POPIA Compliance Statement

1. Accountability and Governance

Decibel has appointed an Information Officer registered with the Information Regulator and empowered deputy information officers across core business units. Our governance framework includes executive oversight, quarterly privacy risk reviews, and board reporting to ensure that POPIA compliance is embedded across the organisation.

All employees, contractors and third-party service providers are bound by confidentiality and data protection obligations. Mandatory privacy and cyber-security training is delivered at onboarding and refreshed annually, with role-based modules for high-risk teams.

2. Information Mapping and Impact Assessments

We maintain a continuously updated record of processing activities (ROPA) covering all categories of personal information processed as a responsible party and operator. Privacy impact assessments are mandatory for new products, features, or integrations to assess proportionality, legal justification and security requirements prior to launch.

Processing activities that present a high risk to data subjects are escalated to the Information Officer and, where necessary, consulted with the Information Regulator before implementation.

3. Lawful Processing and Consent Management

Processing activities are linked to explicit lawful bases in line with sections 11 and 12 of POPIA. We collect consent for optional processing such as marketing communications and special personal information, and maintain audit trails to evidence consent. Consent withdrawal mechanisms are available in-app and via support channels, and requests are fulfilled within five business days.

4. Operator Management

Decibel conducts due diligence on all operators (processors) before engagement, including security posture assessments and contractual commitments to POPIA-equivalent safeguards. Operator agreements include breach notification obligations, audit rights, and requirements to notify us before appointing sub-operators.

5. Data Subject Participation

We provide multiple channels for data subjects to exercise their POPIA rights, including online forms, authenticated account settings, and dedicated email support. Requests to access, correct, delete or object to processing are logged, authenticated and resolved within the timelines prescribed by sections 23 to 25 of POPIA. Where we decline a request, we provide a written justification and guidance on escalation to the Information Regulator.

6. Security Safeguards

Our POPIA-aligned security programme is benchmarked against ISO/IEC 27001 controls and includes encryption, segmentation, multi-factor authentication, endpoint protection, vulnerability management, secure software development lifecycle practices and incident response plans. Independent penetration testing is conducted at least annually, with remediation tracked to completion.

7. Incident Response and Breach Notification

We operate a 24/7 incident response capability supported by automated monitoring and alerting. Personal information breaches are triaged immediately and investigated in line with our breach management playbooks. Where a data breach is likely to result in real risk of harm, we notify the Information Regulator and affected data subjects without undue delay, providing guidance on mitigation steps.

8. Cross-Border Data Flows

International transfers are limited to jurisdictions with adequate protection or governed by contractual safeguards meeting section 72 requirements. We maintain a transfer register identifying receiving countries, the purpose of transfer, and the safeguards applied, and we make summaries of this register available on request.

9. Audits and Continuous Improvement

Internal audit performs biennial reviews of our POPIA controls, with remediation actions monitored by the Information Officer. We track regulatory developments, Information Regulator guidance notes, and relevant case law to ensure policies and processes remain up to date. Feedback from data subjects and industry peers is incorporated into our continuous improvement roadmap.

10. Contact and Escalation

Questions about this POPIA compliance statement can be directed to the Information Officer at [email protected]. Unresolved concerns may be escalated to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, or [email protected].