1. Purpose of this notice
Shaun Gregory Consulting ("SGC") respects the privacy of clients, prospective clients, website visitors and other people who communicate with the business. This notice describes the personal information SGC may process, why it is processed, how it is protected and the choices available to data subjects.
The notice is intended to support SGC's obligations under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It should be read together with the Website Terms of Use.
2. Information currently handled through the website
The current website does not require visitors to create an account. Depending on how a visitor chooses to interact with SGC, the business may receive:
- name, company name, telephone number, email address or other contact details supplied during a direct enquiry;
- the content of messages sent through WhatsApp, LinkedIn, email or another agreed communication channel;
- information voluntarily supplied when discussing a commercial requirement, project, market, opportunity or consultation;
- a summary of a Commercial Growth Diagnostic result if the visitor chooses to send that result to SGC; and
- technical information reasonably required for the secure operation and delivery of the website.
2A. Consultation request storage
When the server-side enquiry service is configured, information submitted through the Book a Consultation form may be stored in SGC's enquiry and CRM database for the purpose of responding, tracking follow-up, maintaining an enquiry history and managing the resulting business relationship.
The record may include the contact and company details supplied, the commercial priority, requested consultation timing, enquiry source and campaign attribution, and a Commercial Growth Diagnostic summary where the visitor chooses to carry that result into the consultation request.
3. Commercial Growth Diagnostic
The Commercial Growth Diagnostic is designed so that answers and results remain in the visitor's browser session while the assessment is being used. The diagnostic does not ask for a name, email address or other direct identifier.
If the visitor proceeds to the Contact page after completing the diagnostic, a result summary may remain temporarily available in that same browser session. The result is not transmitted to SGC merely because the Contact page is opened. If the visitor chooses to send the pre-filled WhatsApp message, the diagnostic summary included in that message is then transmitted through WhatsApp.
4. Why SGC may process personal information
Personal information may be processed where reasonably necessary to:
- respond to an enquiry or consultation request;
- understand a business requirement and determine whether SGC can assist;
- prepare, administer and deliver agreed consulting, marketing, digital, research or related services;
- maintain appropriate client, enquiry and project records;
- manage follow-up communication connected to an existing enquiry or business relationship;
- protect the website, SGC systems and legitimate business interests; and
- comply with applicable legal, regulatory, accounting or record-keeping obligations.
Where POPIA requires a lawful justification, processing may depend on consent, steps connected to concluding or performing a contract, compliance with a legal obligation, or legitimate interests recognised by POPIA.
5. Direct marketing and automated follow-up
An enquiry or consultation request does not automatically amount to consent to receive unrelated electronic marketing. If SGC introduces newsletters, marketing automation or other electronic direct-marketing activity, the relevant consent, existing-customer rules and opt-out requirements will be applied as required by POPIA.
Transactional or service-related messages may still be sent where reasonably required to respond to an enquiry, confirm a consultation, deliver requested information or manage an existing business relationship.
6. Service providers and third-party platforms
SGC may use service providers for functions such as website hosting, domain services, email, customer relationship management, document storage, analytics or other business systems. Providers should receive only the information reasonably required for their role and should be selected and managed with appropriate privacy and security considerations.
WhatsApp and LinkedIn are third-party services. When a visitor chooses to use those services, the provider's own privacy terms and platform rules also apply.
7. Cross-border processing
Some cloud or technology providers may process or store information outside South Africa. Where cross-border processing occurs, SGC will take reasonable steps to use appropriate providers and safeguards consistent with POPIA's requirements for transfers of personal information outside the Republic.
8. Retention
SGC will retain personal information only for as long as it is reasonably required for the purpose for which it was obtained, an ongoing business relationship, legitimate record-keeping needs or applicable law. Information that is no longer required should be deleted, destroyed or de-identified where appropriate.
Diagnostic information held only in browser session storage is intended to remain local to that browser session unless the visitor elects to send a result summary to SGC.
9. Information security
SGC will take reasonable technical and organisational measures appropriate to the nature of the information and the systems in use. No internet or electronic system can be guaranteed to be completely secure, but access, storage and service-provider arrangements should be managed with reasonable safeguards.
10. Your POPIA rights
Subject to POPIA and other applicable law, a data subject may have rights to request confirmation of whether personal information is held, request access, request correction or deletion where appropriate, object to certain processing, withdraw consent where processing depends on consent, and raise a complaint with the Information Regulator.
Requests relating to personal information can be initiated through the SGC Contact page. SGC may need to verify identity before releasing, correcting or deleting information.
11. Cookies, analytics and future integrations
The current build does not intentionally rely on non-essential marketing cookies as a condition of using the website. SGC is planning additional CRM, email, analytics, SEO and reporting integrations. This notice and any required consent controls must be reviewed before those systems are placed into production.
12. Contact and complaints
Questions or requests concerning this notice can be directed to SGC through theContact page. A professional connection can also be made throughLinkedIn.
A data subject also has the right to approach the Information Regulator of South Africa regarding POPIA or PAIA matters.
13. Changes to this notice
This notice may be updated as the website, CRM, booking, email, analytics or other business systems change. The "Last updated" date on this page identifies the current version.