Privacy Policy

1. Introduction

South Africa Business (operated by WorldFinancial.Center in collaboration with WorldExpo.Center, UNiOnWorldTrade.Center, and affiliated chambers of commerce and enterprise service organizations) is committed to protecting the privacy and security of your personal information.

This Privacy Policy describes how we collect, use, process, and disclose your personal data when you interact with our website, services, events, and platforms. It applies to all visitors, users, partners, and clients globally, with specific regard to the Protection of Personal Information Act (POPIA) 4 of 2013 in South Africa and the General Data Protection Regulation (GDPR) (EU) 2016/679 for individuals in the European Economic Area.

2. Scope & Applicability

This policy covers all personal data processed by South Africa Business and its associated entities, including but not limited to:

It applies to information collected through our website, email communications, events, webinars, trade missions, business matchmaking services, and any other interactions where we process personal data.

3. Data We Collect

We may collect the following categories of personal information:

• Identity Data: Full name, job title, company name, industry sector, professional qualifications.
• Contact Data: Email address, telephone number, postal address, country of residence.
• Business Data: Company registration number, VAT/Tax ID, business interests, investment preferences, trade history.
• Technical Data: IP address, browser type, device information, operating system, referral URLs, and cookies (see Section 11).
• Usage Data: Pages visited, time spent, clicks, downloads, and interactions with our content and services.
• Marketing & Communication Data: Your preferences for receiving marketing communications from us and our partner organizations.
• Event & Meeting Data: Information provided during registration for events, webinars, or trade missions, including dietary requirements, accommodation preferences, and special assistance needs.

We collect this data directly from you when you fill out forms, subscribe to newsletters, register for events, request information, or interact with our platforms. We may also collect data from publicly available sources and partner organizations in accordance with applicable law.

4. How We Use Your Data

We process your personal data for the following purposes:

• To provide and manage our business information, investment advisory, and trade facilitation services.
• To facilitate connections between businesses, investors, and South African market opportunities.
• To organize and manage events, trade missions, webinars, and business delegations.
• To send you relevant news, insights, sector reports, and promotional materials (with your consent).
• To improve our website, platforms, and services through analytics and user feedback.
• To comply with legal and regulatory obligations, including anti-money laundering (AML) and know-your-customer (KYC) requirements.
• To respond to your inquiries, requests, or complaints.
• To protect our rights, property, and safety, and that of our users and partners.

5. Legal Basis for Processing (POPIA & GDPR)

We process your personal data only where we have a lawful basis to do so, including:

• Consent: You have given clear consent for us to process your data for specific purposes (e.g., marketing communications).
• Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legal Obligation: Processing is necessary for compliance with a legal or regulatory obligation (e.g., POPIA, tax laws).
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights and freedoms (e.g., improving our services, fraud prevention).

Under POPIA, we act as a Responsible Party (controller) and may engage Operators (processors) who process data on our behalf. We ensure all operators comply with POPIA and applicable data protection laws.

6. Data Sharing & Third Parties

We may share your personal data with the following categories of recipients, always under strict confidentiality and data protection obligations:

• Affiliated Organizations: WorldFinancial.Center, WorldExpo.Center, UNiOnWorldTrade.Center, and CIE – Chambers for Internationalization for the purpose of delivering cross-border business services.
• Service Providers: IT providers, cloud hosting, analytics, event management, and marketing platforms that process data on our behalf.
• Partner Chambers & Trade Bodies: Local and international chambers of commerce, investment promotion agencies, and industry associations.
• Business Counterparts: Potential business partners, investors, or clients as part of matchmaking and trade facilitation (only with your explicit consent).
• Legal & Regulatory Authorities: Where required by law, court order, or regulatory obligation.

7. International Transfers of Data

As a global platform, your personal data may be transferred to and processed in countries outside of South Africa, including the European Union, the United Kingdom, the United States, and other jurisdictions where we or our service providers operate.

Where we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Binding Corporate Rules (BCRs) for intra-group transfers.
• Transfers to countries with adequacy decisions by the EU Commission or similar determinations under POPIA.

In all cases, we ensure that the recipient provides an adequate level of protection for your personal data and respects your rights under applicable law.

8. Data Security

We implement robust technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure. These include:

• Encryption of data in transit and at rest.
• Access controls and authentication mechanisms.
• Regular security assessments, vulnerability scans, and penetration testing.
• Staff training on data protection and information security.
• Incident response and breach notification procedures.

While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to continuously improving our security posture.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

Retention periods vary depending on the type of data and the purpose:

• Contact & Business Data: Retained for the duration of our relationship and for a reasonable period thereafter (typically 5–7 years) for legal and audit purposes.
• Marketing Data: Retained until you withdraw your consent or unsubscribe.
• Event & Meeting Data: Retained for up to 12 months after the event, unless otherwise required.
• Technical & Usage Data: Retained for a shorter period (e.g., 12–24 months) for analytics and service improvement.

When data is no longer needed, we securely delete or anonymize it.

10. Your Rights

Under POPIA and GDPR, you have the following rights regarding your personal data:

• Right to Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): You may request deletion of your data where there is no compelling reason for continued processing.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: You may request that we transfer your data to another organization in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
• Right to Lodge a Complaint: You may lodge a complaint with the South African Information Regulator or your local data protection authority.

To exercise any of these rights, please contact us using the details in Section 13. We will respond to your request within 30 days, as required by POPIA and GDPR.

11. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience, analyze usage, and personalize content. Cookies are small text files stored on your device.

We use the following types of cookies:

• Essential Cookies: Necessary for the functioning of the website (e.g., session management, security).
• Performance Cookies: Collect anonymous data on how visitors use our site to improve performance.
• Functional Cookies: Remember your preferences and settings.
• Targeting/Advertising Cookies: Used to deliver relevant content and measure campaign effectiveness (only with your consent).

You can manage your cookie preferences through your browser settings or via our cookie consent banner. Please note that blocking certain cookies may affect website functionality.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. We will post the updated version on this page with a revised "Last Updated" date. For significant changes, we will notify you via email or through a prominent notice on our website.

We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer (DPO):

For complaints, you may also contact the South African Information Regulator at:
inforeg@justice.gov.za
www.justice.gov.za/inforeg/

---

This Privacy Policy is aligned with the Protection of Personal Information Act (POPIA) 4 of 2013 and the General Data Protection Regulation (GDPR) (EU) 2016/679.