Privacy Policy

POPIA, the Protection of Personal Information Act 4 of 2013, governs how Compound Bridge (Pty) Ltd handles the personal information it receives through this website. This notice says what we collect, why, and what you can ask us to do about it.

1. The responsible party

Compound Bridge (Pty) Ltd, registration number 2021/693707/07, of 386A Grant Avenue, Eldoraigne, Centurion, Gauteng, South Africa.

A responsible party decides why personal information is collected and what is done with it. Below, "we" means that company.

2. Information officer

POPIA requires us to register an information officer with the Information Regulator.

• Name: Reg Bath
• Email: reg@compoundbridge.com
• Address: 386A Grant Avenue, Eldoraigne, Centurion, Gauteng, South Africa

Write to the information officer about your personal information, or to complain about how we have handled it.

3. What we collect

The enquiry form collects your full name, organisation, role or title, work email, telephone, country of operation, nature of enquiry and message. Name, email, nature of enquiry and message are required; the rest is optional. We also record your consent tick, the consent wording version and the time of sending.

The message body is not logged. It is held only long enough to send the enquiry and email you a copy. The server record holds your name, work email address, nature of enquiry, consent version, time and hashed IP address, but not your message, telephone, role, organisation or country.

The site stores a hash of your IP address rather than the address, keyed with a secret held on the server, so it cannot be read back. We use it to rate-limit the form and to reject automated submissions.

This site sets no advertising or analytics cookies and runs no third-party tracking.

The hosting provider keeps standard web server access logs, which may include a visitor's IP address. The provider controls them, not us.

4. Why we process it, and the lawful basis

We use enquiry information for four purposes, each on a basis POPIA allows:

1. Answering your enquiry and corresponding with you. Basis: your consent (s11(1)(a)).
2. Keeping a record that you consented. Basis: POPIA puts the burden of proving consent on us.
3. Protecting the site and mailbox from abuse. Basis: our legitimate interest in keeping both usable.
4. Keeping a business record of enquiries. Basis: our legitimate interest, or performance of a contract where the enquiry proceeds.

Giving us your information is voluntary. No law requires you to send us an enquiry, and the required fields are required only because we cannot answer without them. Leave one out, or leave the consent box unticked, and the form will not send; you can email hello@compoundbridge.com instead.

No law requires you to give us this information, and none requires us to collect it. POPIA governs how we may handle it once you do.

5. How long we keep it

We keep enquiry information for 12 months. POPIA forbids keeping it longer than we need it, so the enquiry and its consent record are deleted together when that period ends. If an enquiry becomes an engagement, that file is kept under the engagement agreement instead.

6. Who else sees it

We do not sell personal information or share it for anyone else's marketing. Two suppliers process it on our instruction, making them operators under POPIA: Microsoft, which provides the Microsoft 365 mailbox that enquiries arrive in and are answered from, and the hosting provider that serves this site.

The form delivers by email through Microsoft 365, so Microsoft may store that email, and the acknowledgement sent to you, on servers outside South Africa. That is a transfer out of the country, and POPIA restricts it (s72). POPIA allows it only where the recipient protects the information to a standard substantially similar to POPIA's. We rely on the Microsoft agreement, which requires Microsoft to protect what it processes for us. No other part of this site sends personal information abroad.

7. Security

The enquiry handler runs over an encrypted connection, and mail leaves it over an encrypted SMTP connection with certificate verification on. The accountability log is closed to the web and readable only by the server account, which is separate from the mailbox credentials. Access to the mailbox and server is limited to those who need it.

No system is perfectly secure. If a compromise affects your information, we will tell you and the Information Regulator as soon as reasonably possible.

8. Marketing

Sending an enquiry does not put you on a marketing list. POPIA does not allow us to send you marketing email without prior consent, and we do not treat an enquiry as consent. If you do consent, every message will offer a way to stop it.

9. Children

This site is aimed at organisations, not at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us information, write to the information officer.

10. Your rights as a data subject

POPIA gives you these rights over the information in this notice:

• to be told when we collect your information and what we do with it, and if it is accessed or acquired by someone unauthorised;
• to ask what we hold about you and request a record of it (s23), through the Access to Information Act procedure, which sets the form and any fee;
• to ask us to correct, delete or destroy information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained, or kept too long (s24);
• to object to our processing on reasonable grounds, where the law does not require it (s11(3)(a)), to object at any time to marketing (s11(3)(b)), and to withdraw your consent at any time (s11(2)(b));
• to complain to the Information Regulator (s74).

Write to the information officer to use any of these. We may ask you to prove your identity first, and we will name and help you complete any prescribed form.

11. How to complain

Write to the information officer first, using the details in section 2. We will reply within two working days, and say what we are doing if the matter is not settled by then. You may also complain to the Information Regulator (South Africa); we would rather put it right first, but the choice is yours.

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone: 010 023 5200
• Toll free: 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

Complaints are lodged on the Regulator's prescribed complaint form (Form 5).

12. Changes to this policy

We date each version. If a change affects information we already hold, we will tell the people affected by email.

13. Effective date

This version takes effect on 1 September 2026.