Last updated: [date] | Version: 1.0
This policy explains how Retail Insider collects, uses, shares and protects personal information, and what your rights are under the Protection of Personal Information Act 4 of 2013 (“POPIA”). It applies to retailinsider.co.za and to any newsletter, form or event operated under the Retail Insider name.
1. Responsible Party
The responsible party, as defined in POPIA, is:
[Registered entity name]
Company registration number: [number]
[Street address], Gauteng, South Africa
Information Officer: [full name]
Email: ed****@**************co.za
2. Personal Information We Collect
2.1 Information you give us
- Newsletter subscription: email address, and optionally your name, job title and company.
- Contact and enquiry forms: name, email address, company, and the content of your message.
- Contributor submissions: name, biography, photograph, professional affiliations, contact details and declared conflicts of interest, all of which are intended for publication alongside your article.
- Comments: name, email address, comment content, and the IP address from which the comment was submitted.
2.2 Information collected automatically
- IP address, approximate location derived from it, browser type and version, operating system and device type.
- Pages viewed, time on page, referring URL and exit pages.
- Cookie and similar identifiers, as set out in section 5.
- Server logs retained for security, abuse prevention and diagnostics.
2.3 Special personal information and children
We do not knowingly collect special personal information as defined in section 26 of POPIA, and we do not knowingly collect the personal information of children under 18. If you believe a child’s information has been submitted to us, contact the Information Officer and we will delete it.
3. Why We Process Your Information and On What Basis
| Purpose | POPIA justification (section 11) |
|---|---|
| Sending the Retail Insider Intelligence newsletter | Your consent |
| Responding to enquiries, tips and pitches | Necessary to conclude or perform under a contract, or our legitimate interest in operating a publication |
| Publishing contributed articles and author bios | Your consent, given at submission |
| Site analytics and audience measurement | Legitimate interest in understanding and improving the publication |
| Spam filtering, security and abuse prevention | Legitimate interest in protecting the site and its users |
| Meeting legal, tax and regulatory obligations | Compliance with an obligation imposed by law |
Under section 69 of POPIA we send direct marketing by electronic communication only where you have consented, or where you are an existing subscriber or customer and the communication relates to similar content. Every marketing email carries an unsubscribe link that works.
4. Who We Share Information With
We do not sell personal information. We share it only with operators who process it on our behalf under a written agreement, and only to the extent needed to deliver the service:
- Hosting and content delivery: [hosting provider name] and [CDN name, if applicable].
- Email and newsletter delivery: [provider name].
- Analytics: [Google Analytics 4 or alternative].
- Spam protection: CleanTalk.
- Professional advisors and authorities where disclosure is required by law.
Each operator is required to secure the information and to process it only on our instruction, as required by sections 20 and 21 of POPIA.
4.1 Transfers outside South Africa
Some of the operators listed above store or process data outside South Africa. In line with section 72 of POPIA, we transfer personal information across borders only where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, or where you have consented to the transfer.
5. Cookies and Similar Technologies
- Strictly necessary cookies: session management, security and caching. These are required for the site to function.
- Preference cookies: remember settings such as your comment details or cookie choices.
- Analytics cookies: measure traffic and reading behaviour in aggregate.
- Advertising or partner cookies: set only where a sponsored placement uses them, and disclosed on the affected page.
Non-essential cookies are set only after you accept them in the cookie banner. You can change or withdraw that choice at any time through the banner control, and you can block or delete cookies in your browser settings. Blocking strictly necessary cookies may break parts of the site.
6. Security Safeguards
As required by section 19 of POPIA, we maintain appropriate technical and organisational measures to protect personal information against loss, damage and unauthorised access. These include TLS encryption in transit, access control and role separation in the content management system, brute force protection on login, regular software and plugin updates, and backups.
If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22.
7. How Long We Keep Information
- Newsletter subscribers: until you unsubscribe, plus a suppression record to make sure we do not email you again.
- Enquiries and tips: 24 months from the last contact, unless a longer period is needed for an ongoing story or legal matter.
- Published contributor information: for as long as the article remains published.
- Comments: for as long as the article remains published, unless you ask for removal.
- Analytics and server logs: [retention period, for example 14 months for GA4 and 30 days for server logs].
8. Your Rights
Under POPIA you have the right to:
- Be told what personal information we hold about you and request a copy of it (section 23).
- Request correction, deletion or destruction of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
- Object to processing that relies on legitimate interest, on reasonable grounds (section 11(3)).
- Withdraw consent at any time, without affecting processing already carried out.
- Opt out of direct marketing at any time (section 69).
- Complain to the Information Regulator, and to institute civil proceedings.
To exercise any of these rights, email the Information Officer at ed****@**************co.za. Access and correction requests must be made on Form 2 or Form 3 as prescribed under the Promotion of Access to Information Act. We respond within 30 days and may ask you to verify your identity first. A prescribed fee may apply to access requests.
9. Information Regulator
If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Information Regulator of South Africa. Current contact details and complaint forms are published at inforegulator.org.za.
10. Access to Records
Our manual prepared in terms of the Promotion of Access to Information Act 2 of 2000 is available on request from the Information Officer.
11. Third Party Sites
Our articles link to external sources and to the sites of companies we report on. We do not control those sites and are not responsible for their privacy practices. Read their policies before submitting information to them.
12. Changes to This Policy
We update this policy when our processing changes or when the law requires it. The version number and date at the top of the page reflect the current version. Material changes affecting subscribers are notified by email.