1. Scope & Core Principles

Scope. This policy applies to visitors, prospects, customers, suppliers, and other parties who interact with our website and web forms. POPIA protects information relating to natural persons and juristic persons, including companies.

Accountability. We take joint responsibility with you to manage and protect personal information lawfully and fairly under POPIA’s 8 Conditions of Lawful Processing.

Purpose limitation. We collect and process only the personal information needed for specified, explicit and lawful purposes, such as responding to enquiries, providing quotes/orders, support, and legal compliance. We will not process it for unrelated purposes unless POPIA allows compatible further processing or you consent.

Lawful basis & consent. We rely on the appropriate lawful basis for each purpose, including contract, legal obligation, legitimate interests, or consent. Where we use consent, you may withdraw it at any time.

Minimal sharing. We do not sell personal information. We don’t share or further process it beyond what’s necessary to deliver services, fulfil legal duties, or as POPIA permits. When we use service providers, also known as operators, we bind them by contract to confidentiality, security and breach-notification duties.

Information quality. We take reasonably practicable steps to ensure personal information is accurate, complete, not misleading and, where necessary, kept up to date.

Openness & transparency. We are clear about what we collect, why, our lawful bases, who receives it, cross-border transfers, your rights, and how to complain.

Security safeguards. We protect personal information using appropriate technical and organisational measures aligned to POPIA, including access controls, encryption, patching, backups, vendor vetting, and incident response.

Your rights. We will confirm what personal information we hold, subject to identity verification and lawful PAIA/POPIA exceptions, and we will correct or delete it on request where applicable. You may also object to processing or withdraw consent at any time.

Storage limitation. We keep personal information only as long as necessary for the stated purposes or as required by law, after which we securely delete or anonymise it.

2. Responsible Party & Contacts

Gene Vantage (Pty) Ltd, South Africa, is the responsible party for personal information processed on and through this website. We operate from Midrand, Gauteng, South Africa. Our full registered address appears in our PAIA Manual and is available on request.

Privacy-related queries, requests, or complaints can be directed to info@genevantage.co.za.

In accordance with POPIA, we maintain documentation of our processing activities and a PAIA Manual explaining how to request access to records. A copy of the PAIA Manual is available on request.

3. What We Collect

We collect two broad categories of information:

3.1 Information you provide directly

When you submit a contact, enquiry or quote request, or ask for product information, you may provide your name and surname, email address, phone number, company or organisation details, including juristic-person details, the content of your message and any other details you choose to share. Providing this information is generally voluntary; however, if you do not provide it, we may be unable to respond to your enquiry or provide certain services.

3.2 Information collected automatically

We use Google Analytics and essential WordPress cookies/plugins to gather usage data that may constitute personal information under POPIA, such as device and browser type/version, IP address and general geolocation, pages viewed, actions taken, session duration, referral source, cookie identifiers and similar online identifiers. We do not use Meta Pixel. We use this analytics information solely to understand website performance and to improve content and user experience.

4. Section 18 Notice

When we collect personal information, we disclose the following:

• Responsible party: Gene Vantage (Pty) Ltd, Midrand, Gauteng, South Africa. Full registered address is in our PAIA Manual, available on request.
• Purposes: See the matrix in Section 5.
• Provision voluntary/mandatory: Generally voluntary for enquiries; may be necessary to conclude or perform a contract, such as a quote or order.
• Consequences of not providing: We may be unable to respond, quote, supply or support you.
• Recipients: Authorised employees and operators that support hosting, analytics, security and site functionality.
• Cross-border processing: Some operator processing may occur outside South Africa.
• Your rights: Access, correction, deletion, objection, and withdrawal of consent.
• Complaints: Contact our Information Officer team or the Information Regulator.

5. Why We Process Your Information

We rely on one or more lawful bases under Section 11 of POPIA, not only consent, depending on the purpose of processing.

Note: We do not sell personal information.

6. Cookies & Analytics

Our website uses essential cookies to provide core functionality and security, and analytics cookies via Google Analytics to understand how visitors use the site so we can improve performance and content.

• You can manage cookies at any time through your browser settings and, where available, our on-site cookie controls.
• Disabling certain cookies, particularly essential cookies, may affect website functionality or limit features.
• We do not use Meta Pixel.

7. Operators & Disclosures

We engage vetted operators, including secure website hosting providers, WordPress plug-in vendors, analytics providers, and IT/security support, to help us run, secure, and improve our services. Each operator is bound by a written agreement that requires confidentiality, appropriate technical and organisational safeguards, and prompt breach-notification duties.

