign parameters such as utm_source, utm_medium, utm_campaign, utm_content, and advertising platform click identifiers.
• Communications. Records of correspondence between you and us, including email, SMS, WhatsApp and recorded or transcribed calls where you have been notified that a call is recorded.

We do not knowingly collect personal information from children under the age of 18. We do not collect special personal information as defined in POPIA.

3. How we collect it

We collect personal information directly from you when you submit a form, register for an event, or communicate with us. We also collect information automatically through cookies and similar technologies as described in section 6, and we may receive information from advertising and analytics platforms where you have interacted with our advertising.

4. Why we process your personal information, and on what lawful basis

• To assess your application and determine whether our programme is suitable for you — necessary to conclude or perform a contract with you (s11(1)(b)).
• To contact you about your application, including by email, SMS, WhatsApp and telephone — necessary to conclude or perform a contract with you (s11(1)(b)); consent (s11(1)(a)).
• To deliver the programme you have purchased and provide support — performance of a contract (s11(1)(b)).
• To send you marketing about our own services — consent (s11(1)(a)) and s69 of POPIA.
• To measure and improve the performance of our advertising and website — our legitimate interests (s11(1)(f)).
• To comply with tax, accounting and other legal obligations — legal obligation (s11(1)(c)).

5. Who we share it with

We share personal information with the following categories of operator (processor), each of which processes it on our instruction and under a written agreement:

• Form and survey providers (Typeform) — to collect and store your application responses.
• Customer relationship and marketing platforms (GoHighLevel) — to store your record and send you email and SMS communications.
• Advertising platforms — to measure advertising performance and to build audiences. Where we share data with advertising platforms we do so using hashed identifiers.
• Payment providers — to process programme fees. We do not store your full card details.
• Hosting and infrastructure providers — to operate this website.
• Professional advisers — our accountants, auditors and attorneys, where required.

We do not sell your personal information.

6. Cookies and tracking technologies

This website uses cookies and similar technologies, including:

• Strictly necessary cookies, which are required for the site to function and for security. These include cookies set by our content delivery network to identify malicious traffic.
• Analytics cookies, which allow us to understand how visitors use the site and to measure the effectiveness of our advertising.

You can control or delete cookies through your browser settings. Disabling cookies may affect how parts of this site function. You can also manage how advertising platforms use your information through the settings offered by those platforms.

7. Your rights

Under POPIA you have the right to:

• Be told what personal information of yours we hold, and to request a copy of it (s23). We may charge a prescribed fee for this.
• Ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (s24).
• Object to our processing of your personal information on reasonable grounds (s11(3)(a)).
• Withdraw your consent at any time, where our processing is based on consent. Withdrawing consent does not affect processing carried out before withdrawal.
• Unsubscribe from our direct marketing at any time, at no cost, using the unsubscribe link in any email or by replying STOP to any SMS.
• Not be subject to a decision based solely on automated processing that has legal consequences for you.
• Complain to the Information Regulator (see section 11).

To exercise any of these rights, contact us at support@rsaconsulting.io. We will respond within a reasonable period and in any event as required by POPIA. We may ask you to verify your identity before we act on a request.

8. How long we keep it

We keep your personal information only for as long as is necessary for the purposes set out in this policy:

• Applications that do not result in enrolment: up to 24 months from your last interaction with us, after which the record is deleted or de-identified.
• Enrolled clients: for the duration of the programme and for 5 years thereafter, to meet our tax, accounting and contractual record-keeping obligations.
• Marketing contacts: until you unsubscribe or object, and then only to the extent needed to honour your suppression request.

9. Security

We apply reasonable technical and organisational measures to protect personal information against loss, damage, and unlawful access, including encryption in transit, access controls, and the use of reputable service providers. No system is completely secure. If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as required by section 22 of POPIA.

10. Cross-border transfers

Several of our service providers are located outside South Africa, including in the United States and the European Union. Where we transfer your personal information across borders we do so in accordance with section 72 of POPIA — on the basis that the recipient is subject to laws or binding agreements that provide an adequate level of protection, or that the transfer is necessary for the performance of a contract with you, or with your consent.

11. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with:

The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: complaints.IR@justice.gov.za General enquiries: enquiries.IR@justice.gov.za Website: inforegulator.org.za

We would appreciate the chance to address your concern directly first — please contact us.

12. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the most recent version. Material changes will be communicated to you where we are required to do so.

13. Contact us

RSA Consulting Email: support@rsaconsulting.io