Category Management Tools

Privacy and POPIA notice

Effective 2 November 2026

1. About this notice

This notice explains how Category Management Tools (“the site”) collects, uses, stores and protects personal information, as required by the Protection of Personal Information Act 4 of 2013 (POPIA). The site is an internal business tool for authorised users only and is not offered to the public.

2. Who is responsible

The site is built and administered by Cornel Jordaan (“the administrator”) for internal business use. Questions about this notice, and requests about your personal information, can be sent to the administrator at cornel.jordaan@spar.co.za. Requests about your employer’s own records may also be sent to your employer’s Information Officer.

3. Personal information we process

• Account details: your name, work email address, sign-in status and security events (for example failed sign-ins), handled by the sign-in service.
• Access settings: the regions, tools, reports and job title assigned to your account.
• Usage records: which tools you open and roughly how long they are in use. Kept for 30 days.
• Error records: error messages, the page where they occurred and the account that saw them. Kept for 90 days.
• Business planning information: product, range, space, sales and store information that authorised users import. The store list may include the names of field managers.
• Minute Book: minutes, attendee names, discussion notes, action items and to-dos that you record. These are private to you (see section 7).
• Information on your device: cookies needed for sign-in, and browser storage used to recover unsaved work and to let Minute Book work offline.

The site does not ask for special personal information (such as health, religious or biometric information), information about children, or identity or bank account numbers. Please do not enter it.

4. Why we process it

• To sign you in, confirm who you are and give you only the tools and regions assigned to you.
• To provide the planning tools, reports and Minute Book.
• To keep the site secure, find and fix faults, and understand which tools are used.

Processing is necessary for these purposes and for the legitimate business interests of the organisation the site serves (section 11(1)(f) of POPIA), and is limited to what those purposes need.

5. Service providers and transfers outside South Africa

The site uses the following service providers (operators) to process information on its behalf:

• Clerk for sign-in and account management.
• Vercel to host and run the website.
• Supabase to store the site’s data, including Minute Book records.
• Anthropic, only when you use Rewrite notes in Minute Book: the notes you choose to rewrite are sent to be reworded and the result is returned to you.

These providers may store or process information outside South Africa. They are used under their terms of service and data-processing terms, and each receives only the information it needs to provide its service. Transfers are made in line with section 72 of POPIA.

6. How we protect it

• Every page and request requires you to be signed in, and access is limited to the tools and regions assigned to you.
• Information travels over encrypted connections, and database keys are kept on the server, never in the browser.
• New accounts receive no access until the administrator assigns it.

If we believe personal information has been accessed or acquired without authorisation, the affected people and the Information Regulator will be notified as section 22 of POPIA requires.

7. Minute Book

Minutes you record are visible only to you. The site reads, saves and deletes only the signed-in person’s own records, and other users, including administrators, cannot see them in the site. When you delete minutes they are removed from your view and marked as deleted; ask the administrator if you need them removed permanently. Keep minutes factual and work-related, and record only the personal details of attendees that the meeting record needs.

8. How long we keep it

Usage records are kept for 30 days and error records for 90 days. Account details are kept while your account is active and removed when it is closed. Business planning information and minutes are kept until they are deleted or are no longer needed for business purposes, unless a law requires them to be kept longer.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request a copy (section 23);
• ask for it to be corrected or deleted if it is inaccurate, out of date, excessive or no longer needed (section 24);
• object to its processing on reasonable grounds (section 11(3)); and
• lodge a complaint with the Information Regulator (section 74).

Send requests to cornel.jordaan@spar.co.za. We may need to confirm your identity before acting on a request.

10. Your responsibilities

Enter only the personal information your work needs, keep your sign-in details to yourself, and report suspected unauthorised access or loss of information to the administrator straight away.

11. Changes to this notice

This notice may be updated when the site or the law changes. The effective date above shows the latest version.