POPIA Notice

1. Our commitment to POPIA compliance

Scales of Strategy Labour Consulting (Pty) Ltd is committed to processing personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). This notice sets out, in specific POPIA terms, how we meet our obligations as a responsible party and the rights you have as a data subject.

This notice should be read alongside our Privacy Policy, which provides broader detail about the information we collect and how we use it.

2. Information Officer

As required under sections 55 and 56 of POPIA, we have designated an Information Officer who is accountable for the lawful processing of personal information within our business.

3. The eight conditions of lawful processing

POPIA requires responsible parties to satisfy eight conditions when processing personal information. The following sets out how we apply each condition:

3.1 Accountability

We take responsibility for ensuring that all eight conditions are met before, during, and after processing personal information. Our Information Officer oversees compliance across the business.

3.2 Processing limitation

We process personal information lawfully and in a reasonable manner that does not infringe on your privacy. We only process information where we have a lawful basis to do so, and we collect only the minimum information necessary for the purpose at hand.

3.3 Purpose specification

We collect personal information for specific, explicitly defined, and lawful purposes connected to our function as a labour law and HR advisory firm. These purposes include responding to enquiries, providing consulting services, representing clients at dispute resolution forums, and meeting our legal and regulatory obligations.

3.4 Further processing limitation

Where we process personal information for a purpose beyond the one for which it was originally collected, we only do so where the further purpose is compatible with the original, or where a separate lawful basis (such as your consent) exists.

3.5 Information quality

We take reasonably practicable steps to ensure that personal information we hold is complete, accurate, not misleading, and updated where necessary. If you notify us that information we hold is inaccurate, we will correct it promptly.

3.6 Openness

We maintain this POPIA notice and our Privacy Policy as an open statement of how we process personal information. We also maintain a PAIA manual (see section 10). Where you provide us with personal information directly, we take reasonably practicable steps to make you aware of the purpose of collection.

3.7 Security safeguards

We take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access, or unauthorised disclosure. These include secure cloud storage with reputable providers (Google, Microsoft, Dropbox), access controls on business systems, encryption of data in transit, and contractual obligations imposed on operators who process information on our behalf.

3.8 Data subject participation

We give you access to the personal information we hold about you on reasonable request, and we allow you to request correction or deletion where appropriate. See section 7 for your specific rights and section 8 for how to exercise them.

4. Categories of data subjects

We process personal information relating to the following categories of data subjects:

• Prospective clients and website enquirers.
• Current and former clients, where the client is an individual or a representative of a client organisation.
• Employees of client organisations, where that information is shared with us in the course of a client engagement (for example, in disciplinary proceedings, retrenchments, or policy drafting).
• Third parties referenced in client matters (such as witnesses, complainants, or opposing parties).
• Service providers and professional contacts.

5. Categories of personal information

Depending on your relationship with us, we may process any of the following categories of information:

• Contact details (name, email, phone, employer).
• Communication records (emails, WhatsApp messages, call notes, meeting records).
• Employment-related information (employment contracts, disciplinary records, payroll data, leave records, performance reviews) — typically in the context of representing or advising a client organisation.
• Identifying information required for CCMA or Bargaining Council proceedings.
• Financial and billing information (for client engagements).
• Website analytics data (approximate location, device type, browsing behaviour — typically aggregated).

We do not routinely process special personal information (such as religious beliefs, health information, or biometric data) unless it is strictly necessary for a specific client matter, and only with appropriate authorisation.

6. Operators and third parties

POPIA distinguishes between responsible parties (who determine the purpose and means of processing) and operators (who process information on behalf of a responsible party). We act as:

• Responsible party in respect of information we collect and control directly (our client list, our internal records, website analytics).
• Operator in respect of information provided to us by client organisations for us to process on their behalf (such as employee records shared with us to conduct a disciplinary hearing or draft a retrenchment consultation letter).

Where we act as an operator, we process information only on the instructions of the responsible party (our client), and we apply the same security safeguards as we do to information we hold as responsible party.

The third parties with whom we share or through whom we process information are listed in section 6 of our Privacy Policy.

7. Your rights under POPIA

As a data subject, POPIA gives you the following rights (sections 23 to 25 of the Act):

• Right to be notified that personal information about you is being collected, or has been accessed or acquired by an unauthorised person.
• Right of access — to confirm whether we hold personal information about you, and to request a copy.
• Right to correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, misleading, or unlawfully obtained.
• Right to object to the processing of your personal information on reasonable grounds.
• Right to withdraw consent, where consent is the basis on which we rely.
• Right to submit a complaint to the Information Regulator.
• Right to institute civil proceedings regarding the alleged interference with the protection of your personal information.

8. How to exercise your rights

To exercise any of the rights above, contact our Information Officer by email or telephone (details in section 2).

When making a request, please:

• Identify yourself clearly (we may ask for verification to prevent disclosure to the wrong person).
• Specify which right you are exercising and what information your request relates to.
• Provide a reasonable description of the information concerned where possible.

We aim to respond to requests within a reasonable time, and in any event within the timeframes specified under PAIA and POPIA. A prescribed fee may apply for access requests in line with the PAIA fee schedule.

9. Complaints to the Information Regulator

If you believe we have failed to comply with POPIA in any respect, you may lodge a complaint with the Information Regulator of South Africa. We encourage you to raise the matter with us first so we have the opportunity to address it, but this is not a prerequisite to contacting the Regulator.

10. PAIA manual

The Promotion of Access to Information Act 2 of 2000 ("PAIA") gives effect to the constitutional right of access to information held by public and private bodies. As a private body, we maintain a PAIA manual which sets out the records we hold and the procedure for requesting access to them.

Our PAIA manual is available on request, free of charge, by contacting our Information Officer.