We are committed to protecting personal information and meeting our obligations under South Africa’s Protection of Personal Information Act (POPIA).
This interim notice describes the public website and enquiry mailbox. It is not a certification of compliance or a complete privacy notice for broker-controlled application records. Provider details and operational arrangements still being confirmed are identified below.
Who is responsible and how to contact us
Company: My Personal Broker (Pty) Ltd (registration number 2026/826785/07).
Business address: 2 Mowbray St, Newton Park, Gqeberha, 6045.
Website: https://www.mpbroker.co.za. Email: info@mpbroker.co.za.
Dewald Johan Herselman is our privacy and access contact and nominated Information Officer. Information Officer registration with the Information Regulator has not yet been confirmed.
Dewald Johan Herselman monitors the mailbox and handles access, correction and deletion requests and reports of suspected disclosures. Please email info@mpbroker.co.za; do not send passwords or unnecessary identity documents.
Information collected and why
The website enquiry form collects your name, email address and consent to respond. Business/brokerage name, phone number and message are optional. Direct email includes the information you choose to send. We use this information to respond to enquiries, discuss requested software services and maintain necessary correspondence.
Name, a valid email and enquiry consent are required to submit the form; without them it will not submit. You may instead contact us by email. The consent covers responding to your enquiry, not a newsletter or unrelated direct marketing. You may withdraw consent by email without retrospectively invalidating lawful prior processing.
Requested pre-contractual steps, legal obligations and justified legitimate interests may provide other lawful grounds where applicable. Technical information is used for website delivery, aggregate usage measurement, troubleshooting and abuse prevention. A general enquiry is not blanket permission for unrelated reuse.
We do not sell enquiry information. Do not send ID numbers, medical information, policy files, claim evidence, passwords or signatures through general enquiries. Use your broker’s appropriate secure channel.
Website hosting, analytics and abuse prevention
The website uses Vercel hosting and Vercel Web Analytics. Hosting may process IP addresses, requested URLs, timestamps and browser/device information. Analytics measures aggregate page visits, referrers, approximate location and device/browser categories. We do not intentionally send enquiry text to analytics.
Vercel describes its default Web Analytics as cookie-free. This does not mean that no personal information is processed or that every security service behaves identically.
When the enquiry form is enabled, Vercel BotID uses browser/request signals to assess automation. Our contact endpoint also uses server-side validation, a honeypot and short-lived in-memory IP rate limits. The in-memory rate-limit entries expire after 15 minutes; this does not describe Vercel’s own log retention.
TrustedSite public-website trustmark
The public website loads TrustedSite’s official trustmark code on its public marketing and legal pages. The code requests our domain configuration, records visits and displays certification information when available. Requests to TrustedSite and its configuration host can disclose technical information such as your IP address, browser/device information and the website host. Opening the verification details also contacts TrustedSite.
TrustedSite’s code uses a visit marker in a first-party cookie and local storage with a 24-hour expiry, plus a short-lived cookie to remember the floating badge’s display state. These support visit counting and badge behaviour. This is separate from Vercel’s cookie-free analytics; we do not claim that the website is cookie-free.
We do not configure TrustedSite purchase-conversion tracking or intentionally supply enquiry field values to this integration. The code is excluded from the separate broker/customer application in this website release. Any displayed badge reflects TrustedSite’s current certification for the public website; it is not a certification of POPIA compliance or an audit of authenticated application security. TrustedSite’s privacy information is linked below. Its processing locations, retention and applicable provider/transfer arrangements remain subject to the provider limitations described in this notice.
Email providers and access
Website form enquiries are delivered through Pingram to our enquiry mailbox. The name, email and optional business, phone and message fields are passed to the delivery provider.
Our enquiry mailbox is hosted by HOSTAFRICA in South Africa. This mailbox-hosting location is based on the company owner’s confirmation; it is not a statement that every website provider processes information only in South Africa.
Within the company, only Dewald Johan Herselman currently has access to the enquiry mailbox. Email delivery and mailbox providers also process information needed to supply their services.
Hosting, security and communication providers process information for their respective roles. Disclosures to regulators, courts or law enforcement may be required by law and must be limited to the relevant purpose and necessary information.
Provider locations and arrangements being confirmed
Vercel, Pingram and other cloud services may process information outside South Africa. The mailbox’s South African hosting location does not establish the locations of backups, filtering, support access or other providers.
We are still confirming provider-specific processing countries, onward recipients, retention periods, backup deletion cycles and applicable contractual and international-transfer protections. We cannot currently confirm that all information remains in South Africa or that every provider arrangement has been verified.
Any transfer outside South Africa must meet the applicable requirements of section 72 of POPIA. This interim notice does not itself establish a lawful transfer ground, replace a required operator agreement or certify a provider’s safeguards. Contact us for the latest available information before sending sensitive material.
Retention and deletion
We retain website enquiries and email correspondence only for as long as necessary to handle enquiries, maintain relevant business records and meet applicable legal obligations. We periodically review these records and securely delete or de-identify personal information as soon as reasonably practicable when there is no longer a lawful reason to retain it.
Dewald Johan Herselman is responsible for those reviews and deletion requests. We are introducing this review-and-deletion approach; review scheduling and provider/backup deletion arrangements are still being finalised. This is not a claim that historic reviews or provider deletions have already been completed.
A deletion request may be subject to lawful retention requirements. We will explain any lawful restriction or refusal. Deletion from the mailbox does not necessarily immediately remove copies held in provider backups.
Broker records and software-provider roles
Brokers ordinarily decide why and how client insurance records are processed and act as responsible parties. My Personal Broker supplies administration software and ordinarily processes those records on authorised broker instructions as an operator. We have our own responsible-party obligations for purposes we independently determine.
This website notice does not set application retention periods or verify application storage locations, security controls or handling of specially protected information. Broker-controlled insurance records require the relevant broker/service notices, lawful grounds and agreements. Contact your broker about those records; you may also contact us to route a request. These distinctions do not remove applicable rights or our own obligations.
Your rights and complaints
You may request confirmation of information held, access, correction or deletion where applicable; object on the grounds available under POPIA; or withdraw consent for processing based on consent. Email info@mpbroker.co.za. Proportionate identity verification may be needed to protect other people’s information.
You may complain to the Information Regulator. Its official contact and POPIA forms pages are linked below. Our access-to-information page explains the current request route while the PAIA manual is being finalised. A request need not wait for that manual.
Safeguards and suspected disclosures
We are committed to appropriate, reasonable technical and organisational safeguards and limited authorised access. Website contact protections include validation, abuse controls and request limits. No system can guarantee that a compromise will never occur.
Report suspected disclosures to Dewald Johan Herselman at info@mpbroker.co.za, without unnecessary sensitive attachments. Dewald coordinates reports; escalation, absence cover and tested incident-response arrangements are still being finalised.
Where acting as an operator, qualifying suspected compromises must be reported to the responsible party immediately. Where acting as a responsible party, required notifications to the Information Regulator and affected people must be made as soon as reasonably possible, subject to POPIA’s statutory qualifications. An investigation is not a blanket reason to delay required reporting.
Changes to this notice
We will review this notice as company details, purposes, providers and confirmed arrangements change. Material changes should be brought to affected people’s attention. Publishing an updated notice does not create consent to a new purpose or postpone existing legal obligations.