Privacy Policy

1. Who we are

Andisa Advisory (Pty) Ltd ("Andisa", "we", "our") operates this website and the CPD workshops, short courses, and seminars listed on it. We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

Entity	Andisa Advisory (Pty) Ltd
Directors	Duncan Pringle (Managin), Justin Pringle (Pr Eng)
Address	Cluster Box 6871 Le Domain KZN 3610
Email	admin@andisa-advisory.com

2. Information officer

Our designated Information Officer under POPIA is Justin Pringle. You may contact the Information Officer at the email address above for any privacy-related request or complaint. We are in the process of registering our Information Officer with the Information Regulator as required by POPIA.

3. What personal information we collect

We collect only the information we need to operate our CPD programmes. This includes:

• Registration details: name, surname, email address, phone number, employer/organisation.
• Professional details: ECSA registration number and category, CPD record number, years of experience — required to issue compliant ECSA CPD certificates.
• Payment information: billing name, employer name for invoice purposes. We do not store card numbers; payment is processed by a third-party gateway.
• Attendance and assessment records: sign-in sheets, quiz or assessment results, certificate issuance records.
• Correspondence: emails or messages you send us.
• Website analytics: anonymised browsing data collected via no analytics. See section 7.

We do not knowingly collect special personal information (health data, race, political views, biometric data, etc.) unless you volunteer it in correspondence. If we receive it, we delete it unless it is strictly necessary and you have consented.

4. Why we process your information

We process personal information on the following lawful grounds:

1. Performance of a contract — registering you for a workshop, issuing a tax invoice, and delivering the CPD certificate you paid for.
2. Legal obligation — issuing ECSA-compliant CPD certificates requires us to record your name, registration number, and attendance. ECSA and IMESA audit records may need to be retained for the duration of the relevant 3-year CPD validation cycle.
3. Legitimate interest — informing past attendees of related upcoming workshops. You may opt out at any time (section 8).
4. Consent — where we ask for consent (e.g. photographing sessions for marketing), we record the consent and honour withdrawal of it.

5. Who we share your information with

We share information only where necessary:

• IMESA (Institute of Municipal Engineering of Southern Africa) — our Licensed Body for ECSA Category 1 CPD validation. Attendee records may form part of a validation submission reviewed by IMESA.
• ECSA — the Engineering Council of South Africa. Certificates reference ECSA validation numbers; ECSA may audit records.
• Venue and co-presenters — first name and dietary requirements where a catered event requires it; no professional or payment details.
• Payment processor — [PLACEHOLDER — name of gateway, e.g. PayFast / Peach Payments / EFT only]. Subject to their own privacy policy.
• Email platform — [PLACEHOLDER — e.g. Mailchimp / Brevo / direct SMTP]. Used to send registration confirmations and, with consent, newsletters.

All third parties we engage are required to handle your information in accordance with POPIA.

6. Cross-border transfers

Where we use cloud services whose servers are located outside South Africa (for example, email or analytics platforms), we take steps to confirm that the recipient country or service provider offers an adequate level of protection, or we rely on contractual safeguards consistent with POPIA section 72. We will update this policy if the specifics change.

7. Cookies and analytics

• This website does not use cookies or analytics tracking. No personal data is collected by visiting the site.

8. Your rights under POPIA

You have the right to:

• Access — request confirmation of whether we hold your personal information and obtain a copy.
• Correction — ask us to correct or update inaccurate information.
• Deletion — ask us to delete your information, subject to our legal retention obligations (e.g. ECSA CPD records must be retained for audit purposes).
• Objection — object to processing based on legitimate interest, in particular direct marketing. We will honour opt-out requests promptly.
• Complaint — lodge a complaint with the Information Regulator (see section 11).

To exercise any of these rights, email info@andisaadvisory.co.za with the subject line "POPIA Request". We will respond within 30 days.

9. How long we keep your information

CPD attendance & certificates	7 years (ECSA audit requirement; aligns with standard 3-year CPD cycle plus buffer)
Financial records / invoices	5 years (Companies Act and SARS requirement)
Marketing email list	Until you unsubscribe, or 3 years of inactivity, whichever is sooner
General correspondence	3 years
Website analytics (anonymised)	24 months rolling

When retention periods expire, we securely delete or anonymise the data.

10. How we protect your information

We apply reasonable technical and organisational measures appropriate to the size of our operation: access-controlled cloud storage, encrypted email transmission, and limiting access to personal data to people who need it to do their jobs. In the event of a data breach that is likely to harm you, we will notify you and the Information Regulator as required by POPIA.

11. The Information Regulator

If you believe we have processed your information unlawfully, you may submit a complaint to the Information Regulator of South Africa:

Website	inforegulator.org.za
Email (general)	inforeg@justice.gov.za
Email (complaints)	POPIAComplaints@inforegulator.org.za
Address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

12. Changes to this policy

We may update this policy when our practices change or when legislation requires it. The effective date at the top of this page shows the current version. Material changes will be announced on this page for at least 30 days before they take effect.