Privacy, POPIA and Cookies

Responsible party: Satchel and Boot (Pty) Ltd, South Africa.

Company registration number: 2016/465306/07.

Registered address: 2A 8th Avenue, Houghton Estate, Johannesburg, 2198.

Postal address for legal queries: Private Bag X16, Melville, Johannesburg, Gauteng, 2109.

Information Officer: Brendon Levendig, info@satchelandboot.co.za. Our Information Officer is registered with the Information Regulator.

PAIA manual and PAIA request forms: available on request at info@satchelandboot.co.za.

General contact: info@satchelandboot.co.za.

We use the information above to respond to your enquiry, clarify your needs, prepare a recommendation, and arrange a meeting where you ask for one; to enter into and perform a contract with you or your organisation, including scoping, delivery, billing and support; to operate, secure and improve this site and our services, including aggregated analytics and security monitoring; to meet our legal and regulatory obligations, including tax and financial recordkeeping and POPIA and PAIA requirements; and, where you have opted in, to send marketing, event and thought leadership communications.

We use artificial intelligence tools and third-party model providers to help process information, including in the analysis and delivery of our work. Where these process personal information, they act as our operators under written agreements that limit them to our documented instructions and require appropriate, POPIA-aligned safeguards. Some of this processing takes place outside South Africa, under the protections described in the cross-border section below. We apply purpose limitation: AI tools process only what is necessary for the specific task, and we do not use personal information to train third-party AI models without explicit consent.

This section describes processing for which we are the responsible party. It does not describe the platforms we run on behalf of clients, where the position is set by our agreement with that client and is often narrower. In particular, patient information held on TessaMed is not submitted to any artificial intelligence service at all. Section 9 explains the distinction.

South Africa has no standalone cookie statute, so we treat cookies under POPIA and ECTA and as a matter of good practice. Essential cookies are required for core functionality, security and remembering your preferences. Analytics cookies help us measure traffic and performance and improve content, in aggregate. Marketing cookies are used only if you opt in. You can accept or decline non-essential cookies through our cookie controls and change your choice at any time, and you can also manage cookies through your browser settings, though disabling essential cookies may affect how the site works.

Directly from you, through forms, email and meetings; from your organisation or colleagues when we work under a contract; and automatically from your device when you browse this site, through logs and cookies.

Most of this policy describes information we hold for our own purposes, where we decide why it is held. The Act calls that being the responsible party, and this policy is the notice we give you about it.

We also run platforms for our clients, and there the position is different. The client decides why the information is held and what may be done with it. We act only on their written instruction, we may not use the information for any purpose of our own, and this policy does not govern it. What governs it is the operator agreement between us and that client, which POPIA section 21 requires and which is more specific than any policy could be.

The distinction is not a technicality. It determines who you ask when you want to know what is held about you, who must tell you if something goes wrong, and whose obligations are engaged. The platforms we run in that capacity are these.

For TessaMed specifically, and because patients reasonably want to know: patient information is stored and processed in South Africa and is not sent out of the country. It is not submitted to any artificial intelligence service. It is not sold, is not used for marketing, and is not used to build or improve anything of ours. Every other company that sees it is named in our agreement with the practice, together with exactly what it receives, and a practice may obtain that list at any time.

If you are a patient and you want to know what is held about you, ask your practice. If you are not satisfied with the answer you may complain to the Information Regulator through inforegulator.org.za. You do not have to come to us first, and in this instance you should not, because your practice holds the record and decides what happens to it.

We do hold the business contact details of the people who work at our client organisations, so that we can administer the account and provide support. We hold those as a responsible party, and this policy governs them in the ordinary way.

Some providers, including AI and cloud providers, store or process data outside South Africa. Where this happens, we transfer personal information only as POPIA permits, using providers bound by appropriate safeguards such as contractual protections and recognised security standards, or where you have consented or the transfer is necessary to perform our contract with you.

This describes our own processing. Where we run a platform on behalf of a client, the agreement with that client governs, and it may prohibit cross-border transfer entirely. Patient information held on TessaMed does not leave the Republic of South Africa.

We apply reasonable technical and organisational measures, including access controls, encryption in transit, environment hardening, monitoring and least-privilege access. No system is completely secure. If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as POPIA section 22 requires.

Where the information affected is held on behalf of a client under section 9, the section 22 duty to notify the Regulator and the affected people is the client's, because the client is the responsible party. Our duty is to notify the client immediately and to give them everything they need to make that notification. We do not contact their patients or users ourselves unless they instruct us to.

We keep personal information only as long as necessary for the purposes above, including legal and contractual obligations. Typical periods: enquiries up to 24 months; client records for the contract term plus the applicable statutory period; billing and tax records for five to seven years or as the law requires.

Information held on behalf of a client is kept for the period that client's agreement specifies, and is returned and deleted on the terms of that agreement.

These rights are exercised against the responsible party. Where the information is held on behalf of a client under section 9, exercise them against that client, and we will assist them to answer you.

To exercise any of these, email info@satchelandboot.co.za. To reach our Information Officer or request our PAIA manual, use the same address. You can contact the Information Regulator at https://inforegulator.org.za or POPIAComplaints@inforegulator.org.za.

We send marketing or event communications only where the law allows. For electronic marketing we identify ourselves as the sender and include an opt-out in every message, in line with POPIA section 69 and the Information Regulator's Direct Marketing Guidance Note. Where required, we obtain your prior opt-in before sending electronic marketing, and we rely on the existing-customer exception only within its limits. To stop marketing at any time, use the unsubscribe link or email info@satchelandboot.co.za.

We never market to the patients, learners or users of a client platform described in section 9. Their details are not ours to use.

We do not make decisions about you based solely on automated processing.

This site and our services are intended for business use. We do not knowingly collect personal information from children under 18 without appropriate authority.

This policy governs the data-protection and confidentiality terms of our email. Our emails carry a short notice confirming that the communication is confidential and intended only for the named recipient, that it is subject to POPIA, and that our full privacy and legal terms are available on this page. Our liability is governed by our written engagement agreements, not by an email footer.

We may update this page to reflect changes to our practices or the law. The effective date shows the latest version, and material changes will be signposted on the site.