Draft for legal review. Written as a starting point and not yet reviewed by a lawyer. Highlighted [brackets] need your details. Remove this notice after review. Some sections describe the members area, which is planned and not yet open, and are marked.
Draft of 5 November 2026.
1. Who is responsible
WFM – Beyond the Spreadsheet is the "responsible party" under the Protection of Personal Information Act 4 of 2013 (POPIA) for personal information handled through this site. Information Officer: the site owner, cnrdigital2026@gmail.com.
We also describe your rights under the EU and UK GDPR, because visitors and members may be in those regions.
2. What we collect
| When | What |
|---|---|
| You visit the public site | Technical data such as IP address, browser type, pages requested and time, handled by our hosting provider in server logs and security systems. We do not use analytics or advertising trackers. The calculators and the checker run in your browser, and what you type into them is not sent to us. |
| Your browser storage | One small entry that remembers you have seen our storage notice. See the cookie policy. |
| You join (planned) | From LinkedIn or Google: your name, email address, profile photo if you allow it, and the provider's unique ID for you. From you: a display name and, if you choose, a short bio and experience level. |
| You post (planned) | Your posts, comments, reactions and reports, with dates and times. |
| Moderation (planned) | Records of approvals, held or removed content, reports and warnings. |
| You contact us | Your email address and the content of your message. |
We do not ask for, and do not want, special personal information (for example health, religion, race or union membership), identity numbers, or any employer, client or customer data. If it is posted, we may remove it.
3. Why we use it
| Purpose | Basis (POPIA, and GDPR where it applies) |
|---|---|
| Run, secure and fix the site | Our legitimate interest in a working, secure service |
| Create and manage your membership, show your posts | Necessary to provide the service you asked for; your consent where we ask for it |
| Moderate content and enforce the rules, including removing confidential or personal information | Legitimate interest of ours, other members and third parties whose information may be posted |
| Reply to you and handle requests and complaints | Legitimate interest; legal obligation where it applies |
| Meet legal duties and defend legal claims | Legal obligation; legitimate interest |
We do not sell personal information, and we do not use it for advertising or automated decisions that significantly affect you.
4. Who we share it with
- Hosting and network provider (Cloudflare), who delivers the site and may process technical data on our behalf.
- Sign-in providers (LinkedIn, Google), when you choose to use them. They have their own privacy policies.
- An email service (provider to be named when the members area opens) to send notices to members.
- Other members, who can see your display name and what you post in the members area.
- Advisers and authorities, where the law requires it or to protect legal rights.
Service providers act on our instructions and are expected to protect the information.
5. Transfers outside South Africa
Our providers run networks and systems in other countries, including the United States and Europe, so your information may be processed outside South Africa. Where this happens, we rely on providers that are bound by law, contract or binding rules that give a similar level of protection, or on your consent, as POPIA allows.
6. How long we keep it
| Information | How long |
|---|---|
| Server logs | For the period set by our hosting provider, usually short |
| Account details | While your account is open, then 12 months unless the law requires longer |
| Posts and comments | Until you or we delete them, then removed from backups on the normal cycle |
| Moderation and report records | 24 months, or longer if needed for a legal claim |
| Messages to us | As long as needed to deal with the matter |
7. Security
We use reasonable technical and organisational measures: encrypted connections (HTTPS), no storage of your sign-in passwords, limited access to member data, and review of the systems we use. No system is perfectly secure. If a breach affects your personal information, we will tell you and the Information Regulator as the law requires.
8. Your rights
You may ask us to confirm what we hold about you, give you a copy, correct it, or delete or destroy it. You may object to certain processing and withdraw consent you gave. Contact cnrdigital2026@gmail.com with the subject "Privacy request". We may need to verify who you are first.
If you are unhappy with how we handled your request, you may complain to the Information Regulator (South Africa) (inforegulator.org.za).
EEA and UK visitors: you also have the rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your local data protection authority.
9. Children
The site is for adults aged 18 or over. We do not knowingly collect information from children. If we learn that a child has joined, we will delete the account and the information.
10. If you live elsewhere
If you live outside South Africa, your local data protection law may give you more rights. Contact us and we will do what the law requires.
11. Changes
We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell members.
12. Contact
WFM – Beyond the Spreadsheet · Information Officer the site owner · cnrdigital2026@gmail.com · Durban, South Africa (contact by email; no public postal address)