Privacy Policy

1. Who we are

LE LIEN is a South African private company (registration 2023 / 789661 / 07) providing professional services and specialist product sourcing. Its registered and physical contact address is 18 Swempie Crescent, Liefde en Vrede, Johannesburg South, Gauteng, 2190.

For purposes of its own processing, LE LIEN acts as the responsible party unless a written arrangement provides otherwise for a particular activity. Kevin Tolmay is the Information Officer.

2. Scope of this policy

This policy applies to personal information processed through LE LIEN business operations, its website and communications, Relay CRM and invoicing functions, Lumen document management, product sourcing and fulfilment, supplier and contractor administration, visitor records, marketing and compliance activities.

Where a client supplies or uploads documents to Lumen, those documents may contain personal information about people other than the client. LE LIEN processes that information only within the approved service purpose, contractual instructions and applicable legal requirements.

3. Whose information we process

• Individual clients and business clients, including their directors, employees, representatives and contacts.
• Prospective clients and leads.
• Suppliers, specialist product providers, couriers and other service providers.
• Contractors and other authorised personnel.
• Visitors to LE LIEN premises.
• People whose information appears in documents supplied or uploaded by clients.

4. Personal information we may collect

• Names, identity information and identification documents where required.
• Business and company details, addresses, email addresses and telephone numbers.
• Correspondence, support communications and other client communications.
• Contracts, quotations, orders and invoices.
• Payment and transaction references. LE LIEN does not ordinarily retain full payment-card credentials.
• Delivery and fulfilment information.
• Supplier and contractor information, including contracts, payment details, work records and authorised system-access information.
• Marketing, enquiry and prospect records.
• Visitor-register information, including name, company, person visited, arrival/departure details and staff confirmation.
• Documents and content supplied or uploaded to Lumen by LE LIEN, its clients or authorised client users.

5. Special personal information, children and sensitive documents

LE LIEN does not ordinarily seek to collect children's information or special personal information for its own routine business purposes. However, client-controlled documents stored in Lumen may contain children's information, health information, biometric information, criminal information, information concerning race or ethnic origin, religious or philosophical beliefs, trade-union membership, sex life or sexual orientation, identity information, financial information or other sensitive content.

Where such information is present, LE LIEN will process it only for the approved service purpose and where the applicable POPIA requirements, authorisations, contractual instructions and safeguards permit that processing. Clients remain responsible for ensuring that information they instruct LE LIEN to process has been collected and supplied lawfully.

6. How we obtain personal information

• Directly from clients, prospective clients, suppliers, contractors and visitors.
• From authorised client users and documents uploaded to Lumen.
• Through website and social-media enquiries, email, telephone and other correspondence.
• Through referrals and existing customer relationships.
• Through LE LIEN-curated prospecting using publicly available business information. LE LIEN does not purchase lead lists.
• From payment, delivery and service providers where necessary to administer a transaction or service.

7. Why we process personal information

LE LIEN processes personal information for legitimate and defined business purposes, including:

• Providing professional services and specialist product sourcing.
• Client and supplier onboarding and administration.
• Preparing and managing quotations, orders, contracts and invoices.
• Receiving and recording payments and transaction references.
• Managing customer relationships, communications and support.
• Operating Lumen document-management services and Relay CRM/invoicing functions.
• Delivering products and coordinating couriers or specialist suppliers.
• Managing contractors, service providers and authorised access.
• Marketing LE LIEN services and responding to enquiries.
• Maintaining security, audit and visitor records.
• Meeting legal, tax, accounting, regulatory, contractual and governance obligations.
• Establishing, exercising or defending legal rights and responding to privacy or access requests.

8. Grounds for processing

Depending on the activity, LE LIEN processes personal information where the data subject has consented; where processing is necessary to conclude or perform a contract or requested service; where processing is required by law; where processing protects a legitimate interest of the data subject; or where processing is necessary to pursue a legitimate interest of LE LIEN or a third party in a manner permitted by POPIA. Additional requirements are applied where POPIA regulates special personal information, children's information, direct marketing or other restricted processing.

9. Mandatory and voluntary information

Providing personal information is generally voluntary. Certain information is nevertheless necessary to enter into or perform a contract, fulfil an order, verify identity where required, deliver a product, process an invoice or payment record, meet a legal obligation, provide requested functionality or maintain appropriate security. If required information is not provided, LE LIEN may be unable to provide the relevant service or complete the requested transaction.

10. Marketing and prospecting

LE LIEN may maintain marketing and contact records for enquiries, existing clients and prospective business contacts. Prospecting information may be curated from publicly available sources and direct business interactions. LE LIEN does not purchase lead lists.

Electronic direct marketing is conducted subject to applicable POPIA requirements, including consent or the rules applicable to existing customer relationships where relevant. Marketing communications should provide an appropriate means to opt out, and an objection or opt-out will be recorded and respected.

11. Lumen document management

Lumen is used to store and manage business documents and related metadata. Access is restricted according to authorised roles and permissions. Client-controlled documents remain subject to the applicable client-approved retention policy, contractual requirements and lawful instructions.

Because clients may upload a wide variety of business documents, the exact categories of personal information within a client-controlled document depend on the client's content. LE LIEN does not treat the ability to store a document as authority to use its contents for unrelated purposes.

