1. Introduction
Welcome to the Privacy Policy and Promotion of Access to Information Act (PAIA) Manual of the Psychological Association for Transformation and Innovation of South Africa (PATISA).
This document describes how PATISA collects, uses, stores, and protects personal information in accordance with:
- The Protection of Personal Information Act 4 of 2013 (POPIA)
- The Promotion of Access to Information Act 2 of 2000 (PAIA)
- The Electronic Communications and Transactions Act 25 of 2002 (ECTA)
- The Constitution of the Republic of South Africa, 1996 — Section 14 (Right to Privacy) and Section 32 (Right of Access to Information)
By using our website, services, or engaging with PATISA in any capacity, you consent to the practices described in this policy.
POPIA gives effect to the constitutional right to privacy by safeguarding personal information processed by public and private bodies. It introduces conditions for lawful processing and establishes the Information Regulator as the oversight body.
2. Responsible Party
For purposes of POPIA, the responsible party (i.e. the entity that determines the purpose and means of processing personal information) is:
3. POPIA Compliance — Conditions for Lawful Processing
PATISA is committed to complying with all eight conditions for lawful processing of personal information as set out in Chapter 3 of POPIA:
- Accountability: PATISA ensures compliance by the responsible party and designated Information Officer.
- Processing Limitation: Personal information is processed lawfully, reasonably, and not in a manner that infringes on privacy.
- Purpose Specification: Information is collected for specific, explicitly defined, and lawful purposes related to our functions.
- Further Processing Limitation: Information is not processed in a way incompatible with the original purpose.
- Information Quality: We take reasonable steps to ensure information is complete, accurate, and not misleading.
- Openness: Documentation is maintained and data subjects are notified of collection (this policy serves that purpose).
- Security Safeguards: Appropriate technical and organisational measures protect the integrity of personal information.
- Data Subject Participation: Data subjects may request access to, correction, or deletion of their personal information.
4. Information We Collect
PATISA collects the following categories of personal information, depending on your relationship with us:
4.1 Members & Prospective Members
- Full name, professional title, and contact details (email, phone, address)
- HPCSA registration number and specialisation category
- Practice address and location
- Payment and banking details for membership fees
- CPD (Continuing Professional Development) records
- Correspondence history
4.2 Students
- Full name, institution, and course of study
- Student number and contact details
- Proof of registration
4.3 Website Visitors
- IP address, browser type, and device information
- Cookies and usage data (see Section 12)
- Contact form submissions (name, email, subject, message)
4.4 Event Attendees
- Registration details and attendance records
- Dietary requirements and accessibility needs
- Photographs or video (with consent) for event documentation
4.5 Practitioner Directory
- Professional details voluntarily provided for public listing
- Specialisation, location, and availability status
5. Purpose of Collection
PATISA collects personal information for the following specific purposes:
- Membership administration: Processing applications, renewals, and fee collection
- Communication: Sending newsletters, event invitations, legislative updates, and meeting notices
- Directory services: Maintaining a searchable practitioner directory for public benefit
- CPD tracking: Recording and certifying professional development activities
- Advocacy: Representing members' interests to HPCSA, government, and stakeholders
- Event management: Organising AGMs, seminars, workshops, and symposia
- Research: Supporting transformation research in psychology (with consent)
- Legal compliance: Meeting obligations under POPIA, PAIA, and other legislation
- Website operation: Ensuring functionality, security, and performance
6. Lawful Basis for Processing
Under POPIA Section 11 and related provisions, PATISA processes personal information based on the following justifications:
| Lawful Basis | When It Applies |
|---|---|
| Consent | Newsletter subscriptions, marketing communications, event photography, research participation |
| Contractual necessity | Membership administration, fee processing, service delivery |
| Legal obligation | Compliance with HPCSA requirements, tax records, regulatory reporting |
| Legitimate interest | Member communications, directory maintenance, advocacy activities, security |
| Public interest | Transformation initiatives, community-centered psychological services |
7. Data Sharing & Third Parties
PATISA does not sell personal information. We may share information only in the following circumstances:
- Service providers: Payment processors, hosting providers, and email services under strict data processing agreements
- HPCSA: When required for regulatory compliance or professional conduct matters
- Legal authorities: When compelled by law, court order, or subpoena
- Professional bodies: For CPD accreditation and recognition purposes
- With consent: For research collaborations, public directories, or other purposes you explicitly approve
All third-party operators are contractually bound to protect personal information in accordance with POPIA Section 21 (Operators).
8. Cross-Border Transfers
PATISA primarily stores and processes personal information within South Africa. Where cross-border transfers are necessary (e.g. cloud hosting, international payment processing), we ensure:
- The recipient country has data protection laws substantially similar to POPIA, OR
- A binding agreement is in place ensuring equivalent protection, OR
- The data subject has consented to the transfer after being informed of the risks (POPIA Section 72)
9. Retention & Security
9.1 Retention Periods
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected:
| Category | Retention Period |
|---|---|
| Active member records | Duration of membership + 5 years after termination |
| Financial records | 5 years (as required by tax legislation) |
| CPD records | Duration of membership + 3 years |
| Website enquiry data | 2 years from last contact |
| Event attendance records | 3 years |
| Marketing consent records | Until consent is withdrawn |
After retention periods expire, personal information is securely deleted or anonymised.
