Privacy notice and POPIA

Who is responsible

Responsible party: [REGISTERED COMPANY NAME], registration [COMPANY REGISTRATION NUMBER], address [BUSINESS / SERVICE ADDRESS]. Information Officer: [INFORMATION OFFICER NAME / ROLE]. Privacy requests: [MONITORED PRIVACY EMAIL]. Officer registration reference: [TO BE CONFIRMED]. These placeholders must be replaced with verified details; they are not operational request channels.

Information and sources

The public form collects organisation name, email, enquiry category and message. The platform can hold account names, contact details, organisation registration and address, membership roles, submitted identity or company documents, licences, bank confirmation, commercial offers, messages, transaction documents and payment evidence. Security and hosting systems may process connection, session and access-log information. Sources include the person submitting it, authorised organisation members, trade counterparties and, where used for a defined check, identified public records or service providers.

Purposes and lawful grounds

Enquiry information is used to respond and follow up on that request. Platform information supports account administration, authority and document review, agreed trading workflows, service notices, fraud investigation and dispute records. The responsible party must identify and document the lawful ground for each purpose, such as steps requested toward a contract, a legal obligation, a balanced legitimate interest or specific consent where required. A generic “FICA” upload label does not establish Commodexa’s regulatory status or a duty to collect every document.

What is required and what is optional

Required form fields are identified in the interface. Without a contact address an enquiry cannot be answered; without necessary verification information access to certain functions may be unavailable. Do not upload extra identity records, children’s information, health information or other sensitive material unless a specifically authorised and justified process requests it. Use synthetic documents on the demo. The production collection checklist and consequences of withholding each required item need approval before onboarding real customers.

Who may receive information

Information may be accessible to authorised Commodexa personnel, the organisation’s permitted members and relevant trade participants according to their role. Hosting, email, support and document-processing providers may handle information needed for the contracted task. Disclosure to advisers, authorities or other parties requires an applicable justification. Public listings and deliberately public content can be seen by visitors; identity and bank records must not be published as listing attachments. The deployed permission and hosting controls require verification before real document intake.

AI assessment and international processing

The platform has a planned Make.com document-extraction and AI-assessment integration, with human review of consequential verification decisions. Current readiness evidence records that automation as inactive; this notice does not claim that it is already processing every upload. Before activation, confirm [PROCESSORS / AI PROVIDERS], [HOSTING AND PROCESSING COUNTRIES], provider retention and model-training terms, contractual safeguards and the lawful cross-border transfer route. AI can misread or misclassify evidence; affected users must be able to challenge an assessment and request human review.

Retention and deletion

Do not keep information merely because storage is available. Retention must be tied to its purpose, an identified legal requirement or a justified dispute/legal hold, with secure deletion or de-identification when no longer needed. The approved schedule is pending: [ENQUIRY PERIOD], [UNSUCCESSFUL APPLICATION PERIOD], [IDENTITY / VERIFICATION PERIOD], [TRADE / ACCOUNTING PERIOD], [ACCESS / AUDIT LOG PERIOD], [BACKUP EXPIRY]. Technical pruning settings are not an approved legal retention schedule. Copies held by authorised counterparties, providers and backups require separate consideration; account closure does not prove immediate deletion from every system.

Security and incidents

The platform is designed with access checks and private document handling, but these are not a guarantee against compromise. Hosting, backup restoration, staff access and processor arrangements must also be assessed. Suspected unauthorised access should be reported promptly using the verified contact channel once supplied. The incident process must preserve evidence, contain exposure, assess affected parties and make the notifications required by South African law. It must not import an assumed GDPR 72-hour deadline into POPIA.

Your rights and requests

You may request confirmation of processing, access, correction and, where the legal conditions apply, deletion, restriction or objection. Where consent is the basis, it can be withdrawn without retrospectively invalidating lawful prior processing. Requests need proportionate identity and authority checks; do not send identity documents to an unverified email address. A refusal or retention decision should be explained with the applicable grounds and escalation route. The PAIA draft sets out the proposed access-request process. These drafts do not suspend existing statutory rights.

Marketing and complaints

Submitting an enquiry or creating an account is not a newsletter subscription. Service messages and replies to a requested enquiry are distinct from promotional campaigns. Any future electronic direct marketing must meet the applicable consent or qualifying existing-customer conditions and provide an effective opt-out. You may complain to the Information Regulator independently of Commodexa’s internal process. Current forms and regulator contact details are linked below.

Independent guidance and official channels

• Information Regulator: POPIA guidance and complaints
• Information Regulator: PAIA guidance and current forms
• POPIA prescribed forms
• Regulator eServices