POPIA Information Notice

Responsible party

Encircle Platform (Pty) Ltd
Trading as: Encircle
Registration number: 2026/810371/07
Incorporated in the Republic of South Africa
Address: 203 Beyers Naude Drive
Telephone: 011 476 3932
Email: anton@encircle.co.za

Information Officer

Name: Anton van Wyk
Email: privacy@encircle.co.za
Registered with the Information Regulator: 2026-069919

The Information Officer carries our duties under both POPIA and PAIA. Requests for access to a record are dealt with under our PAIA Manual.

Personal information collected

We collect and process the following personal information:

• Name, email address, job title, and organisation name
• Platform usage data (assessment answers, feature interactions)
• Billing and subscription information
• Technical data (IP address, browser, device)

Purpose of processing

Personal information is processed for the following purposes:

• Providing access to and operation of the Encircle Platform
• Generating governance assessments, scores, and remediation tasks
• Account management and user authentication
• Billing and subscription administration
• Customer support and communications
• Legal and regulatory compliance
• Platform security and fraud prevention
• Product improvement (using aggregated, de-identified data)

Legal basis for processing

We process personal information on the basis of:

• Contract (POPIA §11(1)(b)): processing necessary to conclude or perform the subscription contract
• Legitimate interest (POPIA §11(1)(f)): platform security, fraud prevention, product improvement
• Legal obligation (POPIA §11(1)(c)): compliance with applicable South African law
• Consent (POPIA §11(1)(a)): for marketing and optional communications, which you may withdraw at any time

Whether you have to give us this information

Supplying the personal information above is voluntary. The account information and the evidence you load are, however, necessary to operate the Platform: without a name, an email address and an organisation we cannot create an account, and without evidence we cannot score a framework or produce remediation tasks. There is no statutory obligation on you to supply any of it, and declining has no consequence beyond our being unable to provide the service.

Sharing of personal information

We share personal information only with:

• Cloud hosting and infrastructure providers under written operator agreements
• Payment processing providers (card details are not stored by us)
• Email and analytics service providers
• Encircle Network professionals, only when you explicitly request an introduction
• Legal and regulatory authorities when required by law

We do not sell personal information to third parties.

Cross-border transfers

Some processing may occur outside South Africa (e.g., cloud infrastructure). Where personal information is transferred across borders, we ensure compliance with POPIA §72 through appropriate contractual safeguards.

Retention

Personal information is retained for as long as your account is active and for a reasonable period thereafter, or as required by applicable law. Maximum retention period: 3 years after account closure, unless a longer period is legally required.

Your rights

As a data subject under POPIA, you have the right to:

• Access the personal information we hold about you (§23)
• Correction of inaccurate or incomplete information (§24)
• Deletion of your personal information in certain circumstances
• Object to processing
• Complain to the Information Regulator

Submit requests to: privacy@encircle.co.za

Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa:
Website: inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za