Operators may only process personal information on our documented instructions and may not use it for their own purposes. Within Gene Vantage, access to personal information is role-based and restricted to personnel who need it to perform their duties.

8. Security Safeguards

We implement safeguards appropriate to the nature and risks of our processing activities, including:

• HTTPS/SSL with hardened hosting and regular patching.
• Least-privilege, role-based access with periodic access reviews.
• Encryption in transit and, where applicable, at rest.
• Tested backup and recovery procedures.
• Vendor and plug-in vetting with ongoing risk reviews.
• Staff confidentiality undertakings and regular POPIA training.
• Monitoring and incident-response practices, including breach drills.

If we have reasonable grounds to believe a security compromise affecting personal information has occurred, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible, using the Regulator’s prescribed channels and including the required content.

9. Cross-Border Transfers

Some of our operators, such as cloud-hosting providers and Google Analytics, may process personal information outside South Africa. We will only transfer personal information where Section 72 conditions are satisfied.

This may include ensuring the recipient is subject to a law, binding corporate rules, or a contract that provides an adequate level of protection; transferring where it is necessary to perform a contract at your request; or proceeding on the basis of your consent. We keep records of the safeguards relied on and can provide further detail on request.

10. Retention & Deletion

We retain personal information only for as long as is necessary for the purposes described in this policy or as required by law. As a guide:

• Enquiries & general correspondence: typically 12–24 months.
• Quotation, sales & financial records: 5 years under the Tax Administration Act and up to 7 years where required by the Companies Act.
• Website logs: up to 12 months, longer if needed for security or legal purposes.
• Analytics data: configured to the shortest feasible period, generally up to 14 months.
• Recruitment records: up to 12 months unless a longer period is legally required or you consent to a longer retention.

When information is no longer needed, we securely delete or anonymise it and instruct our operators to do the same.

11. Your Rights

You may exercise your data-subject rights free of charge, except that PAIA access requests may attract statutory fees. These rights include:

• Access to the personal information we hold about you, handled under PAIA timelines and fee rules.
• Correction or deletion of personal information that is inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained.
• Objection to certain processing, such as processing based on legitimate interests or for direct marketing.
• Withdrawal of consent where processing relies on consent. This does not affect prior lawful processing.

If we ever send direct marketing, you can opt out at any time via a free and simple mechanism included in each message, and we will maintain a suppression list to honour your choice.

How to make a request: Email info@genevantage.co.za. We will acknowledge receipt within 5 business days and respond within 30 calendar days, or explain any legally permitted extension.

12. Complaints

If you believe we are not complying with POPIA:

• Please contact our Information Officer team first at info@genevantage.co.za.
• If unresolved, you may lodge a complaint with the Information Regulator, South Africa, using POPIA Form 5 or the Regulator’s e-services portal.

Information Regulator (South Africa)
54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: +27 (0)10 023 5200
Email, general: enquiries@inforegulator.org.za
Email, POPIA complaints: POPIAComplaints@inforegulator.org.za

13. Special Personal Information & Children

Our website is not intended to collect special personal information, for example health-related data or biometrics, or information about children. If a legitimate business need requires us to process any such categories, for instance in a regulated workflow or a recruitment-related health check, we will only do so with a valid authorisation under POPIA and subject to heightened safeguards, proportionality, and strict access control.

We do not knowingly collect children’s information online. If we become aware that such information was submitted inadvertently, we will delete it or obtain the necessary authorisation without delay.

14. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. If this ever changes, we will implement Section 71 safeguards, including meaningful human involvement, the ability to express your view and contest a decision, and update this policy accordingly.

15. Direct Marketing

We do not operate a newsletter or routine e-marketing programme at present. If we introduce direct marketing in future, we will obtain consent where required or rely on the Section 69(3) customer exemption for similar products/services, and we will include a free, easy opt-out in every message.

We will also maintain a suppression list to honour opt-outs. We do not use third-party email marketing platforms at present.

16. Third-Party Sites & Plugins

Our website may link to third-party sites or use WordPress plugins. Those sites and services are governed by their own privacy terms and practices. Please review their policies before submitting information to them. We are not responsible for how third parties handle your information, and links do not imply endorsement.

17. Changes to This Policy

We may update this policy from time to time. Material changes will be highlighted on the website and, where appropriate, we may provide direct notice. Please refer to the Last updated date at the top of the policy. Your continued use of the site after changes take effect constitutes acceptance of the updated terms.