1. Who we are

1.1 The South African Portuguese Chamber of Commerce, a South African non-profit company (SAPCC), registration number 2014/142246/08, owns and operates LUSOLINK at www.lusolink.co.za.

1.2 For personal information processed through LUSOLINK, SAPCC is generally the “responsible party” as defined in the Protection of Personal Information Act 4 of 2013 (POPIA). A listed Business remains responsible for its own processing of information it receives directly from Users.

1.3 SAPCC’s Information Officer is Rui Marto, contactable at rui@sapcc.co.za. SAPCC’s physical address is 11 Smith Street, Bedfordview, Gauteng, 2007, South Africa, and its general telephone number is +27 11 616 6420.

​

2. Scope

2.1 This Notice explains how SAPCC collects, uses, discloses, stores and protects personal information when a person visits the Platform, creates an account, submits or appears in a Listing, contacts SAPCC, makes a complaint, or otherwise interacts with LUSOLINK.

2.2 “Personal information”, “processing”, “operator” and related terms have the meanings given in POPIA.

​

3. Information we collect

3.1 Depending on the interaction, SAPCC may process:

• identity and contact information, including names, position, business address, email address and telephone number;

• account information, including email address, authentication identifiers, password credentials stored in protected form by the platform provider, login events and account preferences; Business and Listing information, including ownership or operational connection, categories, location, employee-count range, establishment year, descriptions, logos, images, websites and social-media links;

• submission and authority information, including declarations, verification correspondence and evidence that a Submitter is authorised;

• communications, enquiries, correction requests, objections, complaints and supporting documents;

• technical information, including IP address, device and browser information, identifiers, pages viewed, timestamps, referring pages, security logs and cookie data; and

• records required for legal compliance, dispute resolution, information requests, security and audit purposes.

3.2 SAPCC does not intend to collect passwords in readable form, payment information through LUSOLINK, special personal information or children’s personal information.

Users must not submit such information unless SAPCC has expressly requested it through an appropriate secure process and lawful processing conditions have been confirmed.

​

4. Sources of information

4.1 SAPCC obtains information directly from Users and Submitters; from the relevant Business or its authorised representatives; from SAPCC’s existing membership or business records where compatible with the original purpose and lawful; from publicly available business sources; and automatically through the Platform and its service providers.

4.2 Where information is obtained from another person or a public source, SAPCC will take reasonable steps required by POPIA to notify the affected person, unless a lawful exception applies.

 

5. Purposes and lawful grounds

5.1 SAPCC processes personal information only where a lawful justification applies, including consent, performance of an agreement, compliance with law, protection of a legitimate interest of the person, or pursuit of SAPCC’s or a third party’s legitimate interests after appropriate balancing.

5.2 The principal purposes are to:

• create and administer accounts;

• receive, verify, moderate, publish, categorise, update and remove Listings;

• make approved Business contact information searchable and publicly available;

• communicate about submissions, verification, corrections, complaints and service matters;

• maintain the accuracy, integrity, availability and security of the Platform;

• understand aggregate use and improve accessibility, performance and functionality; prevent misuse, fraud, spam, unlawful scraping and security incidents;

• comply with POPIA, PAIA and other legal duties, and establish, exercise or defend legal claims; and

• send marketing only where separately consented to or otherwise lawfully permitted.

 

6. Public information

6.1 Approved Listing information is intentionally published on the internet and may be viewed, indexed, copied or cached by search engines and third parties. Public fields may include a contact person’s name, business email address and business telephone number if authorised for publication.

6.2 A Submitter must avoid supplying private residential addresses, private contact details or another person’s information unless publication is necessary, appropriate and authorised.

6.3 SAPCC will provide a reasonable mechanism to request correction, restriction or removal, but cannot guarantee immediate removal from independent search-engine caches or third-party copies outside its control.

 

7. Mandatory and voluntary information

7.1 Fields marked as required are necessary to create an account, assess a submission, administer the Listing or respond to a request. If required information is not supplied, SAPCC may be unable to provide that functionality.

7.2 Optional information may be omitted. Consent to electronic marketing must not be a condition of receiving a free Listing.

 

8. Recipients and operators

8.1 SAPCC may disclose personal information, only as reasonably necessary, to:

• the public, search engines and visitors where information forms part of an approved Listing;

• the relevant Business and its authorised representatives;

• website hosting, content-management, authentication, CAPTCHA, analytics, security, communications, backup and technical-support providers;

• professional advisers, insurers, auditors and service providers bound by appropriate duties;

• regulators, law-enforcement agencies, courts or other persons where required or permitted by law; and

• a successor operator if the Platform is lawfully transferred, subject to appropriate safeguards and notice.

