POPIA
POPIA Notice — Data Subject Rights
Last updated 21 February 2026
The Protection of Personal Information Act 4 of 2013 (POPIA) gives you specific rights over how your personal information is handled by South African businesses. Below is a plain-language summary of each right, followed by how to exercise it with Source Leak Detection.
1. Right to be notified
You have the right to be notified when we collect personal information about you — including what we collect, why we collect it, and who receives it.
2. Right to access your information
You have the right to ask us whether we hold personal information about you and, if we do, to be given a copy in a reasonable format within a reasonable time.
3. Right to correction and deletion
You have the right to request that we correct or delete personal information about you that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, obtained unlawfully, or that we are no longer authorised to retain.
4. Right to object to processing
You have the right to object, on reasonable grounds relating to your particular situation, to the processing of your personal information — unless the law provides otherwise.
5. Right to object to direct marketing
You have the right to object at any time to the use of your personal information for direct marketing, free of charge and without giving reasons.
6. Right to complain to the regulator
You have the right to lodge a complaint with the Information Regulator if you believe your personal information has been mishandled.
7. Right not to be subject to automated decision-making
You have the right not to be subject to a decision that has legal consequences for you and that is based solely on the automated processing of your personal information (subject to the exceptions in POPIA section 71).
Third-party operators and cross-border processing
Section 69 of POPIA requires us to tell you who else processes your personal information on our behalf. Section 72 requires that any transfer of your personal information to a country outside South Africa is protected by adequate legal safeguards. The operators listed below process personal information for us under written contracts that require confidentiality, purpose limitation, and data-subject-rights support equivalent to POPIA (for European operators, the EU General Data Protection Regulation applies; for United States operators, we rely on standard contractual clauses and each operator’s published data-processing terms).
| Operator | Purpose | Data categories | Country of processing |
|---|---|---|---|
| Brevo (Sendinblue SAS) | Transactional and marketing email, contact CRM, magic-link delivery | Name, email address, phone number, consent state | France (European Union) |
| Supabase Inc. | Application database, authentication, and file storage | All personal information you submit through our forms (encrypted at rest) | AWS eu-west-2 (Ireland) region |
| hCaptcha (Intuition Machines, Inc.) | Bot protection on public forms | IP address, browser fingerprint | United States |
| Google LLC — Analytics, Tag Manager and Ads | Web analytics and advertising attribution — activated only with your consent under our Consent Mode v2 implementation | IP address (anonymised), device fingerprint, page paths, event parameters | United States |
| Vercel Inc. | Application hosting and global edge network | Request metadata, IP address (short-term operational logs) | Multiple regions via edge network |
We do not sell your personal information. If we add or change a material operator in the list above, this page will be updated and the “Last updated” date at the top of this page will change.
Breach notification
POPIA section 22 requires us to notify affected data subjects and the Information Regulator as soon as reasonably possible after we become aware that your personal information has been accessed or acquired by an unauthorised person. Notifications will describe the nature of the incident, the measures taken to address it, and the steps you can take to protect yourself. In serious incidents we will act on the same day; in all cases we act no later than the timelines the Regulator sets from time to time.
How to exercise a right
Submit a request via our privacy request form. We aim to respond within 7 business days and, at the latest, within the 30 days permitted by POPIA section 23. Where we need more time or more information to verify your identity, we will tell you.
Complain to the regulator
Information Regulator (South Africa): inforegulator.org.za · complaints.IR@justice.gov.za.
Our Information Officer
Damon Pheiffer (Information Officer — identity pending confirmation with the Information Regulator) — info@sourceleakdetection.co.za · 072 899 3159. Registration of the Information Officer with the Information Regulator is currently pending; we will update this notice once the registration is finalised.