EvincoVitals

Privacy & Data Protection Policy

Last updated: 07 July 2026

This policy explains how Evinco Vitals, a specialist wing of Evinco Industries (Pty) Ltd, 2024/862354/07 ("Evinco Vitals", "we", "us"), collects, uses, stores, and protects personal information in connection with our website, our business health consultations, and the four-pillar assessment service (Financial, Marketing, HR Compliance, Cyber Security). It is written to comply with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible for your information

Evinco Vitals is the responsible party for personal information processed through our website and consultation services, as defined under POPIA.

2. What personal information we collect

2.1 Information you give us directly

Identity information: full name, ID number, contact details, business role.
Business and financial information collected during the consultation: bank statements, financial statements, tax clearance certificates, and other compliance documents.
HR-related information where relevant to the HR Compliance pillar: employment contracts, UIF/PAYE/COIDA registration details, payroll records (of a client business's employees, not just the client themselves).
Marketing and cyber security related information: website credentials context, social media presence, and answers to our security questionnaire (we do not collect passwords themselves).

2.2 Information collected automatically

Website usage data (pages visited, browser type, device type) via standard analytics and cookies, see Section 8.

2.3 Information from third parties

Where you are referred to us, or where an associate delivering a pillar service shares information back to us as part of delivering that service.

3. Why we process your information

To conduct the business health consultation and calculate your health score.
To deliver the pillar services you purchase (Financial, Marketing, HR Compliance, Cyber Security), including via our associate network.
To generate and send invoices, and to process payments.
To communicate with you about your assessment, your score, and recommended actions.
To comply with our own legal and regulatory obligations.
To improve our services and scoring methodology (using de-identified or aggregated data wherever possible).

4. Our legal basis for processing

We rely on one or more of the following grounds under POPIA for each processing activity:

Your consent, given at the consultation and/or via our website forms.
Processing necessary to perform the service contract between us.
Compliance with a legal obligation (e.g. record-keeping for invoicing and tax purposes).
Our legitimate interests in operating and improving Evinco Vitals, balanced against your rights.

5. Sharing your information

We do not sell personal information. We share information only in the following circumstances:

With associates delivering a specific pillar service on our behalf, under signed confidentiality and data-handling agreements, and only to the extent needed to deliver that service.
With service providers who support our operations (e.g. hosting, invoicing, cloud storage), under appropriate data processing agreements.
Where required by law, regulation, or a valid legal process.

All associates and service providers are contractually required to protect your information to a standard consistent with this policy and with POPIA.

6. Cross-border storage and transfer

Some of our systems (including our hosting provider) may store or process data outside South Africa. Where this occurs, we take reasonable steps to ensure the receiving party is subject to a law, binding agreement, or certification scheme providing a level of protection substantially similar to POPIA.

7. How we protect your information

Because cyber security is one of the pillars we assess in your business, we hold ourselves to the same standard. Our safeguards include:

Multi-factor authentication on internal systems handling client data.
Access restricted to staff and associates who need it to deliver the specific service.
Encrypted storage of uploaded documents (bank statements, compliance records).
Regular backups and a documented incident-response process.
Prompt removal of access for associates or staff who no longer work with us.

8. Cookies and website analytics

Our website may use cookies and similar technologies to remember preferences and understand how visitors use the site (e.g. via analytics tools). You can control or disable cookies through your browser settings; disabling some cookies may affect site functionality. We do not use cookies to collect the sensitive financial or compliance information described in Section 2, that is only ever collected directly, with your knowledge, during the consultation process.

9. How long we keep your information

Consultation and assessment records: retained for as long as you remain a client, and for a reasonable period afterward to meet our own legal, tax, and record-keeping obligations.
Financial and compliance documents collected at consultation: retained only as long as necessary to deliver the relevant pillar service, then securely deleted unless a longer retention period is required by law.
Website analytics data: retained per our analytics provider's standard retention period.

You may request deletion of your information at any time, subject to our legal obligation to retain certain records (see Section 10).

10. Your rights under POPIA

You have the right to:

Be told what personal information we hold about you and why.
Request access to, or a copy of, your personal information.
Request correction of inaccurate or outdated information.
Request deletion of your information, subject to our legal retention obligations.
Object to certain processing, or withdraw consent where processing is based on consent.
Lodge a complaint with the Information Regulator of South Africa if you believe your information has been mishandled.

11. Children's information

Our services are directed at business owners and are not intended for children. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this document will reflect the most recent revision. Material changes will be communicated to active clients directly.

13. Contact us

If you have any question about this policy or how we handle your information, contact:

Ofentse Kgwedi
076 428 7356
privacy@evincoindustries.co.za