Privacy Policy
This privacy policy describes how we collect, use, and protect your personal information when you use our website, our app, and our services, including our Wellness Check-In Programme. This policy is governed by the Protection of Personal Information Act 4 of 2013 (“POPIA”).
1. Information We Collect
We collect information that you provide directly to us, such as when you create an account, make a purchase, or contact us for support. This may include your name, email address, mailing address, phone number, and payment information.
Where you participate in our Wellness Check-In Programme or use our app, we also collect personal well-being data, including your responses to questions about your physical, mental, and productivity wellbeing, and any comments you choose to add.
This is classified under POPIA as Special Personal Information, and we only collect it with your explicit, informed consent, given separately before your first Wellness Check-In. Our handling of this information follows the safeguards set out in our internal Data Security and Retention Policy, which governs how this data is stored, secured, and eventually deleted.
2. How We Use Your Information
We use the information we collect to:
- Process and fulfil your orders
- Send you order confirmations and updates
- Respond to your comments and questions
- Improve our website and services
- Send you marketing communications (with your consent)
- Assess and support your personal wellbeing through the Wellness Check-In Programme, and generate your individual wellness report
- Generate anonymised, aggregated wellbeing reporting for the organisation that invited you to participate, where applicable
3. Information Sharing
We do not sell, trade, or rent your personal information to third parties. We may share your information with service providers who assist us in operating our website and conducting our business, as long as those parties agree to keep this information confidential.
Where you participate through your employer or another organisation, that organisation may provide us with your contact details for the purpose of inviting you to take part, and they remain responsible for that contact information.
Your individual Wellness Check-In answers are never shared with that organisation. Any reporting we provide to an organisation is anonymised and aggregated across a minimum group of respondents, reviewed before release to ensure no individual can reasonably be identified from it, and provided as a static document rather than live access to underlying data. All Programme data is hosted within South Africa, and we do not transfer it across borders.
4. Data Security
We implement appropriate technical and organisational security measures, in line with our obligations under POPIA, to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
Access to identifiable wellbeing data is restricted to a small number of named, authorised personnel, all data is encrypted, and we maintain a documented breach response process. These measures are set out in full in our internal Data Security and Retention Policy, which we maintain and review at least annually.
5. Data Retention
We keep personal information only for as long as necessary for the purposes described in this policy:
- Raw, individually identifiable Wellness Check-In data is deleted no later than 12 months after the conclusion of the relevant programme, unless you have separately consented to longer retention, for example in connection with individual coaching, or retention is required by law.
- Anonymised, aggregated reports already provided to an organisation are retained, as they contain no personal information capable of identifying you.
- Contact details provided by an organisation on your behalf are retained only for as long as needed to manage your participation, and deleted at the end of the programme unless you separately opt into further engagement with us.
6. Your Rights
You have the right to access, update, or delete your personal information at any time. You may also opt out of receiving marketing communications from us.
You also have the right to:
Lodge a complaint with the Information Regulator if you believe we have not handled your personal information in accordance with POPIA. The Information Regulator can be contacted at complaints.IR@justice.gov.za.
Withdraw your consent to any processing that relies on consent, at any time. This does not affect the lawfulness of any processing already carried out before you withdraw it.
Object, on reasonable grounds, to us processing your personal information.
7. Cookies
We use cookies to enhance your experience on our website. You can choose to disable cookies through your browser settings, though this may affect the functionality of the site.
8. Breach Notification
If a data breach occurs that is likely to affect you, we will notify the Information Regulator and affected individuals as soon as reasonably possible, in line with our internal breach response process, including what happened, what information was involved, and the steps we are taking in response.
9. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page.
10. Contact Us
If you have any questions about this Privacy Policy, or wish to exercise any of the rights described above, please contact our Information Officer at info@duality-fitness.com