POPIA Privacy Notice

Protection of Personal Information Act, 2013 (Act No. 4 of 2013)

Thekgang Directory Platform

Last Updated: 13 October 2026

1. Introduction

Thekgang is a non-profit company (NPC) dedicated to supporting and growing South Africa’s book manufacturing, publishing, and distribution industry. This Privacy Notice explains how we collect, use, share, and protect your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA).

POPIA gives effect to the constitutional right to privacy and regulates how organisations process personal information . As a responsible party, Thekgang is committed to ensuring that your personal information is processed lawfully, transparently, and with respect for your rights.

2. Who We Are

Responsible Party: Thekgang NPC

Registered Address: The Rand Club, Office 5, 4th Floor, 33 Loveday Str, Marshalltown, JNB, 2109

Information Officer Contact: info@thekgang.org.za

Information Regulator Contact:
The Information Regulator (South Africa)
Website: https://inforegulator.org.za
Complaints Email: complaints.IR@justice.gov.za

3. Personal Information We Collect

We collect the following categories of personal information:

From Directory Subscribers (Service Providers):

Full name and surname
Organisation/business name
Business registration number (where applicable)
Email address
Telephone number
Physical address
Portfolio samples and proof documentation
Service category and description
B-BBEE status (where voluntarily provided)
Geographic coverage area

From Website Visitors:

IP address
Browser type and version
Device information
Pages visited and time spent
Referral source
Cookie identifiers (where consent is provided)

From Board Members and Staff:

Identity numbers
Tax numbers
Banking details
Employment history
Qualifications

4. Purpose of Processing

We process personal information for the following specific, explicitly defined purposes:

Directory Listing Management: To create, publish, and maintain your directory listing so the public can find and contact you.
Verification and Vetting: To verify your credentials and issue a “Verified Badge” in accordance with our category-specific checklists.
Sector Mapping and Advocacy: To compile anonymised, aggregated data on service availability and gaps in the book value chain for reporting to the Department of Sport, Arts and Culture and other stakeholders.
Communication: To notify you about your submission status (approved, declined, or more information required) and to send administrative updates.
Platform Improvement: To analyse usage patterns and improve the user experience of the Directory.
Legal Compliance: To comply with applicable laws, including POPIA, the Copyright Act 98 of 1978, and other relevant legislation.
Governance and Administration: To manage Board membership, staff employment, and organisational operations.

5. Lawful Basis for Processing

We process personal information based on one or more of the following lawful grounds under Section 11 of POPIA:

Consent: You have given voluntary, specific, and informed consent for processing (for example, by submitting a directory listing or subscribing to communications) .
Contract: Processing is necessary to perform a contract with you (for example, to publish your directory listing).
Legal Obligation: Processing is required to comply with a law (for example, tax reporting or employment equity requirements).
Legitimate Interest: Processing is necessary for our legitimate interests as an NPC promoting sector development, balanced against your rights and privacy .
Public Interest: Processing serves a public interest (mapping and strengthening South Africa’s book value chain).

6. Disclosure of Personal Information

We may share your personal information with:

The Public: Your directory listing (name, service type, contact details, portfolio) is visible to the public.
Government Departments: Anonymised, aggregated sector data may be shared with the Department of Sport, Arts and Culture and other relevant bodies for advocacy and reporting.
Service Providers (Operators): Third-party service providers who assist us with hosting, security, analytics, and communication, subject to written operator agreements as required by POPIA .
Legal Authorities: Where required by law, court order, or to protect our legal rights.

We do not sell your personal information to third parties.

7. Cross-Border Transfers

If we transfer personal information to a foreign country, we will ensure that:

The recipient is subject to a law, binding corporate rules, or agreement providing adequate protection substantially similar to POPIA ;
You have consented to the transfer; or
The transfer is necessary for the performance of a contract with you.

8. Security Safeguards

We implement appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information, including :

SSL encryption for all data transmissions
Firewall protection and malware scanning (Wordfence)
Regular backups (UpdraftPlus)
Access controls limiting who can view personal information
Staff and Board training on data protection

In the event of a security compromise, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, including a description of the breach, measures taken, and recommendations for protection .

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law . Our standard retention periods are:

Active Directory Listings: While your listing remains active and for 12 months thereafter.
Declined Submissions: 6 months after the decision date.
Verification Documentation: 24 months after verification.
Employment Records: As required by the Basic Conditions of Employment Act and tax laws.
Website Analytics: 26 months.

After the retention period, personal information is securely deleted or de-identified.

10. Your Rights as a Data Subject

Under POPIA, you have the right to :

Be Notified: To be informed when your personal information is collected and for what purpose.
Access: To request confirmation of whether we hold personal information about you and to receive a copy.
Correction: To request correction of inaccurate, misleading, or outdated personal information.
Deletion: To request deletion or destruction of personal information that we are no longer authorised to retain.
Object: To object, on reasonable grounds, to the processing of your personal information.
Withdraw Consent: Where processing is based on consent, to withdraw your consent at any time.
Lodge a Complaint: To submit a complaint to the Information Regulator.
Not be Subject to Automated Decisions: To not be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of these rights, contact our Information Officer at privacy@thekgang.org.za. We will respond within 30 days .

11. Cookies and Tracking

We use cookies and similar technologies to:

Remember your preferences
Analyse site traffic and usage patterns
Improve the performance of the Directory

When you first visit our site, you will be presented with a cookie consent banner. You may accept or reject non-essential cookies. You can also manage cookie preferences through your browser settings. POPIA treats cookie identifiers as personal information where they can identify an individual .

12. Direct Marketing

We will only send you electronic direct marketing communications (such as newsletters or event invitations) if:

You have provided explicit consent (opt-in) ; or
You are an existing customer, and we are marketing our own similar products or services, and you have been given an opportunity to object.

Every marketing communication will include an unsubscribe link, and you may opt out at any time free of charge.

13. Children’s Personal Information

We do not knowingly collect personal information from children under 18 without the consent of a competent person (parent or legal guardian). If we become aware that we have collected a child’s personal information without consent, we will delete it promptly .

14. Special Personal Information

We do not generally process special personal information (such as race, health, religious beliefs, or biometric data). If we need to process such information for sector reporting (for example, B-BBEE statistics), we will obtain explicit consent or rely on a lawful basis permitted under POPIA .

15. Changes to This Notice

We may update this Privacy Notice from time to time. The “Last Updated” date at the top indicates when changes were made. We encourage you to review this notice periodically.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Notice or your personal information:

Information Officer
Thekgang NPC
Email: privacy@thekgang.org.za

For Complaints Escalation:
The Information Regulator (South Africa)
Website: https://inforegulator.org.za
Complaints Email: complaints.IR@justice.gov.za

17. PAIA Manual

In accordance with the Promotion of Access to Information Act, 2000 (PAIA), Thekgang maintains a PAIA Manual, which is available on request. The PAIA Manual outlines how to request access to records held by Thekgang .

PAIA Requests: info@thekgang.org.za

This Privacy Notice is designed to comply with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013). It should be read together with our Terms & Conditions and Submission Guidelines.