12. Artificial intelligence processing

LE LIEN may use approved OpenAI functionality through Lumen for AI-assisted processing. Live client information or client-controlled document content may be submitted to OpenAI only where the relevant client has approved that processing and the applicable privacy, contractual, transfer and security requirements have been satisfied.

AI processing is an optional governed processing activity. Approval to use AI for one purpose does not constitute permission to use client information for unrelated purposes.

13. Who may receive personal information

Personal information is disclosed only where reasonably necessary for an approved purpose. Recipients may include authorised LE LIEN personnel and contractors, and the following operators or service providers:

• Darkflame, for technology services supporting Lumen and Relay, software development, technical support, hosting, email/domain services and administration of approved technology services.
• Amazon Web Services (AWS), for Lumen cloud infrastructure including EC2, S3, KMS and associated services. Lumen-hosted infrastructure is configured in the Cape Town (af-south-1) region.
• OpenAI, for separately approved AI-assisted processing subject to client approval where client information is submitted.
• First National Bank (FNB), for banking and financial transaction services.
• Yoco, for payment processing.
• Couriers and delivery providers, where recipient and delivery information is required for fulfilment.
• Specialist suppliers, including international suppliers where necessary to fulfil an approved customer order.
• Professional advisers, contractors and other service providers appointed as operationally required and subject to appropriate safeguards.

14. Cross-border processing and transfers

Core Lumen hosting and storage is configured in South Africa. Cross-border processing may nevertheless occur where LE LIEN uses approved overseas specialist suppliers or technology providers, including OpenAI where applicable.

LE LIEN limits a cross-border disclosure to information necessary for the approved purpose and applies applicable contractual, security and POPIA section 72 requirements. Client approval is obtained where required by the approved processing arrangement.

15. Security safeguards

LE LIEN uses organisational and technical safeguards appropriate to the information and processing activity. Controls recorded for Lumen and related governance include:

• Role-based and least-privilege access controls.
• Mandatory TOTP multi-factor authentication for governed Lumen access.
• Tenant segregation and controlled document storage.
• Encryption of stored documents and protected information.
• Audit logging and evidence preservation.
• Malware scanning and quarantine controls.
• Access reviews and controlled privileged access.
• Visitor registers and physical access controls where applicable.
• Backup and recovery controls.
• Documented incident escalation to the Information Officer and security-compromise response procedures.

No security measure can eliminate every risk. Suspected security compromises are contained, assessed, documented and notified to the Information Regulator and affected data subjects where required by law.

16. Retention and deletion

LE LIEN retains personal information only for an approved operational, legal or contractual period. Expiry triggers review and does not automatically authorise deletion. Legal, investigation, dispute, statutory-preservation and unresolved privacy-request holds suspend disposition.

Client-controlled documents stored in Lumen remain subject to applicable client-approved retention requirements, contractual requirements and lawful instructions. A longer applicable statutory, contractual or client-approved period takes precedence. Controlled deletion in Lumen requires two distinct authorised approvers in accordance with LE LIEN governance controls.

17. Your rights

Subject to POPIA, PAIA and applicable limitations, a data subject may request confirmation of whether LE LIEN holds personal information about them and may request access to that information. A data subject may also request correction or deletion of inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information; object to processing in circumstances permitted by law; withdraw consent where processing depends on consent; and object to qualifying direct marketing.

LE LIEN may need to verify the requester's identity and authority before disclosing, changing or deleting information. A request may be refused or limited where law permits or requires this, including where another person's rights, a legal obligation, a valid retention requirement or a legal hold prevents the requested action.

18. How to make a privacy or access request

Requests should be submitted to the Information Officer using the contact details below. Please describe the information or processing concerned and provide sufficient information for LE LIEN to authenticate the request and locate the relevant records.

Information Officer: Kevin Tolmay
Email: info@le-lien.co.za
Telephone: 063 229 9221
Address: 18 Swempie Crescent, Liefde en Vrede, Johannesburg South, Gauteng, 2190

Formal access requests may also be handled under LE LIEN's PAIA Manual.

19. Complaints

A privacy concern should first be raised with LE LIEN's Information Officer so that it can be investigated and addressed. A data subject may also lodge a complaint with the Information Regulator of South Africa using the Regulator's current official complaint channels. Current contact and complaint information is available from inforegulator.org.za.

20. Website technologies and cookies

LE LIEN's website may use technical cookies or similar technologies required to operate, secure and maintain website functionality. Where analytics, marketing or other non-essential technologies are introduced, LE LIEN will provide appropriate notice and controls where required. Information submitted through website forms is handled in accordance with this policy.

21. Changes to this policy

LE LIEN may update this policy from time to time to reflect changes in law, operations or services. Updated versions will be published at the public location listed above.

22. Contact details

LE LIEN
Registration: 2023 / 789661 / 07
Information Officer: Kevin Tolmay
Email: info@le-lien.co.za
Telephone: 063 229 9221
Registered office: 18 Swempie Crescent, Liefde en Vrede, Johannesburg South, Gauteng, 2190
Website: www.le-lien.co.za
Privacy policy: www.le-lien.co.za/privacy