Effective Date: April 2025
- Introduction
Flowtrack is committed to processing personal information lawfully, responsibly, and transparently in accordance with the Protection of Personal Information Act, 4 of 2013.
This POPIA Policy explains how Flowtrack collects, uses, stores, secures, and manages personal information through www.flowtrack.co.za and in the course of its business activities.
This policy must be read together with the Privacy Policy, Cookie Policy, Terms and Conditions, and any applicable service agreements, quotations, proposals, or client contracts.
- Responsible Party Details
Flowtrack is the responsible party for personal information processed through its website and business operations, unless otherwise stated.
Business name: Flowtrack
Registration number: 2025/324322/07
Email address: info@flowtrack.co.za
Telephone: +27 72 803 3175
Location: Johannesburg, South Africa
Website: www.flowtrack.co.za
- Purpose of This Policy
The purpose of this policy is to:
set out how Flowtrack processes personal information,
confirm Flowtrack’s commitment to POPIA compliance,
describe the rights of data subjects,
outline the measures taken to safeguard personal information,
explain how requests, complaints, objections, corrections, and access requests may be made.
- What POPIA Protects
POPIA is intended to promote the protection of personal information processed by public and private bodies and to establish minimum requirements for lawful processing. The Information Regulator is the body responsible for monitoring and enforcing compliance.
For purposes of this policy, personal information includes information relating to an identifiable natural person and, where applicable, an identifiable juristic person.
- Categories of Personal Information We May Process
Flowtrack may process the following categories of personal information:
name and surname,
email address,
telephone number,
company name,
job title or role,
billing details,
physical or postal address,
website usage information,
IP address and browser data,
project information, tender information, commercial information, and submitted records,
communications sent through forms, email, phone, WhatsApp, or other channels.
Where necessary and lawful, Flowtrack may also process records, files, and documents provided by clients or potential clients for the purpose of delivering requested services.
- How Personal Information Is Collected
Flowtrack may collect personal information:
directly from you,
when you complete a website form,
when you send an email or make contact,
when you request a quotation or service,
when you purchase a product or download a resource,
when you interact with the website through cookies or analytics tools,
from third-party service providers involved in payment, hosting, security, analytics, or administration.
- Purpose for Processing Personal Information
Flowtrack processes personal information only for specific, legitimate, and lawful business purposes, including:
responding to enquiries,
providing services and products,
preparing quotations, proposals, and agreements,
processing payments and invoices,
delivering digital resources,
administering client relationships,
complying with legal and contractual obligations,
maintaining internal business records,
improving website functionality and performance,
sending service-related communications,
sending direct marketing where permitted by law.
- Conditions for Lawful Processing
Flowtrack aims to comply with the applicable POPIA conditions for lawful processing of personal information, including:
accountability,
processing limitation,
purpose specification,
further processing limitation,
information quality,
openness,
security safeguards,
data subject participation.
- Lawful Grounds for Processing
Flowtrack will process personal information where one or more lawful grounds apply, including where:
the data subject has consented,
processing is necessary to conclude or perform a contract,
processing complies with a legal obligation,
processing protects a legitimate interest of the data subject,
processing is necessary for pursuing the legitimate interests of Flowtrack or a third party in a manner permitted by law.
- Special Personal Information
Flowtrack does not intend to process special personal information unless this is lawful, strictly necessary, and permitted under POPIA.
Special personal information includes categories such as religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, and criminal behaviour, subject to the terms of POPIA. POPIA and the Information Regulator provide separate rules and guidance for such processing.
If special personal information must be processed, Flowtrack will do so only where an applicable legal basis exists and, where required, after obtaining any necessary authorisation.
- Information Quality
Flowtrack will take reasonably practicable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary, having regard to the purpose for which it is processed. POPIA places a specific obligation on responsible parties regarding information quality.
- Openness and Notification
Where personal information is collected, Flowtrack will take reasonably practicable steps to notify the data subject of the collection and the matters required by law, including the purpose of collection and whether supply of the information is voluntary or mandatory where applicable. The POPIA Regulations also address notification obligations in support of section 18.
