Who we are

 Melon Consulting (Pty) Ltd ("Melon Consulting," "we," "us," or "our") is the responsible party as defined under POPIA. We determine the purpose and means of processing your personal information.

RESPONSIBLE PARTY DETAILS

Company name: Melon Consulting (Pty) Ltd

Registered address: [Insert registered address]

Information Officer: [Insert name of Information Officer]

Contact email: privacy@melonconsulting.com

Contact telephone: [Insert telephone number]

Our Information Officer is responsible for ensuring compliance with POPIA and has been registered with the Information Regulator as required by the Act.

What personal information we collect

We collect and process personal information that is necessary for our legitimate business purposes. Depending on how you interact with us, this may include:

CONTACT AND IDENTIFICATION INFORMATION

• Full name and job title
• Business email address and telephone number
• Company name and business address

ENGAGEMENT AND COMMUNICATION INFORMATION

• Information you provide when completing forms on our website, including the "Contact Us" and "Book a discovery call" forms
• Correspondence and communications with our team via email, telephone or in person
• Notes and records from meetings, proposals or client engagements

TECHNICAL AND WEBSITE INFORMATION

• IP address, browser type and version, device type and operating system
• Pages visited on our website, time spent on pages and referring URLs
• Cookie data and website usage information (see section 11)

PROFESSIONAL BACKGROUND INFORMATION

• Where relevant to a consulting engagement or employment inquiry, professional experience, qualifications and skills

We do not intentionally collect special personal information (as defined by POPIA) such as race, health information, biometric data or criminal history, unless specifically required for a regulated engagement and with your explicit consent. 

How we collect your personal information

 We collect personal information directly from you in most cases, including when you:

• Complete a contact, enquiry or callback form on our website
• Book a discovery call or request a capability overview
• Correspond with us by email or telephone
• Attend an event or webinar hosted or co-hosted by Melon Consulting
• Engage with us as a client, prospective client, supplier or business partner
• Apply for a position with Melon Consulting

In some cases, we may receive your personal information from third parties, such as referrals from existing clients, professional networking platforms, or publicly available business directories. Where this occurs, we will inform you that we hold your information at the earliest practical opportunity.

Why we collect your personal information

 We process your personal information only for specific, clearly defined purposes. These include:

• Responding to enquiries and requests you submit through our website or by other means
• Providing consulting, implementation, support and advisory services to our clients
• Managing our client and business relationships, including the preparation and execution of contracts
• Sending you relevant information about our services, capabilities and industry insights where you have consented or where we have a legitimate interest to do so
• Improving the functionality, content and user experience of our website
• Complying with legal, regulatory and contractual obligations
• Evaluating applications from prospective employees or contractors
• Protecting the security and integrity of our systems, data and business operations

We will not use your personal information for purposes that are incompatible with those for which it was originally collected without obtaining your consent or establishing a new lawful basis for doing so.

Lawful basis for processing

Under POPIA, we are required to have a lawful basis for processing your personal information. We rely on the following bases depending on the nature of the processing activity:

• Consent— where you have provided us with voluntary, specific and informed consent, including for direct marketing communications and the use of non-essential cookies
• Contractual necessity— where processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract
• Legal obligation— where processing is necessary to comply with a legal or regulatory obligation
• Legitimate interest— where processing is necessary for our legitimate business interests, such as responding to business enquiries, maintaining client relationships, or improving our services — provided these interests are not overridden by your right to privacy

Who we share your personal information with

We do not sell, rent or trade your personal information to any third party. We may share your personal information with third parties only in the following circumstances:

• Service providers and operators— third-party providers who assist us in operating our website, managing our communications, or delivering our services (such as cloud hosting providers, email platforms and CRM systems). These providers are bound by written agreements to maintain appropriate security measures and may only process your information on our instruction
• Professional advisors— lawyers, auditors and accountants where necessary in connection with our legal and compliance obligations
• Regulatory and law enforcement bodies— where we are required to do so by law, court order or regulatory authority, including the South African Information Regulator
• With your consent— in any other circumstances, only where you have given us explicit permission to share your information

Cross-border transfers of personal information

As a consulting firm operating across Africa, we may on occasion transfer personal information to parties located outside of South Africa — for example, where we use cloud-based tools hosted on international infrastructure or engage with clients in other African countries.

Where such transfers occur, we ensure that appropriate safeguards are in place as required by Section 72 of POPIA. This includes ensuring that the recipient country or organisation provides an adequate level of data protection, or that appropriate contractual protections are in place before any transfer is made.

