Privacy Policy & POPIA Notice

01. Legislative Framework & Definitions

This Statutory Privacy Policy and POPIA Compliance Manual constitutes the statutory disclosure of HORIZON STRATEGIC GROUP (PTY) LTD ("HSG", "the Holding Company", "the Responsible Party", "we", "us", or "our") pursuant to the provisions of:

• Section 14 of the Constitution of the Republic of South Africa, 1996 (the fundamental constitutional right to privacy);
• The Protection of Personal Information Act No. 4 of 2013 ("POPIA");
• The Promotion of Access to Information Act No. 2 of 2000 ("PAIA");
• The Companies Act No. 71 of 2008 (governing company records, director registers, and Section 45 financial assistance);
• The Electronic Communications and Transactions Act No. 25 of 2002 ("ECTA"); and
• The Cybercrimes Act No. 19 of 2020.

02. Lawful Grounds & Justification for Processing

In terms of Section 11(1) of POPIA, Horizon Strategic Group processes personal information strictly and solely where one or more of the following lawful grounds apply:

• Statutory & Legal Obligation (Section 11(1)(c)): Processing is mandatory to comply with duties imposed by South African corporate legislation, including the Companies Act 71 of 2008 (maintaining shareholder registers, director declarations, beneficial ownership filings with CIPC), and the Tax Administration Act No. 28 of 2011.
• Performance of a Contract (Section 11(1)(b)): Processing is necessary for concluding or executing institutional shareholder compacts, intercompany commercial agreements, term sheets, or corporate financing facilities.
• Legitimate Interests of the Responsible Party (Section 11(1)(f)): Processing is necessary for capital allocation governance, conducting due diligence, maintaining virtual data room audit trails, and ensuring statutory corporate veil protection.
• Voluntary Consent (Section 11(1)(a)): Where explicit consent is granted by an authorized corporate representative submitting an institutional inquiry through our secure web portal.

03. Categories of Personal Information Collected

In strict compliance with the Principle of Minimality (Section 10 of POPIA), HSG collects only the information strictly required for holding company governance and institutional transactions:

04. Statutory Operating Boundary & Corporate Veil (Sec 20(9))

05. Compliance with the 8 Conditions for Lawful Processing

Our governance architecture embeds the eight statutory conditions of Chapter 3 of POPIA:

06. Institutional Due Diligence, FICA & KYB Verification

For prospective co-investors, institutional lenders, and transaction partners engaging in M&A or credit facilities:

07. Authorized Operators & Cross-Border Transfers (Sec 72)

We do not sell, rent, or trade personal information to any third parties under any circumstances. Personal data is shared strictly with authorized service providers (Operators) performing essential infrastructure functions:

• Hosting & Server Infrastructure (Truehost / cPanel): Static web delivery and secure corporate email routing hosted on enterprise infrastructure in compliant data centres.
• Statutory & Legal Advisors: External corporate secretarial, auditing, and legal counsel engaged under binding professional confidentiality mandates.
• Cross-Border Safeguards (Section 72 POPIA): To the extent that cloud infrastructure is backed up across international nodes, transfers comply with Section 72(1)(a) of POPIA, ensuring that recipient jurisdictions provide substantially similar protection or are bound by corporate agreements.

08. Security Safeguards & Breach Protocol (Sec 19–22)

We enforce comprehensive technical, cryptographic, and operational security measures:

Section 22 Breach Notification: In the event of an actual or reasonably suspected security compromise, HSG will notify the Information Regulator and affected data subjects as soon as reasonably possible, specifying the nature of the breach and remediation measures taken.

09. Retention & Statutory Destruction of Records (Sec 14)

Personal information is retained only for as long as necessary to achieve the initial purpose or as required by South African law:

• Corporate Governance, MOIs & Board Minutes: Retained indefinitely in terms of Section 24(1) of the Companies Act 71 of 2008.
• Financial & Tax Records: Retained for a mandatory statutory period of seven (7) years in compliance with the Companies Act 71 of 2008 and Tax Administration Act No. 28 of 2011.
• Institutional Inquiries: Retained for twenty-four (24) months post-inquiry conclusion, after which records are archived or deleted unless ongoing commercial negotiations exist.
• Secure Destruction Protocol: Expired electronic records are purged using cryptographic de-identification; paper documents are cross-shredded or incinerated.

10. Data Subject Rights & Access Request Procedure

Under Sections 23, 24, and 25 of POPIA and the provisions of PAIA, you have the following statutory rights:

• Right of Access: Request confirmation whether we hold your personal information and obtain an official copy thereof.
• Right to Rectification: Request correction or updating of inaccurate, irrelevant, or incomplete records.
• Right to Erasure / Deletion: Request destruction or deletion of records where we are no longer authorized to retain them.
• Right to Object: Object on reasonable grounds to the processing of your personal information (Form 1 of the POPIA Regulations).

11. Direct Marketing & Zero Tracking Cookie Policy

No Unsolicited Marketing: Horizon Strategic Group does not engage in consumer marketing or mass unsolicited promotional communications. Communications are strictly bespoke and transactional.

Zero Invasive Tracking Cookies: This website does not deploy third-party advertising trackers, cross-site telemetry beacons, or profiling cookies.

12. Lodging a Complaint with the Information Regulator

If you believe your personal information has been processed in breach of POPIA, we encourage you to contact our Information Officer first. However, you have the statutory right under Section 74 of POPIA to lodge a formal complaint with the Information Regulator: