Privacy Policy

1. Who we are

This Privacy Policy explains how Core Path Analytics (Pty) Ltd (registration number 2026/364044/07) ("Core Path Analytics", "we", "us" or "our") processes personal information when you visit www.corepathanalytics.co.za (the "Website"), contact us, request a quote or a GAP Analysis, or become a client.

For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), Core Path Analytics is the responsible party for the personal information described in this policy.

2. Our Information Officer

Our owner and Chief Executive Officer, Andries Mashego, is our Information Officer under POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA"). He is responsible for making sure we comply with POPIA, dealing with requests from data subjects and working with the Information Regulator.

• Name: Andries Mashego
• Role: Chief Executive Officer and Information Officer
• Email: info@corepathanalytics.co.za (please use the subject line "Information Officer")
• Telephone: +27 60 899 2639
• Address: 33 Woodley Street, Kimberley CBD, Kimberley, Northern Cape, 8301

3. What personal information we collect

We only collect what we need for the purposes described in section 4.

3.1 Information you give us through the Website

• Quote requests: your name, job title, organisation name, email address, phone number, industry, organisation size, the services you selected, your project description, preferred timeline, and how you would like us to contact you.
• GAP Analysis requests: your name, job title, organisation name, email address, phone number, industry, organisation size, location, the business areas you are concerned about, what prompted the request, your preferred assessment format and how you would like us to contact you. During the assessment itself, we record your answers to our assessment questions about how your organisation operates, and our findings.
• Contact enquiries: your name, email address, phone number, organisation name, the topic of your enquiry and your message.

3.2 Information you give us through other channels

When you email us, call us or message us on WhatsApp, we receive your name, contact details and whatever you choose to tell us. When you become a client, we also collect the information needed to deliver the engagement, such as company registration details, director and shareholder details, tax reference numbers and operational or financial records of your organisation. We collect only what the specific service requires.

3.3 Information collected automatically

Our hosting provider records basic technical information when you visit the Website, including your IP address, browser type, the pages requested and the date and time of the request. This is used to deliver the Website securely and to detect abuse. We do not use advertising or analytics cookies. See our Cookie Policy for details.

3.4 Special personal information and children

We do not ask for special personal information (such as religious beliefs, race, health, biometric or criminal information) through the Website, and we ask that you do not send it to us. If a client engagement requires it (for example, B-BBEE documentation), we will only process it where POPIA allows. The Website is intended for adults acting for themselves or for an organisation. We do not knowingly collect personal information about children.

4. Why we use your information and our lawful basis

We will not use your personal information for a purpose that is incompatible with the purpose for which we collected it.

5. Direct marketing

We do not send unsolicited marketing. If you are an existing client, we may tell you about services similar to those you already use, and every message will let you opt out free of charge. If you are not a client, we will only send marketing if you have opted in. You can withdraw consent at any time by emailing info@corepathanalytics.co.za.

6. Who we share it with

We do not sell or rent personal information. We share it only where needed, and only with:

• Service providers (operators) who process information on our behalf under written agreements that require them to keep it confidential and secure. These include our website hosting and form-handling provider (Netlify, Inc.), our business email provider, and our accounting software provider.
• Government bodies and regulators where a service you engaged us for requires it, for example the Companies and Intellectual Property Commission (CIPC), the South African Revenue Service (SARS), the Department of Employment and Labour, the Department of Social Development, National Treasury's Central Supplier Database and the Construction Industry Development Board.
• Professional advisers such as our auditors, accountants or attorneys, who are bound by confidentiality.
• Law enforcement or courts where the law requires us to disclose information.

If you choose to contact us on WhatsApp, your messages are also processed by WhatsApp (Meta Platforms) under its own privacy policy.

7. Cross-border transfers

Some of our operators store information on servers outside South Africa. In particular, Website form submissions are processed by Netlify, Inc., which hosts data in the United States and other countries. We only transfer personal information outside South Africa where section 72 of POPIA allows it, for example where the recipient is bound by law, binding corporate rules or an agreement that gives an adequate level of protection, or where the transfer is necessary to respond to your request or perform a contract with you.

8. How we protect it

Under section 19 of POPIA we take appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction and unlawful access to personal information. These include:

• encrypted connections (HTTPS) for the whole Website;
• access to form submissions and client files limited to staff who need them, protected by passwords and multi-factor authentication where available;
• confidentiality obligations for staff and operators;
• regular review of our safeguards as risks change.

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA.

9. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, unless the law requires or allows us to keep it longer (section 14 of POPIA).

• Enquiries and quote requests that do not lead to an engagement: up to 12 months, then deleted.
• Client records, contracts and invoices: five years after the end of the engagement, in line with the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011.
• Website server logs held by our hosting provider: according to the provider's standard retention periods.

When the retention period ends, we delete or de-identify the information securely.

10. Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you and request a copy of it (section 23);
• ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• object to the processing of your personal information on reasonable grounds, and object to direct marketing at any time (section 11(3));
• withdraw your consent at any time, without affecting processing that took place before you withdrew it;
• not be subject to a decision based solely on automated processing that has legal consequences for you (section 71). We do not make such decisions;
• lodge a complaint with the Information Regulator.

To exercise these rights, contact our Information Officer at info@corepathanalytics.co.za. We may need to verify your identity before acting on your request. We will respond within 30 days. Requests for access to records may also be made under our PAIA Manual.

11. Complaints to the Information Regulator

We would appreciate the chance to address your concern first. If you are not satisfied, you may contact the Information Regulator:

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: PO Box 31533, Braamfontein, Johannesburg, 2017
• Telephone: 010 023 5200 or toll-free 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: www.inforegulator.org.za

12. Links to other websites

The Website links to third-party sites, such as LinkedIn, Facebook, Instagram, WhatsApp and Google Maps. We are not responsible for their privacy practices. Please read their privacy policies before sharing information with them.

13. Changes to this policy

We may update this policy when our practices or the law change. The date at the top of this page shows when it was last updated. Material changes will be highlighted on the Website.