iFeedback Consulting (Pty) Ltd - Privacy Policy

Registration Number: 2013/171267/07

Last Updated: April 4, 2025

1. Introduction

iFeedback Consulting (Pty) LTD ("iFeedback," "we," "us," "our"), registered in South Africa, is committed to protecting your privacy and handling your personal information responsibly and transparently. This commitment is in compliance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable data protection laws.

This Privacy Policy ("Policy") explains how we collect, use, disclose, secure, and otherwise process your personal information when you:

• Visit or interact with our websites: ifeedback.co.za (the "Marketing Site") and ifeedback.app (the "Platform"). Together referred to as the "Websites".
• Participate in the iFeedback Citizen Scientist community via the Platform.
• Respond to surveys, polls, or other research activities deployed through our Platform or services.
• Engage with us for our professional services described on the Marketing Site.
• Interact with other related websites we control where this policy is posted (e.g., conservationmag.org).

What is Personal Information? As defined by POPIA, personal information means information relating to an identifiable, living, natural person, and where applicable, an identifiable, existing juristic person. This includes, but is not limited to, your name, email address, phone number, address, demographic details, opinions (in certain contexts), and online identifiers like IP addresses.  

This Policy does not apply to third-party websites or services that may be linked from our Websites. We encourage you to review their privacy policies independently.

By using our Websites or Services, you acknowledge that you have read and understood this Privacy Policy. Where specific processing activities require your consent (as outlined below), we will obtain this separately. If you do not agree with our use of your personal information as described herein, please do not use our Websites or Services.

2. Information Officer

Our designated Information Officer, responsible for overseeing compliance with this Policy and POPIA, is:

• Name: Adriaan Buys
• Contact: Contact us

Please contact the Information Officer with any questions, concerns, or requests regarding this Policy or your personal information.

3. Information We Collect

We collect personal information in various ways, depending on your interaction with us:

• Information You Provide Directly:
  • Citizen Scientist Sign-up (ifeedback.app): When you voluntarily join the iFeedback Citizen Scientist community, we collect your email address, name, and any demographic information you choose to provide (e.g., Country, Age Range, Gender, City).
  • Contact Forms / Inquiries (Both Websites): Information you submit via contact forms or direct email inquiries, such as your name, email address, phone number (optional), company (optional), and the content of your message.
  • Service Engagement (ifeedback.co.za): Information provided when you engage our consulting or research services, potentially including professional contact details, company information, payment details (processed securely via third-party providers), and information shared during consultations or project execution.
  • Survey/Poll Responses (ifeedback.app):
    • Anonymous Responses: For the vast majority of surveys and polls, your responses are collected anonymously, meaning your personal identifiers (like name or email from your community profile) are not linked to the answers you provide to researchers.
    • Non-Anonymous Responses: In specific, clearly identified research studies (often academic), non-anonymous responses might be required. This will always be explicitly stated in the survey invitation, require your specific, informed consent before participation, and typically be subject to approved University Ethics Committee protocols.
  • Account Registration (ifeedback.app): Information required to create and manage your user account on the Platform, potentially including username and password.
• Information Collected for Specific Research Projects:
  • Professional Roles: For certain B2B research projects targeting specific professional roles (e.g., Marketing Managers), we may process professional contact information (name, company email, job title) sourced from reputable third-party B2B data providers who assert POPIA compliance (e.g., Interactive Direct). Invitations are sent based on the likely relevance of the study to the professional role.
• Information Collected Automatically:
  • Log Data: When you access our Websites, our servers automatically record information such as your IP address, browser type, operating system, referring URLs, pages viewed, access times, and device information.
  • Cookies and Tracking Technologies: We use cookies (small text files stored on your device) and similar technologies. See Section 5 ("Cookies") for details.

4. How We Use Your Information and Lawful Basis (POPIA)

We process your personal information only for specified, explicit, and legitimate purposes, relying on the following lawful bases under POPIA:

• Consent: Where we rely on consent, you provide it freely (e.g., signing up, agreeing to a non-anonymous survey, opting into marketing). You can withdraw consent at any time, though this won't affect prior lawful processing.
• Legitimate Interest: We rely on legitimate interest when processing is necessary for our business operations (e.g., platform security, responding to queries, targeted B2B research invites), provided our interests don't override your rights and freedoms. You have the right to object to processing based on legitimate interest.
• Performance of Contract: Processing necessary to fulfil our contractual obligations to you (e.g., providing paid services).
• Legal Obligation: Processing necessary to comply with South African law.

5. Cookies and Tracking Technologies

We use cookies and similar technologies on our Websites for various purposes:

• Essential Cookies: Necessary for the Websites to function properly (e.g., maintaining login sessions on the Platform, security).
• Performance/Analytics Cookies: Help us understand how visitors use our Websites by collecting anonymous usage statistics (e.g., pages visited, time spent). This helps us improve the Websites. We may use tools like Google Analytics.
• Functionality Cookies: Allow the Websites to remember choices you make (e.g., language preference) to provide a more personalized experience.
• Targeting/Advertising Cookies (Less Common): May be used by us or third parties to deliver advertising more relevant to you, potentially based on Browse habits (requires explicit consent where applicable by law).