We will not transfer your personal information outside South Africa in a manner that fails to meet the requirements of POPIA.

How long we keep your personal information

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Website enquiry and contact form data — retained for up to 24 months unless an ongoing business relationship develops
• Client engagement records — retained for a minimum of 5 years following the conclusion of the engagement, in line with applicable legal and contractual requirements
• Marketing consent records — retained for as long as consent remains active, and for 12 months following withdrawal
• Employment applications — retained for 12 months following the conclusion of a recruitment process, unless an employment relationship results
• Website analytics data — retained in accordance with our analytics provider's data retention settings, typically 26 months

Once personal information is no longer required, we will delete or de-identify it securely in accordance with our data retention procedures.

How we protect your personal information

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration or disclosure. These measures include:

• Encryption of data in transit and at rest
• Access controls limiting personal information to authorised personnel on a need-to-know basis
• Regular security reviews and assessments of our systems and processes
• Contractual security obligations imposed on all third-party service providers who handle personal information on our behalf
• Staff training on data protection responsibilities and POPIA compliance

In the event of a security compromise affecting your personal information, we will notify the South African Information Regulator and, where required, affected data subjects as soon as reasonably possible in accordance with Section 22 of POPIA and the 2025 Amendment Regulations.

Your rights as a data subject

POPIA grants you the following rights in relation to your personal information. You may exercise any of these rights by contacting our Information Officer using the details in section 14.

• Right to access - You may request confirmation of whether we hold personal information about you and, if so, request access to that information.
• Right to correction - You may request that we correct or update any personal information that is inaccurate, incomplete or misleading.
• Right to deletion - You may request that we delete or destroy your personal information where it is no longer necessary for the purpose for which it was collected.
• Right to object - You may object to the processing of your personal information, including for direct marketing purposes, at any time.
• Right to withdraw consent - Where we rely on consent as our lawful basis, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint - You have the right to lodge a complaint with the South African Information Regulator if you believe your rights under POPIA have been infringed.

SOUTH AFRICAN INFORMATION REGULATOR CONTACT DETAILS

Website: www.inforegulator.org.za  ·  Email: inforeg@justice.gov.za  ·  Telephone: 010 023 5207

Cookies and website tracking

Our website uses cookies and similar tracking technologies to improve your experience, understand how our website is used, and — where you have consented — to support our marketing activities.

TYPES OF COOKIES WE USE

• Strictly necessary cookies— essential for the website to function. These do not require your consent
• Analytics cookies— help us understand how visitors interact with our website by collecting aggregated, anonymous data. We will only place these with your consent
• Marketing cookies— used to deliver relevant content and track the effectiveness of our marketing. We will only place these with your explicit consent

When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You may change your cookie preferences at any time through the cookie settings available on our website.

Under POPIA and the 2025 Amendment Regulations, your consent to the use of non-essential cookies must be voluntary, specific and informed. We do not use cookies to process special personal information or to track your activity across third-party websites without your explicit consent.

Direct marketing

We may from time to time send you information about our services, capabilities, industry insights or events that we believe may be of interest to you. We will only do so where:

• You have given us your explicit consent to receive such communications, or
• You are an existing client or business contact and the communication relates to similar services to those we have previously provided, and you have not objected to receiving such communications

You may opt out of receiving direct marketing communications from us at any time by clicking the "unsubscribe" link in any email we send, or by contacting us directly at privacy@melonconsulting.com. We will action your request promptly and without charge.

Changes to this Privacy Policy

We review this Privacy Policy periodically and will update it as required to reflect changes in our data processing activities, applicable law, or regulatory guidance — including any further amendments to POPIA or guidance issued by the Information Regulator.

When we make material changes to this Policy, we will update the "Last updated" date at the top of this page and, where appropriate, notify affected individuals by email or through a prominent notice on our website. We encourage you to review this Policy periodically.

How to contact us

If you have any questions about this Privacy Policy, wish to exercise your rights as a data subject, or wish to raise a concern about how we handle your personal information, please contact our Information Officer:

MELON CONSULTING INFORMATION OFFICER

Email: info@melonconsulting.com

Telephone: 021 975 5102

Postal address: P.O.Box 2397, Durbanville, Cape Town, 7550

We will acknowledge your request within 3 business days and aim to respond in full within 30 days. Complex requests may take longer, in which case we will keep you informed of progress.