POPIA Compliance Statement

1. Our Commitment

Yotta acts as both a responsible party and an operator of personal information, depending on the context. We are committed to processing personal information lawfully, fairly, and transparently, and only for purposes that are adequate, relevant, and not excessive. We implement reasonable technical and organisational measures to safeguard personal information against unauthorised access, loss, or misuse.

2. Information Officer

Yotta has designated an Information Officer responsible for ensuring compliance with POPIA. The Information Officer is the point of contact for the Information Regulator and for any data subject who wishes to exercise their rights under POPIA. Requests may be submitted to hello@yotta.co.za or through our contact page.

3. Conditions for Lawful Processing

We process personal information in accordance with the conditions for lawful processing set out in POPIA, including:

• Accountability: We remain accountable for the personal information under our control.
• Purpose specification: Personal information is collected for a specific, explicitly defined, and lawful purpose.
• Further processing limitation: Further processing of personal information is compatible with the purpose for which it was collected.
• Information quality: We take reasonable steps to ensure personal information is complete, accurate, and up to date.
• Openness: We maintain transparency about the personal information we collect and how it is used, as detailed in our Privacy Policy.
• Security safeguards: We implement reasonable technical and organisational measures to secure personal information.
• Data subject participation: Data subjects may exercise their rights to access, correct, or delete their personal information.

4. Data Security Measures

We implement a range of security safeguards to protect personal information, including encrypted data transmission (TLS 1.2+), access controls based on role and identity, secure session management, and regular security reviews. Access to personal information is restricted to authorised personnel who require it to perform their duties. All access is logged and monitored.

5. Data Subject Rights

In accordance with POPIA, data subjects have the right to:

• Be notified when their personal information is collected;
• Access the personal information we hold about them;
• Request correction or deletion of inaccurate personal information;
• Object to the processing of their personal information on legitimate grounds;
• Withdraw consent where processing is based on consent.

Data subject requests are processed within a reasonable timeframe, and no later than 30 days from receipt. Requests can be submitted to hello@yotta.co.za.

6. Breach Notification

In the event of a confirmed data breach involving personal information, Yotta will take immediate steps to contain and assess the breach. Where the breach poses a risk to the rights and freedoms of data subjects, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with POPIA requirements.

7. Compliance Review

Yotta conducts periodic reviews of its data protection practices and compliance posture. Our compliance status is tracked through an internal compliance programme covering policy documentation, security controls, data handling practices, consent management, and incident response readiness.

8. Related Documents

This statement should be read together with our Privacy Policy, Terms of Service, Data Processing Agreement, and B2B Data Policy.

9. Contact Us

If you have any questions about this POPIA Compliance Statement or wish to exercise your data subject rights, please contact us at hello@yotta.co.za or through our contact page.