Last updated: 9 October 2026
4.1 About this policy
APEA respects your privacy. This policy explains what personal information we collect through our website, events and programmes, why we collect it, who we share it with and what rights you have. We follow the Protection of Personal Information Act 4 of 2013 (POPIA) and its eight conditions for lawful processing. As "responsible party" under POPIA, APEA decides why and how your information is processed.
4.2 Information Officer
Our Information Officer can be reached at info@apea.international. APEA's Information Officer is registered with the Information Regulator.
4.3 What we collect
| Who you are | What we may collect |
|---|---|
| Website visitor | IP address, device and browser type, pages viewed, referring site, and cookie data (see section 5) |
| Newsletter subscriber | Name, email address, country, organisation and interests |
| Ticket buyer and delegate | Name, email, phone, organisation, job title, country, ticket type, billing details, dietary and access needs, and session choices. Card details are entered directly with Peach Payments; we don't store them |
| Programme applicant or entrant | Contact details, age or date of birth, school or institution, country, CV or biography, essays, videos and other submissions, and references |
| Speaker, moderator or panellist | Biography, photo, contact details, travel details and presentation material |
| Sponsor, partner, exhibitor or supplier | Contact persons' names, roles and business contact details, and company, tax and banking details |
| Service request client | Contact details and the details of the service you've asked for |
| Job applicant | See the Applicant Privacy Notice in section 7 |
| Event attendee | Photographs and video taken at AFSI (see clause 3.10), and badge scans where you agree to them |
Special personal information. We only collect information about health or disability (for example, dietary or access needs) where you choose to give it so we can accommodate you, and we use it only for that purpose (POPIA sections 26 and 27). We may ask for race and gender information on an optional, anonymised basis for reporting on the diversity of AFSI participation. You don't have to provide it.
Children. We process personal information about children under 18 only with the prior consent of a parent, guardian or school acting with that authority (POPIA section 35), and only for the youth programme they're taking part in.
4.4 Why we use it and on what basis
| Purpose | Lawful basis under POPIA section 11 |
|---|---|
| Selling and managing passes, sending tickets and event updates | Performing our contract with you |
| Reviewing programme applications and running programmes | Your consent, or that of your parent or guardian, and performing the programme |
| Answering enquiries and service requests | Taking steps at your request before a contract, and our legitimate interest |
| Sending newsletters and AFSI news | Your consent (POPIA section 69) |
| Accounting, tax and audit records | Complying with the law |
| Keeping the site and the event safe and secure | Our legitimate interest and legal obligations |
| Understanding how the site is used (analytics) | Your consent through the cookie banner |
| Reporting on AFSI's reach and outcomes to funders and partners | Our legitimate interest, using aggregated or anonymised figures only |
| Recruitment | See section 7 |
We only collect what we need for these purposes, and we won't use your information for something unrelated without telling you and, where needed, asking for your consent.
4.5 Direct marketing
We'll only send you newsletters and marketing emails if you've opted in, or if you're an existing delegate or customer and the message is about similar APEA events or services (POPIA section 69(3)). Every message includes an unsubscribe link. If someone contacts you on our behalf by email or SMS without consent, you can object using Form 4 under the POPIA Regulations, or simply tell us.
4.6 Who we share it with
We don't sell your personal information. We share it only where needed:
- Operators that process information for us under written agreements that require them to keep it secure (POPIA sections 20 and 21). These include Wix.com (website hosting, Wix Events ticketing, forms and email marketing), Peach Payments (card processing), Google (analytics, if you consent), our email and cloud storage providers, and our event registration and badge printing suppliers
- The venue and event suppliers, such as The Canvas Riversands, caterers and security, who receive only the details they need (for example, delegate names for access lists and dietary needs for catering)
- Programme partners, judges and panels, who see application material only for the programme you applied for
- Sponsors and exhibitors, only if you choose to share your details with them, for example by having your badge scanned at their stand. We don't hand over delegate lists
- Public listings of speakers, award finalists and winners, with their agreement
- Professional advisers such as auditors and lawyers, and authorities where the law requires it
4.7 Information sent outside South Africa
Some of our operators store or process information on servers outside South Africa, including in the United States, the European Union and Israel (where Wix is based). We only send information across borders when POPIA section 72 allows it: where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, where you consent, or where it's needed to perform our contract with you.
4.8 How long we keep it
| Information | How long |
|---|---|
| Ticket, invoice and payment records | 5 years after the financial year end (Companies Act and Tax Administration Act) |
| Delegate registration details | 2 years after AFSI 2027, so we can invite you to the next edition, unless you ask us to delete them |
| Programme applications | Unsuccessful: 12 months after selection closes. Successful: for the life of the programme plus 2 years |
| Newsletter list | Until you unsubscribe |
| Event photos and video | Kept in our archive as long as they're useful for reporting AFSI's history, unless you ask us to remove an image |
| Analytics data | As set in the analytics tool, at most 26 months |
After that we delete, destroy or anonymise it, unless the law requires us to keep it longer (POPIA section 14).
4.9 Security and breaches
We use reasonable technical and organisational measures to protect your information, including encryption in transit (HTTPS), access controls, strong passwords and two-factor authentication on admin accounts, and staff confidentiality obligations. No system is completely secure. If we have reasonable grounds to believe your personal information has been accessed or acquired by someone not authorised to, we'll notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires, and tell you what we're doing about it and what you can do to protect yourself.
4.10 Your rights
Under POPIA you have the right to:
- ask whether we hold information about you and request a copy (using the process in our PAIA Manual, section 6)
- ask us to correct or delete information that's inaccurate, out of date, incomplete, misleading or unlawfully obtained (Form 2 under the POPIA Regulations)
- object to processing based on legitimate interest (Form 1) and to direct marketing at any time
- withdraw consent at any time, without affecting processing that already took place
- not be subject to a decision based only on automated processing that significantly affects you
- complain to the Information Regulator
To use any of these rights, email our Information Officer. We'll respond within 30 days and may ask you to confirm your identity first. There's no charge for correcting or deleting information, though PAIA may allow a fee for access requests (see section 6).
4.11 Complaints
If you're unhappy with how we've handled your information, please contact us first so we can try to fix it. You also have the right to lodge a complaint with the Information Regulator:
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Email: enquiries@inforegulator.org.za
- Website: www.inforegulator.org.za (complaints forms are available there)
4.12 Visitors from the EU, UK and elsewhere
If you're in the European Union or United Kingdom, the GDPR or UK GDPR may also apply when we offer you tickets or monitor your behaviour on the site. The rights and lawful bases in this policy line up closely with those laws. You can also complain to your local data protection authority. Delegates from other African countries may have similar rights under their own data protection laws (for example, Kenya's Data Protection Act 2019 or Nigeria's Data Protection Act 2023), and we'll honour requests made under them.
4.13 Changes to this policy
We'll post any changes on this page and update the date at the top. If a change is significant, we'll tell you by email or a notice on the site.