POPIA Privacy Notice

Effective date: 14 October 2026 · Last updated: 14 October 2026

22. Purpose

This Notice provides additional information regarding CLP's processing of personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

It applies particularly to the Personal Mastery™ campaign, including lead generation, assessments, consultations, marketing communications and coaching enquiries.

23. Responsible Party

Change Leadership Partners (Pty) Ltd

trading as:

Change Leadership Partners (CLP)

is the responsible party for personal information processed for CLP's own business purposes.

Email: hello@changeleadership.co.za
Website: www.changeleadership.co.za
Telephone: +27 83 321 2456
Address: Atrium on 5th, 5th Street, Sandhurst, Sandton, 2196

24. Categories of Data Subjects

Depending on the interaction, CLP may process information relating to:

website visitors;
campaign prospects;
assessment participants;
coaching prospects;
Personal Mastery™ clients;
representatives of corporate clients;
suppliers;
professional advisers;
business contacts; and
other individuals with whom CLP interacts in the course of business.

25. Categories of Personal Information

Depending on the relationship and interaction, information may include:

identity and contact details;
professional information;
organisation information;
campaign responses;
assessment responses;
consultation information;
coaching administration information;
transaction and billing information;
website and technical information;
communication preferences; and
other information voluntarily supplied for a specific lawful purpose.

CLP does not require individuals to submit special personal information through ordinary campaign forms.

Individuals should not provide sensitive information unless specifically requested through an appropriate and lawful process.

26. Purposes and Lawful Grounds

CLP may process personal information for:

responding to enquiries;
providing requested resources;
delivering assessment results;
arranging consultations;
preparing proposals;
delivering Personal Mastery™ coaching;
administering client relationships;
sending lawful marketing communications;
managing CRM records;
measuring campaign performance;
improving services;
managing payments and records;
complying with law; and
protecting legitimate business interests where legally permitted.

The lawful basis will depend on the specific processing activity and may include consent, contract, pre-contractual steps, legal obligation, legitimate interests or another ground permitted by POPIA.

27. Voluntary and Necessary Information

Information requested through a campaign form may be voluntary or necessary depending on the purpose.

For example, an email address may be necessary to deliver a requested assessment result.

If required information is not supplied, CLP may be unable to provide the requested resource, respond to the enquiry or establish the requested professional relationship.

Optional marketing communications will be distinguished from information necessary to fulfil the individual's request.

28. Operators and Recipients

CLP may disclose or make personal information available to categories of recipients including:

HubSpot and relevant technology providers;
website and hosting providers;
assessment and form providers;
email providers;
payment providers;
professional advisers;
consultants or authorised delivery partners;
cloud-service providers;
accounting providers; and
lawful authorities.

Where an organisation processes information on CLP's behalf as an operator, CLP will take appropriate steps to meet POPIA's requirements concerning operators.

The actual provider and operator list must be confirmed against the live campaign environment.

29. HubSpot as a Technology Provider

CLP's use of HubSpot may involve processing personal information within HubSpot's CRM, marketing and website infrastructure.

HubSpot's current DPA describes both processor and controller scenarios and provides for sub-processors and international processing.

CLP remains responsible for ensuring that its own collection, use, disclosure and instructions concerning personal information comply with applicable law.

HubSpot's contractual documentation does not by itself constitute CLP's POPIA compliance programme.

30. Cross-Border Processing

Where personal information is transferred outside South Africa, CLP will apply the requirements of POPIA concerning cross-border transfers.

Where applicable, CLP will assess whether the destination provides an adequate level of protection or whether another lawful transfer mechanism applies.

The actual countries and providers involved must be confirmed before publication.

31. Security Compromises

CLP will assess suspected security compromises involving personal information and will notify the Information Regulator and affected data subjects where POPIA requires notification.

CLP will maintain appropriate incident-response procedures proportionate to its actual systems and risk profile.

32. Direct Marketing

CLP will comply with POPIA's requirements concerning direct marketing.

Where prior consent is required, CLP will obtain it.

Where another lawful basis or statutory provision permits direct marketing, CLP will comply with the conditions applicable to that basis.

Individuals may object to direct marketing at any time.

33. Automated Decision-Making

Where applicable, CLP will comply with POPIA's requirements concerning decisions based solely on automated processing.

The Personal Mastery™ campaign and its assessments are not intended to make significant decisions about individuals solely through automated processing.

Any future use of automated scoring, profiling or decision-making that could materially affect individuals must be assessed separately for POPIA compliance.

34. Requests for Access, Correction or Deletion

Privacy requests should be sent to:

hello@changeleadership.co.za

The request should identify the individual and provide sufficient information for CLP to understand and process the request.

CLP may take reasonable steps to verify identity.

Requests will be handled in accordance with POPIA and applicable procedures.

35. Complaints to the Information Regulator

Individuals may contact the Information Regulator of South Africa where they believe their rights under POPIA have been infringed.

Information Regulator:
https://inforegulator.org.za/

The current complaint procedure and contact details should be confirmed directly with the Regulator.