A privacy policy is a public statement of what personal information you collect, why, what you do with it, and what rights people have to control it. Under POPIA you must have one, link it from every page that collects info, and keep it accurate.
The 7 sections every POPIA privacy policy needs
- Who you are. Your registered business name, trading name, address and contact e-mail.
- What information you collect. List the categories: contact details (name, e-mail, phone), order details, payment info, browsing data via cookies, IP address, etc.
- How you collect it. Forms on the website, e-mails, phone calls, cookies, third-party trackers (Google Analytics).
- Why you collect it. The lawful basis: consent, contract performance, legitimate interest, legal obligation. Be specific - "to send you a quote", "to deliver your order", "to comply with SARS reporting".
- Who you share it with. Your hosting provider, payment processor, courier, e-mail platform, accountant. Each one is a separate "operator" that must also comply with POPIA.
- How long you keep it. Different categories have different retention rules. Order info typically 5+ years for tax. E-mail subscriber lists until they unsubscribe.
- What rights people have. The right to ask what you hold, to correct it, to ask you to delete it, to opt out of marketing, to complain to the Information Regulator. Include the e-mail address they should use to exercise these rights.
What NOT to do
- Do not copy a generic template verbatim. Most templates were written for GDPR and may not match how you actually run your business.
- Do not be vague. "We may share your data with our partners" is meaningless. Name them.
- Do not bury it. The link must be visible in the footer of every page.
- Do not forget to update it when you add a new tracker, change processors, or start collecting a new category of data.
Quick start
If you do not have a privacy policy yet, the Information Regulator publishes a free template at inforegulator.org.za. Adapt it to your business in plain language. We strongly recommend having a lawyer review the final version before publishing.
Talk to us about POPIA hosting needs Get us to add it to your site
Need a hand?
The Trinico Cloud team is in South Africa and replies during local business hours. Reach us via WhatsApp, e-mail or a support ticket - whichever suits you best.
