Legal
Privacy policy
This policy explains how Integrity and Impact ESG Consulting (Pty) Ltd ("IIESG", "we", "us") collects, uses and protects personal information when you visit integrityesg.co.za, when you contact us, or when you engage us as a client.
We act as a responsible party under the Protection of Personal Information Act, 2013 (POPIA). Where we process personal information on behalf of clients, we act as an operator and our obligations are set out in our client agreements.
Information we collect
- Information you give us through forms or email — typically name, business email address, company name and the contents of your enquiry.
- Technical information needed to deliver the website — such as IP address, browser type and pages visited. We do not run third-party analytics on this site.
- Engagement information — once you become a client, the information necessary to deliver the engagement, governed by the relevant services agreement.
How we use it
- To respond to enquiries you send through the contact form or by email.
- To deliver and improve our consulting services and the IIESG platform under client engagements.
- To meet legal, regulatory and contractual obligations.
Lawful basis
We rely on one or more of the following lawful bases under POPIA: your consent, performance of a contract with you, our legitimate interest in running our business, and compliance with a legal obligation.
Sharing
We do not sell personal information. We share personal information only with:
- Service providers who help us operate this website and the IIESG platform, under written confidentiality and data-processing terms.
- Professional advisors (legal, audit, insurance) bound by professional duties of confidentiality.
- Regulators or law enforcement where we are legally required to do so.
A current list of sub-processors is available on request.
Cross-border transfers
Where personal information is transferred outside South Africa, we rely on the POPIA section 72 grounds (such as adequacy, contractual safeguards or your consent) and take reasonable steps to ensure ongoing protection.
Retention
We retain personal information for as long as needed for the purposes described in this policy and to meet legal, tax, audit and regulatory requirements. Client engagement records are retained per the relevant services agreement.
Your rights
You have the right to:
- Access the personal information we hold about you.
- Correct or update inaccurate or incomplete personal information.
- Object to or restrict certain processing.
- Request deletion where we have no continuing lawful basis to keep your information.
- Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
Security
We apply technical and organisational measures appropriate to the sensitivity of the personal information we process, including encryption in transit and at rest, role-based access controls, and operations aligned to the ISO 27001 control framework.
Information Officer
Our Information Officer can be reached at contactus@integrityesg.com. Please direct any privacy queries, access requests or complaints to that address.
Changes
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page.