9.2 Security Measures
PATISA implements appropriate technical and organisational measures to protect personal information (POPIA Section 19), including:
- Encryption of data in transit (TLS/SSL) and at rest
- Access controls limiting information to authorised personnel
- Regular security assessments and updates
- Staff training on data protection and confidentiality
- Secure physical storage for paper records
- Incident response procedures for data breaches
In the event of a data breach involving your personal information, PATISA will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with POPIA Section 22.
10. Data Subject Rights
Under POPIA Chapter 3, Part E (Sections 23–25), you have the following rights regarding your personal information:
- Right of access: Request confirmation of whether we hold your personal information, and request a record or description of it
- Right to correction: Request that we correct, update, or delete inaccurate or misleading personal information
- Right to object: Object to processing on reasonable grounds relating to your circumstances
- Right to complain: Lodge a complaint with the Information Regulator if you believe your rights have been violated
- Right to withdraw consent: Withdraw consent at any time where processing is based on consent (without affecting lawfulness of prior processing)
To exercise any of these rights, please contact our Information Officer (see Section 15). Requests will be actioned within the timeframes prescribed by POPIA.
11. PAIA — Promotion of Access to Information Act
The Promotion of Access to Information Act 2 of 2000 gives effect to Section 32 of the Constitution, which provides everyone the right of access to information held by the state and information held by another person that is required for the exercise or protection of any rights.
11.1 Records Available in Terms of PAIA
PATISA's records are available in accordance with PAIA. The following categories of records may be requested:
- Constitution and governance documents
- Annual reports and financial statements
- Meeting minutes (subject to confidentiality provisions)
- Membership policies and codes of conduct
- Programme descriptions and CPD frameworks
- Research publications authored or commissioned by PATISA
11.2 How to Request Access
To request access to a record held by PATISA:
- Complete the prescribed Form C (for requests to private bodies) as published in Government Gazette No. 25792 of 9 January 2004
- Submit the completed form to our Information Officer (see Section 15) via email, post, or hand delivery
- Pay the prescribed request fee (currently R50.00) — payment details will be provided upon receipt of your request
- Provide sufficient particulars to identify the record sought and specify the form of access required
11.3 Grounds for Refusal
Access may be refused in accordance with PAIA Part 4 (Sections 63–70) where records contain:
- Personal information of third parties (protected under Section 65)
- Commercially confidential information
- Information protected by legal professional privilege
- Information that could endanger safety or prejudice law enforcement
If access is refused, you will be provided with adequate reasons and informed of your right to lodge a complaint with the Information Regulator or apply to a court.
11.4 Timeframes & Fees
| Item | Fee / Period |
|---|---|
| Request fee | R50.00 |
| Reproduction fee | R5.10 per A4 page |
| Search and preparation | R20.00 per hour (after first hour free) |
| Decision timeframe | 30 days (may be extended by 30 days with notice) |
12. Cookies & Tracking Technologies
Our website uses cookies and similar technologies to enhance user experience. The following cookies may be set:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Essential for website functionality (e.g. session management) | Session |
| Performance | Collect anonymous usage data to improve site performance | Up to 2 years |
| Functional | Remember user preferences (e.g. language, region) | Up to 1 year |
We do not use third-party advertising cookies or tracking for marketing purposes. You may disable cookies through your browser settings, though this may affect website functionality.
13. Direct Marketing
PATISA may send electronic communications (emails, newsletters) for the following purposes:
- Legislative updates and industry news relevant to psychology practitioners
- Event invitations and programme announcements
- Membership renewal reminders
- Research opportunities and publications
In accordance with POPIA Section 69 and the Electronic Communications and Transactions Act:
- We will obtain your prior consent before sending marketing communications (unless you are an existing customer and the communication relates to similar products/services)
- Every marketing email will include a clear opt-out mechanism
- You may unsubscribe at any time by clicking the unsubscribe link or contacting us directly
14. Complaints & the Information Regulator
If you believe PATISA has violated your rights under POPIA or PAIA, you may:
- First, contact our Information Officer to attempt resolution (see Section 15)
- If unresolved, lodge a formal complaint with the Information Regulator of South Africa
15. Information Officer & Deputy
In accordance with POPIA Section 1, every organisation must designate an Information Officer. For PAIA purposes, the Information Officer is also responsible for handling access requests.
Deputy Information Officers (in the absence of the CEO):
- Coordinator of Committee — coc@patisa.co.za
- Head of Transformation — transform@patisa.co.za
16. Changes to This Policy
PATISA reserves the right to update this Privacy Policy and PAIA Manual at any time. Material changes will be communicated via:
- A prominent notice on our website
- Direct notification to members via email
- Updates to the "Last updated" date at the top of this document
We encourage you to review this policy periodically. Continued use of our services following changes constitutes acceptance of the updated policy.
No amendment to this policy diminishes rights already afforded to you under POPIA, PAIA, or the Constitution of South Africa. If you have questions about this policy or wish to exercise your rights, please contact our Information Officer.