POPIA Privacy Notice

This notice explains how Nandisa Psychological Consultancy ("NPC") handles personal information under the Protection of Personal Information Act, 2013 ("POPIA").

1. Responsible party and contact details

NPC is the responsible party that determines why and how personal information is processed for its assessment, payment, delivery, accounting, and support services.

2. Personal information we process

Depending on your interaction with NPC, we may process your name, email address, contact and support messages, assessment selected, payment status and transaction reference, invoice or accounting records, device and technical logs, and assessment responses, scores, results, or related professional notes. For an assessment involving a child, this may include the child's information and details showing the authority of a parent, guardian, or professionally authorised person.

3. Why we process it

We process personal information to confirm eligibility and consent, take and verify payment, provide secure assessment access, administer and deliver assessments and results, communicate service and recovery information, respond to support requests, maintain clinical, professional, accounting, and legal records, secure and improve our systems, and comply with applicable law and professional duties.

4. Operators and service providers

NPC uses third-party operators for specific functions: Paystack for payment processing and transaction verification; Firebase for website hosting, server functions, and related technical logs; Resend for transactional email delivery; and Typeform for assessment administration and response handling. Banks, accountants, professional advisers, regulators, or authorities may also receive information where necessary or legally required.

5. Cross-border processing

Paystack, Firebase, Resend, Typeform, or their infrastructure providers may process or store information outside South Africa. NPC will use providers and safeguards intended to provide protection consistent with POPIA, including contractual, organisational, and technical safeguards where appropriate.

6. Retention

Payment, accounting, and support records are retained for five years unless a longer period is required for an active dispute or by law. Assessment responses and results are retained for at least six years, subject to applicable professional, ethical, clinical, and legal requirements. Information is deleted, anonymised, or securely disposed of when it is no longer required.

7. Security and multi-system handling

NPC applies reasonable technical and organisational safeguards appropriate to the information and risk, including controlled access, secure payment verification, restricted assessment delivery, service-provider controls, and incident handling. No internet service can guarantee absolute security. A transaction or assessment may create related records across NPC systems, Typeform, Paystack, Resend, and Firebase.

8. Your rights and deletion requests

Subject to POPIA and other applicable requirements, you may ask whether NPC holds your information, request access or correction, object to certain processing, withdraw consent where consent is the legal basis, request deletion or restriction, and complain about processing. Identity or authority may need to be verified before a request is actioned.

Deletion is not automatic or absolute. NPC may retain information required by law, professional rules, accounting duties, safeguarding obligations, legal claims, or other permitted purposes. Where deletion is available, NPC will coordinate reasonable action across its own records and relevant Typeform, Paystack, Resend, and Firebase records; each provider may retain limited records under its own legal obligations.

9. Complaints

Raise a concern first with the Information Officer at admin@nandisapc.co.za. You may also lodge a complaint with South Africa's Information Regulator using the regulator's published complaint channels.

10. Changes to this notice

NPC may update this notice when its services, providers, or legal obligations change. The production notice should state its effective date after legal approval.