Responsible Party (Data Controller)

Chemplanet Scientific Solutions (Pty) Ltd
Registration Number: 2019/549346/07

Physical Address

8 Hunters Green
Summer Greens
Cape Town, 7441
South Africa

Information Officer

As required by POPIA, we have appointed an Information Officer who is responsible for overseeing our data protection strategy and compliance:

Name: Cosmas Mutsimhu
Email: info@chemplanet.co.za
Phone: (+27) 21-555-0053
Cell: (+27) 63-571-0130

Business Activities

Chemplanet Scientific Solutions is Southern Africa's leading provider of mass spectrometry, chromatography, spectroscopy instruments, and scientific solutions. We serve pharmaceutical, mining, food & beverage, environmental, academic, and industrial sectors across Africa.

We collect different types of information depending on your interaction with us:

We process your personal information for the following legitimate business purposes:

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

We process your personal information based on one or more of the following legal grounds:

We may share your personal information with the following categories of recipients:

Service Providers

• Technical Support Partners: Authorized service technicians (only necessary contact and equipment information)
• Payment Processors: Secure payment gateways (they process but do not store full payment details)
• Cloud Services: Secure hosting providers with data processing agreements
• Shipping Companies: Delivery information for equipment shipments
• Marketing Platforms: Email service providers (only with your marketing consent)

Legal & Regulatory Sharing

• Government authorities when required by law
• Law enforcement agencies with valid legal requests
• Regulatory bodies for compliance purposes

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and outline your choices.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

Data Deletion

Upon expiration of the retention period, or if you exercise your right to erasure, we will securely delete or anonymize your personal information. Some data may be retained for longer periods where required by law.

Archival Storage

Some information may be moved to secure archival storage after the active retention period for historical or statistical purposes, where it is fully anonymized or encrypted.

You have the following rights regarding your personal information:

Exercising Your Rights

To exercise any of these rights, please contact our Information Officer using the contact details in Section 13. We will respond to your request within 21 business days as required by POPIA.

Withdrawing Consent

Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Technical Security Measures

• Encryption: Data in transit (TLS/SSL) and at rest (AES-256)
• Access Controls: Role-based access, strong authentication, least privilege principle
• Network Security: Firewalls, intrusion detection, regular security audits
• Secure Development: Security-focused development practices, regular code reviews
• Backup & Recovery: Regular encrypted backups, disaster recovery plans
• Endpoint Security: Antivirus, device encryption, mobile device management

Organizational Security Measures

• Data Protection Training: Regular training for all employees on data protection
• Security Policies: Comprehensive information security policies and procedures
• Incident Response: Documented incident response plan for data breaches
• Vendor Management: Security assessments for third-party vendors
• Physical Security: Secure facilities, access controls, visitor management
• Regular Audits: Internal and external security audits and assessments

Data Breach Response

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

1. Contain the breach and assess the risk
2. Notify the Information Regulator within 72 hours (if required)
3. Notify affected individuals without undue delay
4. Document the breach and our response
5. Implement measures to prevent recurrence

As a South African company serving clients across Africa, we primarily process and store data within South Africa. However, in some cases, data may be transferred to other countries.

Transfer Scenarios

• Equipment Manufacturers: Limited equipment data may be shared with international manufacturers for warranty claims or technical support
• Cloud Services: Some cloud services may store data in multiple locations (with appropriate safeguards)
• Multinational Clients: Data related to multinational corporations may be processed in their country of operation

Safeguards for International Transfers

When transferring data outside South Africa, we ensure appropriate safeguards are in place:

• Standard contractual clauses approved by relevant authorities
• Binding corporate rules for intra-group transfers
• Adequacy decisions for transfers to countries with adequate data protection laws
• Explicit consent for specific transfers when required

Our website uses cookies and similar tracking technologies to enhance user experience and analyze website traffic.

Types of Cookies We Use

Managing Cookies

You can control and/or delete cookies as you wish. You can delete all cookies that are already on your computer and set most browsers to prevent them from being placed. However, if you do this, you may have to manually adjust some preferences every time you visit a site and some services and functionalities may not work.

Third-Party Analytics

We use Google Analytics to analyze website traffic. Google Analytics collects information such as how often users visit our site, what pages they visit, and what other sites they used prior to coming to our site. We use the information from Google Analytics only to improve our site and services.

Our services are not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately.

If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will take steps to remove that information from our servers.

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Notification of Changes

When we make material changes to this policy, we will:

• Update the "Last Updated" date at the top of this policy
• Notify registered users via email (if we have your contact details)
• Post a notice on our website for significant changes
• Provide a summary of changes for easy reference

Your Acceptance

By continuing to use our services after changes become effective, you agree to be bound by the revised policy. If you do not agree with the changes, you should discontinue use of our services.

Version History

We maintain a version history of this policy. You may request previous versions by contacting our Information Officer.

For any questions, concerns, or requests regarding this privacy policy or our data protection practices, please contact us:

Response Time

We strive to respond to all privacy-related inquiries within 21 business days as required by POPIA. Complex requests may require additional time, in which case we will notify you and provide an estimated response timeline.

Complaints

If you are not satisfied with our response or believe we are processing your personal information in a way that is not compliant with data protection laws, you have the right to lodge a complaint with the Information Regulator of South Africa or your local supervisory authority.