GDPR & POPIA Compliance

1. Two regimes, one operating standard

POPIA and GDPR share core principles: lawfulness, fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. We apply those principles to all personal information we process. Where GDPR applies, we also comply with its specific requirements, including the lawful-basis rules, transparency obligations, data-subject rights and transfer safeguards.

2. Our role

For enquiries submitted through this website, and for our own client and supplier relationships, we are the responsible party under POPIA and the controller under GDPR. For client systems we host or support, we act as an operator under POPIA and a processor under GDPR, processing data only on the client’s documented instructions.

3. Lawful bases

Depending on the processing, we rely on:

• Contract: to provide a service you or your organisation has requested.
• Legitimate interests: to secure and improve our services, prevent fraud, and manage our business, balanced against your rights.
• Consent: for non-essential cookies, advertising pixels and electronic marketing. You may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, company and other applicable law.

4. International transfers

Our website and email infrastructure are hosted in the European Union (Hetzner Cloud, Germany), and some service providers (such as Google and TikTok) are in the United States. Where personal information is transferred out of South Africa, we rely on a lawful mechanism under POPIA section 72, such as adequate protection, consent or contractual necessity.

Where GDPR applies to a transfer from the EEA to South Africa or another country, we use an appropriate safeguard, such as the European Commission’s Standard Contractual Clauses, together with a transfer impact assessment where required. POPIA is not the subject of a general EU adequacy decision. We therefore do not treat POPIA as automatically providing an adequate level of protection for GDPR purposes.

If you are in the EEA and Article 27 GDPR applies to our processing, you may contact our Information Officer at info@blackbartechnologies.co.za. Where we are required to appoint an EU representative, we will publish the representative’s details on this page.

5. Your rights

Subject to the applicable regime, you have the right to:

• access your personal information and receive a copy;
• rectify inaccurate or incomplete information;
• erase information where there is no lawful reason to keep it;
• restrict or object to processing;
• data portability, where GDPR applies;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with a supervisory authority.

Email info@blackbartechnologies.co.za with your request. We may verify your identity. We respond within one month where GDPR applies (extendable by two months for complex requests) and within a reasonable time under POPIA, and we aim to respond within 30 days.

6. Security and breach response

We apply reasonable technical and organisational measures, including encrypted transport, access controls and least-privilege access. If a personal-data breach is likely to result in a risk to your rights, we will notify the relevant regulator and affected individuals within the timeframes required by law (72 hours where GDPR applies, and as soon as reasonably possible under POPIA). We will also take reasonable steps to contain and remedy the breach.

7. Cookies and tracking

We load non-essential analytics and advertising cookies only after you consent through our cookie banner, except where the law permits otherwise. You can change your choice at any time via the Cookie Settings link. See our Cookie Policy for the providers, purposes and durations.

8. Data processing agreements

Where we process personal information on behalf of a client, we do so under a written data processing agreement that sets out the subject matter, duration, nature and purpose of processing, the type of personal information, the categories of data subjects, and the technical and organisational measures. A template is available from our Information Officer.

9. Complaints

10. Contact

Information Officer, Black Bar Technologies (Pty) Ltd, 35 Glenroy Drive, Glenroy Park, Gqeberha, Eastern Cape, 6025. Email info@blackbartechnologies.co.za. Telephone +27 41 010 5035. See also our Privacy Policy.