Start with the basics your policy must identify
Begin with the plain facts. State the business name, trading name if different, the physical base in Gardens, Cape Town, and the types of online services you provide. If your business works nationwide, say so clearly and explain that the policy applies to website visitors, customers, suppliers and anyone who submits details through your forms. A visitor should not have to guess who is responsible for their data.
It also helps to name the person or team that handles privacy queries, even if contact happens through an enquiry form. Keep the wording practical and direct, especially if you serve clients in places like Cape Town CBD, Stellenbosch or Paarl. The policy should match how your business actually operates, not how you hope it operates one day.
List every type of personal information you collect
A strong privacy policy should not hide the obvious details. Spell out the categories of information you collect through forms, checkout pages, booking tools, support requests and account sign-ups. If you only say you collect data without listing it, users can miss what is happening with their own information.
- Names, company names and job titles
- Contact details and delivery details
- Billing information and invoice records
- Login details and account activity
- Device, browser and usage data
- Messages sent through contact forms or support requests
If you collect information from a child, a client’s staff member, or a third party who fills in a form on someone else’s behalf, say how that information is handled. Be careful with customer notes too, because these often contain more than the person intended to share.
Explain why you collect information and what legal basis applies
Visitors should know why their information is needed. A privacy policy must link each type of data to a real business reason, such as processing an order, responding to an enquiry, issuing an invoice, or providing ongoing support. If the reason is unclear, the collection can feel unnecessary and may create problems later.
For South African businesses, it is wise to state the legal basis for processing in simple terms. That may include consent, contractual necessity, legal obligation, legitimate business interest, or another lawful ground. Keep the explanation grounded in real operations such as subscription management, ecommerce fulfilment, appointment bookings, or account administration. If you use information for more than one purpose, say so rather than bundling everything into one vague statement.
Cover sharing, storage and cross-border processing clearly
Many businesses rely on service providers to host systems, send messages, process payments or manage customer records. Your policy should say who may receive personal information and why. This is especially important if data is shared with payment processors, couriers, software providers, accountants or support teams working offsite.
If information is stored outside South Africa or can be accessed from another country, say that plainly. POPIA expects businesses to think about cross-border transfers, so this section should not be left broad or hidden in legal wording. Include practical details about how long data is kept, where it is stored, and whether it sits in cloud systems or local records that are protected by passwords, access controls and backup routines. During load-shedding, it is worth noting that electronic records should still be protected and recoverable after outages.
- Who receives the data and for what purpose
- Whether storage happens locally or offshore
- How long records are retained before deletion or archiving
- What security measures protect the records
- When disclosure may happen by law or court order
Set out cookies, tracking and marketing use in plain language
If your website uses cookies, analytics tools or advertising pixels, your privacy policy should say so. Users need to know what those tools do, what information they gather, and how they affect browsing behaviour. Keep the wording practical and avoid making it sound as if all cookies are the same, because they are not.
Separate essential site functions from marketing or tracking activity. If you send newsletters, reminders or follow-up messages, explain how someone can opt in or opt out. Where consent is used, make sure it is clear, voluntary and recorded. A short explanation on this point can prevent confusion later, especially for online stores, booking sites and subscription businesses that depend on repeat contact.
Include data subject rights and how people can use them
A privacy policy should tell people what they can do if they want access to their data, corrections to their records, or deletion where allowed. It should also explain how they can object to certain processing, withdraw consent, or raise a concern if something looks wrong. This is not just legal wording, it is a practical part of customer service.
Make the process simple. Say that requests must be made through the contact channel provided on the website, and explain what information the requester should include so the matter can be verified. If the business needs to keep some records for tax, contractual or legal reasons, say that too. Clear expectations help avoid back-and-forth and make the policy easier to follow for both sides.
Review, update and keep the policy aligned with real operations
A privacy policy is only useful if it stays current. Check it whenever you launch a new service, add a booking tool, start collecting new categories of data, or change the systems that handle customer records. If your business uses a policy pack, a review should still happen before launch and again when your processes change.
Use this final checklist before publishing or updating the document:
- Business identity and contact route are correct
- Information collected is listed accurately
- Purposes and legal grounds are explained
- Sharing, storage and retention are covered
- Cookies, tracking and marketing are disclosed
- Rights and complaint steps are easy to follow
- Update date is shown and the wording matches current practice
If the policy no longer reflects how you work, it needs to be revised. A short, accurate policy is better than a long one that does not match the business anymore.
