POPIA Compliance Framework
How LeadWise AI complies with the Protection of Personal Information Act, 4 of 2013.
1. Introduction
LeadWise AI (Pty) Ltd is committed to protecting the privacy, confidentiality, and security of personal information processed in the course of its lead-generation and qualification business.
The right to privacy is a fundamental human right recognised in the Constitution of the Republic of South Africa. The Protection of Personal Information Act, 4 of 2013 (POPIA) gives effect to this right by regulating how personal information is collected, processed, stored, shared, and destroyed.
LeadWise AI acknowledges its obligation to comply with POPIA and other applicable legislation and to ensure that personal information is processed lawfully, fairly, transparently, and securely.
This Compliance Framework is prepared in accordance with the POPIA Regulations (2018), which require the Information Officer to prepare, implement, monitor, and maintain a compliance framework.
2. Definitions
Data Subject — the person to whom personal information relates.
Deputy Information Officer (DIO) — the person to whom any power or duty conferred or imposed on an Information Officer by POPIA has been delegated.
Head — in relation to a private body, the chief executive officer or equivalent officer, or any person duly authorised by that officer.
Information Officer (IO) — the person appointed by LeadWise AI to ensure compliance with POPIA.
Information Regulator — the regulatory body established under POPIA to monitor and enforce compliance.
Lead Information Notice — a plain-language notice published at /lead-information-notice.html. It sits at the point of collection and applies to LeadWise AI's own lead capture.
Operator — a third party that processes personal information on behalf of LeadWise AI in terms of a contract or mandate.
PAIA — Promotion of Access to Information Act, 2 of 2000.
Personal Information — information relating to an identifiable, living natural person, or where applicable, an identifiable, existing juristic person.
POPIA — Protection of Personal Information Act, 4 of 2013.
Processing — any operation concerning personal information, including collection, receipt, recording, organisation, storage, updating, retrieval, use, dissemination, restriction, erasure, or destruction.
Responsible Party — LeadWise AI, as the entity determining the purpose of and means for processing personal information.
Special Personal Information — personal information requiring additional protection under POPIA, including health data, criminal records, biometric data, race, or religious beliefs.
3. Information Officer
3.1 Appointment
Information Officer: Irfaan Sulaiman — Founder, CEO & CTO — [email protected]
Deputy Information Officer: Armina Sulaiman — COO — [email protected]
Both officers are registered with the Information Regulator via the eServices Portal (https://eservices.inforegulator.org.za).
3.2 Duties of the Information Officer
Under POPIA Section 55, the Information Officer is responsible for ensuring the organisation complies with POPIA, designing and overseeing a compliance framework, educating the company and its staff, training staff involved in data processing, conducting regular security assessments, dealing with data subject access requests, reporting breaches to the Information Regulator, maintaining the PAIA manual, and assisting the Information Regulator with any investigations.
3.3 Deputy Information Officer
The Deputy Information Officer assists the Information Officer and acts in their absence. The DIO is the first point of contact for day-to-day privacy queries and manages the [email protected] mailbox where privacy queries arrive.
4. Conditions for Lawful Processing
POPIA establishes eight conditions for lawful processing. LeadWise AI is committed to complying with all of them.
4.1 Accountability
LeadWise AI is accountable for POPIA compliance and for implementing measures to demonstrate such compliance. The Information Officer is responsible for ensuring accountability.
4.2 Processing Limitation
Personal information is processed lawfully, reasonably, and in a manner that does not infringe data subject privacy. Lawful basis: contract performance, legitimate interest, consent, legal obligation. Minimality: only personal information that is adequate, relevant, and not excessive is collected. Consent: where consent is the basis, it is obtained voluntarily, specifically, and explicitly.
4.3 Purpose Specification
Personal information is collected for specific, explicitly defined, and lawful purposes: providing the lead qualification service, notifying clients when a qualification completes, producing reports for clients, meeting legal and accounting obligations, and preventing fraud and abuse. Personal information is not kept longer than necessary.
4.4 Further Processing Limitation
Further processing of personal information is compatible with the purpose for which it was originally collected. Where further processing is required for a new purpose, a compatibility assessment is conducted.
4.5 Information Quality
LeadWise AI takes reasonable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary. Clients can update their information via the portal. Data subjects can request correction.
4.6 Openness
LeadWise AI maintains documentation of all processing activities and makes reasonable efforts to inform data subjects about the collection and use of their personal information. The Privacy Policy is published on the website. The Lead Information Notice is published at /lead-information-notice.html, referenced by the Privacy Policy, and linked from every lead capture point. The Register of Processing Activities is maintained by the Information Officer. Data subjects are notified when their personal information is collected.
