PopiGuard is a product of Celagenix® (Pty) Ltd ("Celagenix®", "we", "us", "our"), a South African company. Celagenix® is the responsible party (as defined in the Protection of Personal Information Act 4 of 2013, "POPIA") for the personal information described in Section 3(a) below, and acts as an operator on behalf of our Compliance Hub subscribers for the personal information described in Section 3(b).
Registered address: 4th Floor West Wing, Nelson Mandela Square, Sandton City, Sandton, Johannesburg, 2196. Phone: 012 755 5528. Contact for privacy queries: popi@celagenix.com. General product support: support@popiguard.co.za.
Key terms used in this policy (as defined in POPIA s.1): a data subject is the person to whom personal information relates — for example, you, if you use PopiGuard directly, or a resident, employee or visitor whose information your organisation processes using the Compliance Hub. A responsible party determines the purpose and means of processing personal information. An operator processes personal information for a responsible party, on that party's instruction, without determining the purpose or means itself.
This policy covers the free Snapshot Tool (quiz.popiguard.co.za), the paid POPIA Assessment (assessment.popiguard.co.za), the Compliance Hub platform (app.popiguard.co.za), and this website (popiguard.co.za). It does not cover websites we link to, including celagenix.com.
If your organisation subscribes to the Compliance Hub, it will use the platform to record its own compliance activity — for example, compliance task records, policy documents, data subject request (DSR) logs (which may include the name and email of a member of the public making a request to your organisation), and data breach incident records (which may describe categories of affected personal information, including special personal information such as biometric or health data, without necessarily identifying specific individuals). We process this information strictly on your organisation's instructions, as its operator. Your organisation remains the responsible party for this data and is responsible for having its own lawful basis to collect and process it, including under its own Privacy Notice to its residents (see Template 01 in your Policy Vault).
Some information is required for us to provide the product or service you've signed up for — for example, we cannot create a Compliance Hub account without an email address, or process the paid Assessment without payment details. Where information is required, we'll indicate this at the point of collection; if you choose not to provide it, we may not be able to provide that specific product or service, but this will never affect information your organisation is required to collect from its own residents, employees or visitors under its own Privacy Notice (Template 01 in your Policy Vault) — that is a separate matter between your organisation, as responsible party, and its own data subjects.
Where you have not already provided your details to us in the course of a sale (e.g. as an existing Compliance Hub subscriber), we will only send you direct marketing communications with your consent, as required by POPIA s.69(1). If you are an existing customer, we may send you marketing about our own similar products or services on an opt-out basis, as permitted by s.69(3) — every such email includes a way to unsubscribe. You can withdraw consent or opt out of direct marketing at any time by using the unsubscribe link in any marketing email, or by emailing popi@celagenix.com. Withdrawing consent does not affect service-related emails (e.g. task reminders, billing notices), which are not marketing.
We use the following operators to run PopiGuard. Each processes personal information only on our instruction and only to the extent needed to provide their service to us:
We do not sell personal information to any third party.
Information processed outside South Africa. Most of the operators above process information outside the Republic: Supabase hosts our database, authentication and file storage in Frankfurt, Germany; Vercel and SendGrid process information in the United States. PayFast processes payments in South Africa. For these cross-border transfers we rely on the safeguards required by POPIA section 72 — specifically binding contractual agreements with each operator that uphold principles substantially similar to POPIA's conditions for lawful processing, and that govern onward transfers. These agreements are being confirmed and executed as part of Celagenix®'s own compliance programme and are not all in place at the date of this policy.
We keep account and billing information for as long as your account is active, plus a further period required by South African tax and accounting law. Free Snapshot Tool leads are retained until you unsubscribe or ask us to delete them. Compliance Hub data you enter as an operator is retained per your organisation's own retention decisions (see your Data Retention Schedule) and is deleted or exported at your organisation's instruction on termination of your subscription.
The Compliance Hub uses row-level security so that one organisation's data is never visible to another, encrypts data in transit (HTTPS), and maintains an audit log of key account and data actions. No system is completely secure, and we cannot guarantee absolute security, but we take reasonable technical and organisational measures required by POPIA section 19 to protect the personal information we hold.
If we become aware of a security compromise affecting personal information for which we are the responsible party, we will notify the Information Regulator and affected individuals as required by POPIA section 22. Where we act as an operator for your organisation's own compliance data, we will notify your organisation promptly so it can meet its own notification duties.
Under POPIA, you have the right to:
To exercise any of these rights, contact popi@celagenix.com. If your request concerns data your HOA or scheme holds about you as a resident (rather than your relationship with Celagenix® directly), it should be directed to your HOA's own Information Officer — PopiGuard's DSR Register exists to help your HOA handle that request.
PopiGuard does not currently use any AI or automated process to generate guidance, explanations, or decisions about you. If we introduce such a feature, we will update this policy first and ensure it does not make any automated decision that produces legal or similarly significant effects concerning you without human review.
The Compliance Hub uses a strictly necessary session cookie to keep you signed in. We do not currently use analytics or marketing cookies on any PopiGuard property. If this changes, we will update this policy and, where required, ask for your consent first.
PopiGuard is a business-to-business governance tool intended for adult trustees, Information Officers and managing agents. It is not directed at children, and we do not knowingly collect personal information from children.
We may update this policy from time to time. Material changes will be notified to Compliance Hub subscribers by email.
Information Regulator (South Africa)
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
Complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Phone: 010 023 5200 (toll-free 0800 017 160)
Website: www.inforegulator.org.za