- Security Safeguards
Flowtrack will take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information and unlawful access to or processing of personal information.
These safeguards may include:
secure hosting,
password protection,
controlled access,
anti-malware and anti-spam tools,
software updates,
document access control,
limited access to information on a need-to-know basis.
- Retention and Restriction of Records
Flowtrack will not retain personal information longer than necessary to achieve the purpose for which it was collected, unless retention is required or permitted by law, contract, or legitimate operational need. POPIA contains rules on retention and restriction of records.
When information is no longer required, Flowtrack will delete, destroy, de-identify, or anonymise it where reasonably practicable and lawful.
- Direct Marketing
Flowtrack may use personal information for direct marketing only where permitted by POPIA and other applicable laws.
Where required, consent will be obtained before sending direct marketing by electronic communication. The Information Regulator has issued guidance on direct marketing under POPIA, including consent and opt-out requirements.
You may opt out of direct marketing at any time by using the unsubscribe option or by contacting info@flowtrack.co.za.
- Sharing of Personal Information
Flowtrack does not sell personal information.
Personal information may be shared with third parties where reasonably necessary for business operations, including:
hosting providers,
payment processors,
cloud storage providers,
website maintenance providers,
analytics and security providers,
accountants, attorneys, or professional advisers,
regulators, courts, law enforcement, or public authorities where disclosure is legally required.
Where personal information is shared with operators or service providers, Flowtrack will take reasonable steps to ensure that such parties maintain confidentiality and appropriate safeguards.
- Cross-Border Transfers
Personal information may be stored or processed outside South Africa where Flowtrack uses service providers or technology platforms located in other jurisdictions.
POPIA regulates cross-border transfers and permits them in specified circumstances, including where the recipient is subject to laws, binding corporate rules, or a binding agreement that provide an adequate level of protection, where the data subject consents, where the transfer is necessary for contract performance, or where the transfer benefits the data subject in certain circumstances.
Flowtrack will take reasonable steps to ensure that any cross-border transfer is lawful and appropriately protected.
- Data Subject Rights
Under POPIA, data subjects have rights that include the right to:
be notified that personal information is being collected,
request confirmation of whether personal information is held,
request access to personal information,
request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained,
object to certain processing,
lodge a complaint with the Information Regulator.
Requests for correction or deletion are addressed in POPIA and the Regulations, and the Information Regulator provides forms for these requests.
- Requests for Access, Correction, Deletion, or Objection
A data subject who wishes to exercise any applicable POPIA or PAIA right may submit a written request to:
Email: info@flowtrack.co.za
The request should contain enough information to identify the requester and the nature of the request. Flowtrack may request proof of identity before acting on the request.
Where applicable, requests may also need to follow the procedures set out in the relevant PAIA Manual and prescribed forms. The Information Regulator publishes PAIA guidance and POPIA-related forms for access, correction, deletion, objection, and complaints.
- Information Officer
POPIA requires Information Officers of private bodies to register with the Information Regulator in order to perform their duties and responsibilities under POPIA.
Flowtrack will ensure that its Information Officer responsibilities are assigned and managed in accordance with applicable law.
Suggested internal placeholder for publication:
Information Officer: Vernon Fenner
Email: info@flowtrack.co.za
- Personal Information Breaches
If Flowtrack becomes aware of a security compromise involving personal information, it will take steps required by law, including investigation, containment, and notification where required.
- Complaints
If you believe that your personal information has been processed unlawfully or in breach of this policy, you may first contact Flowtrack at info@flowtrack.co.za so that the matter may be addressed.
You also have the right to lodge a complaint with the Information Regulator. The Information Regulator provides complaint and assessment procedures under POPIA.
- Updates to This Policy
Flowtrack may amend this POPIA Policy from time to time.
Any updated version will be published on the website with a revised effective date. Continued use of the website or services after publication of the revised version will constitute acceptance of the updated policy to the extent permitted by law.
- Contact Details
Flowtrack
Email: info@flowtrack.co.za
Phone: +27 72 803 3175
Website: www.flowtrack.co.za
Location: Johannesburg, South Africa