POPIA Compliance Framework
1. Introduction
LeadWise AI (Pty) Ltd ("LeadWise AI", "we", "us", "our") is committed to protecting the privacy, confidentiality, and security of personal information processed in the course of its lead-generation and qualification business.
The right to privacy is a fundamental human right recognised in the Constitution of the Republic of South Africa. The Protection of Personal Information Act, 4 of 2013 ("POPIA") gives effect to this right by regulating how personal information is collected, processed, stored, shared, and destroyed.
LeadWise AI acknowledges its obligation to comply with POPIA and other applicable legislation and to ensure that personal information is processed lawfully, fairly, transparently, and securely.
This Compliance Framework is prepared in accordance with the POPIA Regulations (2018), which require the Information Officer to prepare, implement, monitor, and maintain a compliance framework.
2. Definitions
| Term | Definition |
|---|---|
| Data Subject | The person to whom personal information relates. |
| Deputy Information Officer (DIO) | The person to whom any power or duty conferred or imposed on an Information Officer by POPIA has been delegated. |
| Head | In relation to a private body, the chief executive officer or equivalent officer, or any person duly authorised by that officer. |
| Information Officer (IO) | The person appointed by LeadWise AI to ensure compliance with POPIA. |
| Information Regulator | The regulatory body established under POPIA to monitor and enforce compliance. |
| Operator | A third party that processes personal information on behalf of LeadWise AI in terms of a contract or mandate. |
| PAIA | Promotion of Access to Information Act, 2 of 2000. |
| Personal Information | Information relating to an identifiable, living natural person, or where applicable, an identifiable, existing juristic person. |
| POPIA | Protection of Personal Information Act, 4 of 2013. |
| Processing | Any operation concerning personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination, restriction, erasure, or destruction. |
| Responsible Party | LeadWise AI, as the entity determining the purpose of and means for processing personal information. |
| Special Personal Information | Personal information requiring additional protection under POPIA, including health data, criminal records, biometric data, race, or religious beliefs. |
3. Information Officer
3.1 Appointment
| Role | Name | Designation | Contact |
|---|---|---|---|
| Information Officer | Irfaan Sulaiman | Founder, CEO & CTO | irfaan@lead-wise-ai.com |
| Deputy Information Officer | Armina Sulaiman | COO | armina@lead-wise-ai.com |
Both officers are registered with the Information Regulator via the eServices Portal (https://eservices.inforegulator.org.za).
3.2 Duties of the Information Officer
Under POPIA Section 55, the Information Officer is responsible for:
- Ensuring the organisation complies with POPIA
- Designing, developing, implementing, and overseeing a compliance framework
- Educating the company and its staff about POPIA compliance
- Training staff involved in data processing
- Conducting regular security assessments
- Dealing with data subject access requests (DSARs)
- Reporting breaches to the Information Regulator
- Maintaining the PAIA manual
- Assisting the Information Regulator with any investigations
3.3 Deputy Information Officer
The Deputy Information Officer assists the Information Officer and acts in their absence. The DIO is the first point of contact for day-to-day privacy queries and manages the support@lead-wise-ai.com mailbox where privacy queries arrive.
4. Conditions for Lawful Processing
POPIA establishes eight conditions for lawful processing. LeadWise AI is committed to complying with all of them.
4.1 Accountability
LeadWise AI is accountable for POPIA compliance and for implementing measures to demonstrate such compliance. The Information Officer is responsible for ensuring accountability.
4.2 Processing Limitation
Personal information is processed lawfully, reasonably, and in a manner that does not infringe data subject privacy.
- Lawful basis: Contract performance, legitimate interest, consent, legal obligation
- Minimality: Only personal information that is adequate, relevant, and not excessive is collected
- Consent: Where consent is the basis, it is obtained voluntarily, specifically, and explicitly
4.3 Purpose Specification
Personal information is collected for specific, explicitly defined, and lawful purposes:
- Providing the lead qualification service
- Notifying clients when a qualification completes
- Producing reports for clients
- Meeting legal and accounting obligations
- Preventing fraud and abuse
Personal information is not kept longer than necessary. Retention periods are documented in our Data Retention Policy, available on request from the Information Officer.