8.2 Operators processing information for SAPCC must be bound by written terms requiring confidentiality, appropriate security and processing only with SAPCC’s authority, as required by POPIA.

 

9. Authentication and third-party services

9.1 If Users choose Google, Facebook or another third-party sign-in method, the provider may supply SAPCC with an authentication identifier, name, email address and other information shown during the sign-in process. The provider processes information under its own privacy terms.

9.2 The Platform is built or hosted using Wix services and may use service providers such as reCAPTCHA and error-monitoring or tag-management services. SAPCC will maintain an up-to-date cookie preference tool or schedule identifying the actual technologies in use.

 

10. Cookies and similar technologies

10.1 The Platform may use strictly necessary cookies for security, authentication, session management, load balancing and core functionality. These are required for the Platform to work.

10.2 Analytics, preference or marketing technologies will be used only in accordance with applicable law and the choices presented through the cookie settings tool. Users may change non-essential preferences at any time.

10.3 Blocking necessary cookies may prevent account, security or submission features from functioning. Browser settings may also be used to manage cookies, subject to those limitations.

 

11. Cross-border processing

11.1 Some technology providers or their support, resilience or backup systems may process information outside South Africa. SAPCC will permit cross-border transfers only where section 72 of POPIA is satisfied, including through adequate legal protection, binding contractual safeguards, consent where appropriate, or another lawful ground.

11.2 Further information about relevant service-provider locations and safeguards may be requested from the Information Officer.

 

12. Retention

12.1 SAPCC retains information only for as long as reasonably necessary for the purpose for which it was collected, or as required or authorised by law. The following indicative periods apply, subject to legal holds and justified exceptions:

• published Listing information: while the Listing remains active, followed by up to 12 months in routine systems and longer in secure backups until overwritten; rejected or abandoned submissions: ordinarily up to 12 months after the last activity;

• closed account records and acceptance evidence: ordinarily 5 years after closure or last relevant transaction;

• contact enquiries: ordinarily 2 years after final response;

• complaint, dispute, consent and takedown records: ordinarily 5 years after closure, or longer where reasonably required for a claim or law; and

• security and access logs: ordinarily 12 months, unless needed to investigate an incident.

12.2 At the end of the retention period, information will be securely deleted, destroyed, de-identified or retained in restricted form where required by law.

 

13. Security

13.1 SAPCC maintains reasonable technical and organisational measures appropriate to the nature of the information and foreseeable risks, including access controls, role-based administration, secure transmission, protected authentication, backups, software maintenance, monitoring and service-provider controls.

13.2 No internet service is completely secure. Users must protect account credentials and notify SAPCC promptly of suspected unauthorised access.

13.3 Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, SAPCC will investigate and notify the Information Regulator and affected data subjects as required by POPIA.

 

14. Direct marketing

14.1 A free Listing does not automatically subscribe a Submitter or contact person to SAPCC marketing.

14.2 Where consent is required for electronic direct marketing, SAPCC will request it separately, identify the sender and provide a functional means to opt out. Consent may be withdrawn and marketing communications may be unsubscribed from at any time.

14.3 SAPCC may still send necessary non-marketing communications about an account, Listing, security issue, enquiry or legal notice.

 

15. Rights of data subjects

15.1 Subject to POPIA and PAIA, a data subject may request confirmation of processing and access to personal information; request correction, deletion or destruction of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information; object to certain processing; withdraw consent where processing is based on consent; and complain to SAPCC or the Information Regulator.

15.2 Requests should be sent to admin@sapcc.co.za and should provide sufficient information to identify the requester, relevant records and requested action. SAPCC may take reasonable steps to verify identity and authority before acting.

15.3 Rights are not absolute. SAPCC may retain or refuse access to information where authorised or required by law, and will explain the applicable basis where required.

 

16. Children

16.1 Accounts and Listing submissions are restricted to persons aged 18 or older. SAPCC does not knowingly solicit children’s personal information through LUSOLINK. If such information has been submitted, a parent, guardian or competent person should contact the Information Officer promptly.

 

17. Complaints and regulator

17.1 Privacy queries and complaints should first be addressed to SAPCC’s Information Officer, Rui Marto, at rui@sapcc.co.za, +27 11 616 6420, or 11 Smith Street, Bedfordview, Gauteng, 2007.

17.2 A person may also complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, Johannesburg, 2017; enquiries@inforegulator.org.za; complaints.IR@inforegulator.org.za; telephone 010 023 5200; www.inforegulator.org.za.

These details should be checked at the time of use.

 

18. Changes to this Notice

18.1 SAPCC may update this Notice to reflect legal, operational or technical changes. The revised version and effective date will be published on the Platform. Material changes may also be communicated by email or account notice where appropriate.