Privacy notice
In short
- We collect what you send us when you contact us, and basic technical information when you visit this website.
- We use it to reply to you and to plan the protection you asked about. We do not sell it.
- This website sets no tracking cookies.
- You can ask to see, correct or delete your information, and you can object, free of charge.
- The Protection of Personal Information Act 4 of 2013 (POPIA) applies to everything we do. If you are in Europe or the UK, the GDPR or the UK GDPR applies too.
Who we are
World Risk Global is the responsible party for your personal information, which the GDPR calls the controller. In this notice, "World Risk", "we", "us" and "our" mean World Risk Global.
| yasmin@worldrisk.co.za |
You can send a privacy request, or a request for our Information Officer, to yasmin@worldrisk.co.za.
Which laws apply
POPIA applies to all the personal information we handle in South Africa.
We also offer our services in Europe. So when you are in the European Economic Area and we offer you our services, the EU General Data Protection Regulation (GDPR) applies to that information as well (Article 3(2)). If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply in the same way.
For questions under the GDPR or the UK GDPR, email us at yasmin@worldrisk.co.za. The section "If you are in Europe or the UK" sets out your extra rights under those laws.
What we collect
When you contact us
You can reach us by email. We receive your email address, the name on your account, and whatever you tell us or send us. You choose what to tell us, but we need your email address to reply.
Please do not send sensitive information by email, such as ID numbers, bank details, health information, or private security details like routes, schedules or access codes. We will ask for what we need, in the right way, if you become our client.
When you visit this website
Our website runs on Cloudflare. Like any web server, it receives technical information each time your browser asks for a page: your IP address, the page you asked for, your browser and device type, the date and time, and security signals. Cloudflare uses this to deliver the website and protect it from attacks.
If you become our client
This notice covers this website and the enquiries we receive. If you appoint us, we will tell you in writing how we handle personal information for that work. Our PAIA manual describes the records we keep.
Why we use it and on what basis
POPIA allows us to use personal information only on a lawful basis in section 11. For visitors in Europe and the UK, the GDPR's bases in Article 6 apply as well. The table shows both.
| What we use it for | Basis under POPIA | Basis under the GDPR and UK GDPR |
|---|---|---|
| Replying to you and preparing a proposal or quote you asked for | You asked us to take these steps before any agreement (section 11(1)(b)) | Steps you asked for before a contract (Article 6(1)(b)) |
| Keeping records of our correspondence and meeting our legal duties, such as keeping tax records | Meeting a legal duty (section 11(1)(c)) and our legitimate interest in keeping accurate records (section 11(1)(f)) | Legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)) |
| Keeping the website working and secure | Our legitimate interest in a safe website that works (section 11(1)(f)) | Legitimate interests (Article 6(1)(f)) |
| Dealing with complaints and legal claims | Our legitimate interest in protecting our rights (section 11(1)(f)) | Legitimate interests (Article 6(1)(f)) |
Where we rely on our legitimate interests, you may object at any time. Where we rely on your consent, you may withdraw it at any time. See "Your rights".
We do not use your information to make automated decisions about you.
Cookies and analytics
Cookies are small text files that a website stores in your browser. We keep them to a minimum. This website sets no tracking cookies.
What this website stores in your browser
| Name | Set by | What it does | How long it lasts | When it is set |
|---|---|---|---|---|
| Your sound setting (stored in local storage, not a cookie) | This website | Your browser stores the optional sound setting on this device. It remembers whether you turned the interface sound on or off, and holds nothing about you | Until you change it or clear your browser data | When you use the sound control |
__cf_bm or cf_clearance | Cloudflare | Used for security only. Helps tell people from automated bots | __cf_bm lasts 30 minutes. cf_clearance is short-lived | Only if Cloudflare's bot protection or a security check runs |
We do not use advertising cookies, remarketing or cross-site tracking.
You can block or delete cookies in your browser settings. Blocking Cloudflare's security cookies may stop parts of the website from working.
Who receives your information
We do not sell your personal information. We share it only with the providers who help us run this website and our business, and only as much as each one needs.
| Who | What they do for us | What they receive | Where |
|---|---|---|---|
| The web developer who built this website | Fixes major faults on the website when we ask | Website technical information, only where a fix needs it | South Africa |
| Cloudflare, Inc. | Hosts and protects the website | Website technical information | Cloudflare's global network, including the United States |
| Our email provider | Hosts our email, including the emails you send us | Emails | Ask us for details |
| Our accountant, bank, insurers and legal advisers | Help with accounts, tax, insurance and legal advice | Only what each one needs | Ask us for details |
| Government bodies, courts and law enforcement | Receive information only when the law requires it | What the law requires | South Africa, or the country whose law requires it |
Our web developer and Cloudflare act only on our instructions. They must keep your information confidential and secure and tell us about any breach, as sections 20 and 21 of POPIA require.