4.4 Further Processing Limitation
Further processing of personal information is compatible with the purpose for which it was originally collected. Where further processing is required for a new purpose, a compatibility assessment is conducted.
4.5 Information Quality
LeadWise AI takes reasonable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary.
- Clients can update their information via the portal
- Data subjects can request correction per the DSAR Procedure
4.6 Openness
LeadWise AI maintains documentation of all processing activities and makes reasonable efforts to inform data subjects about the collection and use of their personal information.
- Privacy Policy: lead-wise-ai.com/privacy.html
- Register of Processing Activities: maintained by the Information Officer, available on request
- Notification: Data subjects are notified when their personal information is collected
4.7 Security Safeguards
LeadWise AI implements appropriate technical and organisational measures to secure the integrity and confidentiality of personal information.
Technical measures:
- Encryption in transit and at rest
- Per-client data isolation at the platform level
- Role-based access controls
- Audit logging
- Regular backup and restore testing
- Secure development practices
Organisational measures:
- Information Officer and Deputy Information Officer appointed and registered
- Staff training on POPIA
- Data Processing Agreements with all operators
- Breach notification procedure
- Access controls and segregation of duties
4.8 Data Subject Participation
Data subjects have the right to:
- Establish whether LeadWise AI holds personal information about them
- Request access to their personal information
- Request correction, deletion, or destruction of their personal information
- Object to the processing of their personal information
- Lodge a complaint with the Information Regulator
- Institute civil proceedings for damages resulting from unlawful processing
5. Privacy Policy
The Privacy Policy is a separate document published on the LeadWise AI website at lead-wise-ai.com/privacy.html. It explains:
- What personal information is collected
- Why it is collected
- The legal basis for processing
- Who it is shared with
- How long it is retained
- Data subject rights
- Security measures
- Contact details for the Information Officer
6. Data Retention Policy
Retention periods and deletion procedures are documented in the Data Retention Policy, available on request from the Information Officer.
7. Register of Processing Activities
LeadWise AI maintains a Register of Processing Activities, as required by POPIA. The Register is available on request from the Information Officer.
8. Data Subject Access Request (DSAR) Procedure
LeadWise AI maintains a documented DSAR Procedure. To make a request, contact the Information Officer at contact@lead-wise-ai.com. We respond within 30 days.
9. Breach Notification Procedure
LeadWise AI maintains a documented Breach Notification Procedure. Suspected breaches should be reported immediately to:
- Information Officer: irfaan@lead-wise-ai.com
- Deputy Information Officer: armina@lead-wise-ai.com
10. Training and Awareness
All staff, contractors, and anyone acting on behalf of LeadWise AI must be familiar with this Compliance Framework and their obligations under POPIA.
Training requirements:
- Initial POPIA awareness training on onboarding
- Annual refresher training
- Targeted training for staff handling personal information
- Documentation of training attendance
11. Data Processing Agreements
LeadWise AI enters into Data Processing Agreements (DPAs) with all operators who process personal information on its behalf. Current operators include Meta, Google, cloud infrastructure providers, database providers, and email service providers. Details are available on request from the Information Officer.
12. PAIA Manual
See lead-wise-ai.com/paia.html.
13. Personal Information Impact Assessment (PIIA)
A PIIA is conducted to ensure that adequate measures and standards exist to comply with the conditions for lawful processing. It includes:
- A systematic description of processing operations and purposes
- An assessment of necessity and proportionality
- An assessment of risks to data subjects
- Measures to address risks
The PIIA is reviewed annually and is available on request from the Information Officer.
14. POPIA Annual Monitoring Assessment
LeadWise AI submits an annual POPIA Monitoring Assessment via the Information Regulator's eServices Portal, as required.
15. Review and Maintenance
This Compliance Framework is reviewed annually or when there are material changes to:
- POPIA or related legislation
- LeadWise AI's processing activities
- The organisational structure
- Security measures
- Information Regulator guidance
The Information Officer is responsible for ensuring this review takes place.