Privacy Notice

Last updated: 18 August 2026

Who we are

Escience Associates (Pty) Ltd (“we”, “us”, “our”) is the responsible party for the personal information described in this notice. Our Information Officer is Theo Ernst Fischer, who can be reached at theo@escience.co.za or on 011 718 6380.

This notice explains what personal information we collect about you, why we collect it, who we share it with, how long we keep it and what rights you have. It is given to you in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA).

What information we collect

Depending on your relationship with us, we may collect and hold the following:

• Names, email addresses and telephone numbers
• Physical and postal addresses
• Identity and passport numbers, including copies of identity documents
• Banking details
• Tax numbers and tax records
• Payroll and employment records
• CVs and recruitment records
• Health and medical information
• Criminal and disciplinary records
• Race, religion, political persuasion and trade union membership
• CCTV footage, photographs, voice notes and call recordings
• Website tracking, cookie and analytics data
• Invoices, statements, contracts and financial documents
• Vehicle tracking and location data

Some of this is special personal information under POPIA. We process it only where the Act permits, we keep it separately, and we restrict who can see it.

Where we get it from

• Directly from the person concerned
• From public sources
• From our CCTV and access control systems
• Automatically between our connected systems

Why we use it

We use personal information for the following purposes:

• To deliver our products and services
• To prepare quotations and respond to enquiries
• To invoice, collect payment and maintain accounting records
• To employ, pay and manage our staff
• To meet our legal and regulatory obligations
• To market our services to existing and prospective clients
• To secure our premises and systems
• To verify identity and carry out required checks
• To recruit staff

We process your information because it is necessary to perform a contract with you, because a law requires it, because it is necessary for our legitimate interests in running the business, or because you have consented. We do not need your consent for most of what we do, and where we rely on consent you may withdraw it at any time.

Who we share it with

We do not sell your personal information. We share it only where there is a lawful basis and only with those who need it:

• Our professional advisers, including our accountants, auditors and attorneys
• Our banks and payment providers
• Government bodies where the law requires it, including SARS
• The UIF, the Compensation Fund and our payroll provider, in respect of employees
• The service providers that host our systems and support our business, listed below

Every outside service provider that processes personal information for us is bound by a written agreement requiring it to apply appropriate security measures and to notify us immediately of any security compromise.

Information sent outside South Africa

Some of the systems we use store or process information outside South Africa. This happens because we use widely-used cloud services for email, file storage and business software. Where information is transferred outside the country we rely on section 72 of POPIA: the recipient is subject to binding rules or a binding agreement that provides a level of protection substantially similar to POPIA, and the transfer is necessary for the performance of our contract with you.

CCTV

We operate CCTV cameras at our premises to protect people and property. Notices are displayed at the entrances. Footage is kept for a limited period on a rolling basis and is then automatically overwritten, unless it is needed for a specific incident or required by law.

How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires. Financial records are generally kept for 7 years under the Companies Act and 5 years under the Tax Administration Act; employee records for the periods set by labour legislation; and everything else for the period set out in our retention schedule. When the period ends we destroy or delete the information so that it cannot be reconstructed.

How we protect it

We apply appropriate, reasonable technical and organisational measures as section 19 of POPIA requires. These include individual user accounts, multi-factor authentication on our email and cloud systems, encryption of laptops, restricted access to sensitive files on a need-to-know basis, regular tested backups, prompt removal of access when someone leaves, and secure storage of paper records.

Your rights

Under POPIA you have the right to:

• Ask us what personal information we hold about you, and get a copy of it.
• Ask us to correct information that is wrong, out of date, incomplete or misleading.
• Ask us to delete or destroy information we are no longer entitled to keep.
• Object to our processing of your information where we rely on legitimate interests.
• Withdraw your consent at any time, where we rely on consent.
• Object to direct marketing at any time, free of charge.
• Complain to us, and to the Information Regulator.

You may make a request in whatever way is most convenient for you — in person, by post, by email, by SMS or by WhatsApp. If you make a request by telephone we will record it and can give you a transcript. We will respond within 30 days. There is no charge for correcting or deleting information, or for objecting; a prescribed fee may apply to a request for copies of records.

How to contact us

Complaining to the Regulator

If you are not satisfied with how we have handled your information or your request, you may complain to the Information Regulator. A complaint is made on Form 5 or through the Regulator's eServices portal, and the Regulator must acknowledge it within 14 days.

Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, Johannesburg, 2017. Telephone 010 023 5200. General enquiries: enquiries.IR@inforegulator.org.za. PAIA complaints: PAIAComplaints.IR@inforegulator.org.za. POPIA complaints: POPIAComplaints.IR@inforegulator.org.za. Website: https://inforegulator.org.za

Changes to this notice

We review this notice at least once a year and whenever our systems, our providers or the law change. The date at the top of this notice shows when it was last updated.