We use both session cookies (expire when you close your browser) and persistent cookies (remain until they expire or you delete them). We use first-party cookies (set by us) and may allow third-party cookies (set by partners like analytics providers).

Your Choices: You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies may affect the functionality of the Websites.  

6. Information Sharing and Disclosure

We respect your privacy and do not sell your personal contact information. We may share your personal information only in the following limited circumstances:

• With Researchers/Clients:
  • Anonymous/Aggregated Data: Primarily, only anonymized survey responses and/or aggregated demographic data are shared with the researchers or clients who commission studies via the Platform (ifeedback.app).
  • Non-Anonymous Data: In the rare case of studies requiring non-anonymous data, your identifiable information is shared only with the specific researcher/client stated in the invitation, only after obtaining your explicit prior consent, and subject to ethical approvals where applicable.
  • Service Delivery (ifeedback.co.za): Information relevant to providing contracted services may be shared with the client as necessary and agreed upon.
• With Service Providers: We engage trusted third-party vendors to perform functions on our behalf (e.g., website hosting – Scala Hosting & Hetzner; email delivery – Amazon SES; payment processing; data analysis tools). These providers are contractually obligated to process your information securely, only for the purposes we specify, and in compliance with POPIA.
• For Legal Reasons: If required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others, or to investigate fraud.  
• Business Transfers: If iFeedback Consulting (Pty) LTD is involved in a merger, acquisition, asset sale, or other business transition, your information may be transferred as part of that transaction. We will ensure transferee respects commitments made in this Policy or notify you of changes.
• With Your Consent: We may share your information with other third parties when we have your explicit consent to do so.

7. Data Security

We implement reasonable and appropriate technical, administrative, and physical security measures designed to protect the personal information we process from loss, misuse, unauthorized access, disclosure, alteration, and destruction. These measures consider the nature of the data and the risks involved. However, please be aware that no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.  

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Policy, including:

• Managing your participation in the Citizen Scientist community (while you remain a member).
• Providing services you have requested.
• Complying with our legal obligations (e.g., financial record-keeping).
• Resolving disputes and enforcing our agreements.
• Maintaining suppression lists to honour opt-out requests (unless deletion is specifically requested and feasible).

Once retention is no longer necessary, we will securely delete or anonymize your personal information.

9. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights regarding your personal information:

• Right of Access: To request confirmation of whether we hold personal information about you and to request a copy of that information.
• Right to Rectification: To request the correction of inaccurate, outdated, excessive, irrelevant, or misleading personal information.
• Right to Erasure (Deletion): To request the deletion or destruction of your personal information under certain conditions (e.g., if it's no longer necessary for the original purpose, if consent is withdrawn and no other legal basis exists).
• Right to Object: To object, on reasonable grounds, to the processing of your personal information where we rely on legitimate interests or for direct marketing purposes.
• Right to Restrict Processing: To request the restriction of processing under certain circumstances (e.g., while verifying accuracy or legality).
• Right Not to be Subject to Automated Decision-Making: To not be subject to decisions based solely on automated processing (including profiling) that have legal or significant effects, unless certain conditions are met (we currently do not engage in such activities).  
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time (this does not affect prior lawful processing).
• Right to Complain: To lodge a complaint with the South African Information Regulator if you believe your rights under POPIA have been infringed.

Exercising Your Rights: To exercise any of these rights, please contact our Information Officer (details in Section 2 and 14). We will respond to your request within a reasonable timeframe and in accordanceance with POPIA requirements, potentially requesting further information to verify your identity.

10. International Data Transfers

Your personal information may be stored and processed on servers located outside of South Africa (e.g., by our cloud hosting providers or other service providers). When we transfer your information internationally, we take appropriate steps to ensure that the transfer complies with POPIA requirements and that your information remains protected to an adequate standard, for example, through contractual clauses or by ensuring the recipient country has adequate data protection laws.

11. Third-Party Links

Our Websites may contain links to other websites not operated or controlled by us. This Policy does not apply to those third-party sites. We are not responsible for their privacy practices and encourage you to review their privacy policies before providing any personal information.  

12. Children's Privacy

Our Websites and Services are not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will post the updated Policy on our Websites and indicate the "Last Updated" date at the top. For significant changes, we may provide more prominent notice (e.g., via email to registered users or a notice on the website). We encourage you to review this Policy periodically to stay informed about how we protect your information.  

14. Complaints

If you have any concerns or complaints about how we handle your personal information or believe your rights under POPIA have been breached, please contact our Information Officer first (details below). We are committed to resolving complaints fairly and efficiently and aim to respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa:

• The Information Regulator (South Africa)
• Website: https://inforegulator.org.za/

15. Contact Information

For any questions, concerns, requests to exercise your rights, or comments regarding this Privacy Policy, please contact our Information Officer:

• Information Officer: Adriaan Buys
• Company: iFeedback Consulting (Pty) LTD (Reg: 2013/171267/07)
• Postal Address: 8 Glencaird Road, Glencairn, Cape Town, South Africa, 7975.
• Via Website: Contact Us