4.7 Security Safeguards
LeadWise AI implements appropriate technical and organisational measures to secure the integrity and confidentiality of personal information.
Technical measures: encryption in transit and at rest, per-client data isolation at the platform level, role-based access controls, audit logging, regular backup and restore testing, and secure development practices.
Organisational measures: Information Officer and Deputy Information Officer appointed and registered, staff training on POPIA, Data Processing Agreements with all operators, breach notification procedure, and access controls and segregation of duties.
4.8 Data Subject Participation
Data subjects have the right to establish whether LeadWise AI holds personal information about them, request access to their personal information, request correction, deletion, or destruction of their personal information, object to the processing of their personal information, lodge a complaint with the Information Regulator, and institute civil proceedings for damages resulting from unlawful processing.
5. Privacy Policy
The Privacy Policy is a separate document published on the LeadWise AI website. It explains what personal information is collected, why it is collected, the legal basis for processing, who it is shared with, how long it is retained, data subject rights, security measures, and contact details for the Information Officer.
6. Lead Information Notice
The Lead Information Notice is a separate document published at /lead-information-notice.html.
It is a plain-language notice specifically for prospects who submit information through contact forms, chatbots, and demo flows. It is referenced from the Privacy Policy and linked from all lead capture points on the website.
It provides the legal coverage for LeadWise AI's own lead capture. It does not apply to leads processed on behalf of a paying client. Those are governed by the client's Service Level Agreement and Data Processing Agreement.
It is published as a draft, subject to attorney review.
7. Data Retention Policy
LeadWise AI retains personal information only for as long as necessary for the purpose for which it was collected, or as required by law. The full retention schedule is maintained in the Data Retention Policy.
8. Register of Processing Activities
The Register documents all processing activities carried out by LeadWise AI, as required by POPIA. It is maintained by the Information Officer and reviewed annually or when processing activities change.
9. Data Subject Access Request (DSAR) Procedure
Data subjects may request access to, correction of, or deletion of their personal information. Requests are handled in accordance with POPIA within 30 days. The full procedure is maintained by the Information Officer.
10. Breach Notification Procedure
In the event of a confirmed data breach, LeadWise AI notifies the Information Regulator as soon as reasonably possible, and affected data subjects where the breach poses a high risk to their rights and freedoms. The full procedure is maintained by the Information Officer.
11. Training and Awareness
All staff, contractors, and anyone acting on behalf of LeadWise AI must be familiar with this Compliance Framework and their obligations under POPIA.
Training requirements: initial POPIA awareness training on onboarding, annual refresher training, targeted training for staff handling personal information, and documentation of training attendance.
Internal awareness sessions: held as required to communicate POPIA provisions, regulations, codes of conduct, and any guidance from the Information Regulator.
12. Data Processing Agreements
LeadWise AI enters into Data Processing Agreements with all operators who process personal information on its behalf.
Current operators: Meta (messaging platform — WhatsApp, Messenger, Instagram), TikTok (messaging channel), Google (authentication, Cloud Run hosting, Gemini AI validation), Neon (managed Postgres database), and Zoho (email and invoicing).
13. PAIA Manual
The PAIA Manual is maintained by the Information Officer and is available on request. It sets out the categories of records held by LeadWise AI, how to request access, the fees payable, and the grounds for refusal.
14. Personal Information Impact Assessment (PIIA)
A PIIA is conducted to ensure that adequate measures and standards exist to comply with the conditions for lawful processing. It includes a systematic description of processing operations and purposes, an assessment of necessity and proportionality, an assessment of risks to data subjects, and measures to address risks. The PIIA is maintained by the Information Officer.
15. POPIA Annual Monitoring Assessment
The POPIA Annual Monitoring Assessment is a structured self-assessment submitted via the Information Regulator's eServices Portal.
Status: Pending — deferred until compliance documentation is finalised.
16. Review and Maintenance
This Compliance Framework is reviewed annually or when there are material changes to POPIA or related legislation, LeadWise AI's processing activities, the organisational structure, security measures, or Information Regulator guidance. The Information Officer is responsible for ensuring this review takes place.
17. Contact
For any questions about this Compliance Framework or LeadWise AI's data practices:
Information Officer: Irfaan Sulaiman — [email protected]
Deputy Information Officer: Armina Sulaiman — [email protected]
General contact: [email protected] · +27 78 97 99 397
Postal address: Unit 289, 243 Forest Drive Extension, Pinelands, Cape Town, Western Cape, 7405, South Africa.