Privacy Policy

1. How We Collect Your Information

We collect personal information directly from you through two channels on our website:

1. Contact form: when you complete the enquiry form on cadelis.site to request a consultation or ask a question, we receive the name, email address, telephone number and any message content you choose to provide.
2. Email subscription: when you sign up to our mailing list, we receive your email address and, where you supply it, your first name, for the purpose of sending you newsletters and updates about our financial consulting services.

We do not collect personal information from any other source unless you separately engage us as a client, in which case additional information is gathered under a separate client engagement and onboarding process governed by our Terms of Use and any applicable engagement letter.

2. What Happens to the Information Once Submitted

1. The data you submit via the contact form is transmitted securely to our internal enquiry mailbox and reviewed by a member of the Cadelis Rivergate team.
2. A staff member responds to your enquiry using the contact details you provided.
3. If your enquiry proceeds to a client relationship, the information is transferred to our client management records, subject to a separate retention regime described in our engagement documentation.
4. If your enquiry does not proceed, the enquiry record is retained for a limited period (see the table in section 8) and then deleted.
5. Email subscription addresses are added to our mailing list platform and used only to send newsletters until you unsubscribe.
6. Every marketing email contains an unsubscribe link; on use, your address is removed from active sending lists within a reasonable period and retained only on a suppression list to ensure we do not email you again.

3. Legal Basis for Processing

POPIA requires that processing be justified on one of the grounds set out in section 11 of the Act. We rely on the following:

• Consent: for email subscriptions, and for any cookies that are not strictly necessary (see our Cookie Policy).
• Legitimate interest: for responding to contact form enquiries, which reflects both your interest in receiving a response and our legitimate interest in engaging with prospective clients.
• Performance of a contract or steps prior to entering into a contract: where an enquiry develops into a client engagement.
• Compliance with a legal obligation: where we are required to retain records under financial services, tax or anti-money-laundering legislation applicable to consulting engagements.

4. Categories of Personal Information Processed

• Identifying information: name, email address, telephone number.
• Content of correspondence: the substance of any message submitted through the contact form.
• Technical information: IP address, browser type and device information collected automatically through cookies (see our separate Cookie Policy for detail on necessary, analytics and marketing cookies).
• Marketing preference information: subscription status and engagement history with our newsletters.

We do not knowingly collect special personal information (as defined in section 26 of POPIA, such as health, religious belief, or biometric data) through the contact form or email subscription, and ask that you do not include such information in any message you send us.

5. Hosting and Third-Party Processing

The cadelis.site website and the data submitted through it are hosted and processed with the assistance of third-party service providers, including our website hosting provider and our email marketing platform provider. These providers act as operators (processors) on our behalf within the meaning of POPIA and are bound by written agreements requiring them to process personal information only on our instruction, to apply appropriate security safeguards, and not to use the information for their own purposes. Where any such provider is located outside South Africa, we take reasonable steps to ensure the recipient is subject to a law, binding corporate rules or agreement providing an adequate level of protection substantially similar to POPIA, as required by section 72 of the Act.

6. Security Safeguards

In accordance with section 19 of POPIA, we have implemented reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in our possession, including access controls limiting staff access to enquiry and subscriber data, encrypted transmission of form submissions, and regular review of our hosting and email platform providers' security practices. No system is entirely immune from risk, and in the event of a security compromise that has compromised personal information and there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

7. Disclosure to Third Parties

We do not sell or rent personal information. We may disclose personal information to:

• our hosting provider and email marketing platform, as operators processing data on our instruction;
• professional advisors (auditors, legal counsel) bound by confidentiality, where necessary for the operation of our business;
• regulators, courts, or authorities where disclosure is required by law.

8. Retention of Personal Information

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law, in line with section 14 of POPIA.

Data	Source	Retention Period
Contact form enquiry (name, email, phone, message)	Contact form	24 months from last contact, or until enquiry is closed and no client relationship arises, whichever is sooner
Email address and name	Email subscription	Duration of subscription, plus suppression list retention indefinitely after unsubscribe
Client engagement records arising from an enquiry	Contact form → client onboarding	5 years after termination of engagement, in line with applicable financial and tax record-keeping obligations
Website technical/cookie data	Automated collection	As set out in our Cookie Policy

9. Your Rights as a Data Subject

Under POPIA, you have the right to:

• be notified that personal information about you is being collected;
• access the personal information we hold about you, on request;
• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully;
• object to the processing of your personal information, including for direct marketing purposes such as our newsletter;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal, for example by using the unsubscribe link in any marketing email;
• complain to the Information Regulator of South Africa if you believe your rights under POPIA have been infringed.

To exercise any of these rights, please contact us using the details below. We will respond within a reasonable time and, in any event, within the timeframes required by POPIA.

10. Complaints to the Information Regulator

If you are not satisfied with our response to any request or complaint, you may lodge a complaint with the Information Regulator of South Africa, whose contact details are published at inforegulator.org.za.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The updated version will be published on this page with a revised effective date.