Sending information outside South Africa
Cloudflare processes information in many countries, including the United States. Section 72 of POPIA allows us to send personal information to another country only on certain grounds. We rely on this one: Cloudflare is bound by data processing terms that protect personal information to a standard substantially similar to POPIA, including when it passes it on to others (section 72(1)(a)).
If you are in Europe or the UK and you send us your details, they come to us in South Africa, and POPIA protects them here. Neither the European Commission nor the UK has made an adequacy decision for South Africa. Where our providers process them in other countries, their data processing terms include safeguards the GDPR and UK GDPR recognise, such as the standard contractual clauses approved by the European Commission. You may ask us for a copy of the safeguards that apply.
How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires.
| Information | How long we keep it |
|---|---|
| Invoices, payment records and other accounting records | 7 years, as section 24 of the Companies Act 71 of 2008 requires |
| Cloudflare technical logs | As long as Cloudflare needs them, as its privacy policy explains |
| Your sound setting | In your browser, for the period in the cookie table above |
When a period ends, we delete or destroy the information, or remove anything that identifies you. We keep it longer only if the law requires it, if we need it for a legal claim, or if you agree.
How we protect it
We take reasonable technical and organisational steps to protect your information, as section 19 of POPIA requires. Every page of this website is served over an encrypted (HTTPS) connection with strict browser security settings. The website keeps no separate database of enquiries. Inside our business, only the people who need your information to do their work can see it.
No way of sending or storing information is completely secure. If we believe someone has gained access to your personal information without permission, we will tell the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. If you are in Europe or the UK and the law requires it, we will also tell the supervisory authority.
Direct marketing
We do not use the details you send through this website to market to you. If we ever want to, we will ask first, and we will ask only once. Every marketing message we send says it comes from World Risk and tells you how to stop more, free of charge. We will not send you marketing if you have registered a block on the National Consumer Commission's national opt-out registry.
Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, free of charge (section 23)
- ask for a copy or a description of that information, including who has had access to it (section 23)
- ask us to correct or delete information that is wrong, out of date, incomplete, misleading, excessive, irrelevant or obtained unlawfully, free of charge (section 24)
- ask us to destroy or delete information we are no longer allowed to keep, free of charge (section 24)
- object, on reasonable grounds, to our use of your information where we rely on our legitimate interests (section 11(3)(a))
- object to direct marketing at any time (section 11(3)(b))
- withdraw your consent at any time, where you gave it. This does not affect what we did before you withdrew it
- complain to the Information Regulator
If you are in Europe or the UK
Under the GDPR or the UK GDPR you also have the right to:
- ask us to restrict how we use your information while a question about it is settled (Article 18)
- receive the information you gave us, in a common electronic format, or have it sent to another organisation, where we use it on the basis of your consent or a contract (Article 20)
- object at any time to our use of your information based on our legitimate interests, and we must then stop unless we have compelling grounds (Article 21)
- complain to the data protection authority where you live or work, or where you think the law was broken (Article 77). In the UK, that is the Information Commissioner's Office, at ico.org.uk
We will answer a request under the GDPR or the UK GDPR within one month. If it is complex, we may extend that by up to two more months, and we will tell you why within the first month.
How to use your rights
Contact our Information Officer by email at yasmin@worldrisk.co.za. It is free. A clear message is enough, and if you prefer the Information Regulator's forms (Form 1 to object, Form 2 to correct or delete), we accept those too.
If you make your request orally, we will make an electronic record of your request and give you a copy, free of charge, if you ask.
We may ask you to confirm who you are before we act, so that we do not give your information to someone else. We will not ask for more than we need. Under POPIA, we will tell you in writing what we did about your request within 30 days. If a copy of your information carries a fee under POPIA, we will give you a written estimate before we do the work.
Requests for other records, and for information about someone else, fall under the Promotion of Access to Information Act. Our PAIA manual explains how to make them.
Complaints to the Information Regulator
If you are unhappy with how we handle your information, please tell us first so that we can try to put it right. You may also complain to the Information Regulator at any time.
| Regulator | Information Regulator (South Africa) |
|---|---|
| General enquiries | enquiries@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Online complaints | eservices.inforegulator.org.za |
| Website | inforegulator.org.za |
In Europe or the UK, you may complain to your data protection authority instead, as set out under "If you are in Europe or the UK".
Children
Our services are for companies and the people who run them. This website is not meant for anyone under 18, and we do not knowingly collect their information.
Links to other websites
This website links to other websites, such as the public sources behind our risk figures. When you follow a link, that website's own privacy policy applies. We do not control what it collects.
Changes to this notice
We will update this notice when the way we handle personal information changes, or when the law changes, and we will change the date at the top. The current version is always on this page.