Synaptic Group: How we handle personal information collected through synaptic-grp.com, under the Protection of Personal Information Act and the GDPR.
Last updated: 3 September 2026
1. Who we are
Synaptic Group (“we”, “us”, “our”) operates synaptic-grp.com. For the purposes of POPIA we are the responsible party for the personal information described here; under the GDPR we are the data controller.
Registered name: Synaptic Group Pty. Ltd. Registration number: 2019/244301/07 Registered address: 1 Sagila Lane, Simbithi Office Park, Unit 218 Ballito, KwaZulu-Natal, South Africa Information Officer: Ingrid Thomas, ingrid@synaptic-grp.com General contact: info@synaptic-grp.com · +27 32 008 5008
2. What this policy covers
This policy applies to personal information we collect through this website: general enquiries, consultation bookings, the client onboarding questionnaire, career applications, and analytics where you have consented to them.
It does not govern consulting engagements themselves. Once you become a client, the handling of your information is governed by the engagement letter and any data processing terms signed with it.
3. What we collect
When you enquire or book a consultation
Your name, email address, telephone number and its country dialling code Your company name Anything you choose to write in the message field The date and time slot you request
When you complete the client onboarding questionnaire
This is a longer form and it is worth being precise about it. It asks for: job title or role; company website; country or region of head office; how you heard about us; industry or sector; company size; annual revenue band; your role in the decision; the areas the work falls under; what prompted you to seek help now; what a good outcome looks like; what you have tried or considered so far; your desired timeline; whether budget is allocated; who else is involved in the decision; and your preferred contact method and best time.
We ask for this so the first conversation is useful rather than exploratory. Only your name and email are strictly required to reach you.
When you apply for a role
Your CV and any covering information you send to cv@synaptic-grp.com
Automatically
Only with your consent: website performance, analytics and advertising identifiers, described in section 6 Always: standard web server logs held by our host, including IP address, browser type and pages requested, used for security and fault diagnosis
We do not ask for special personal information as defined in section 26 of POPIA, or special category data under Article 9 of the GDPR. Revenue band and budget describe your organisation, not your personal finances.
4. Why we use it
We only process personal information where the law permits. Our grounds are set out below.
Purpose POPIA justification GDPR lawful basis Responding to your enquiry and arranging a consultation s11(1)(b) — necessary for a contract or steps prior to one Art 6(1)(b) Preparing for and holding the consultation s11(1)(b) Art 6(1)(b) Keeping a record of the enquiry and following up s11(1)(f) — legitimate interests in pursuing business Art 6(1)(f) Measuring website performance and analysing how the site is used, so we can improve it s11(1)(a) — your consent Art 6(1)(a) Advertising measurement s11(1)(a) — your consent Art 6(1)(a) Considering a job application s11(1)(b) and s11(1)(f) Art 6(1)(b) and 6(1)(f) Meeting tax, accounting and other legal obligations s11(1)(c) Art 6(1)(c) Site security and fault diagnosis s11(1)(f) Art 6(1)(f)
We do not make decisions about you by automated means alone, and we do not profile you.
5. Consent and withdrawal
Where we rely on consent, it is asked for plainly and never assumed. You must tick the consent box before an enquiry or booking can be submitted, and no analytics or advertising tag is loaded until you press Accept on the cookie banner.
Declining costs you nothing. The site works identically either way, and declining does not prevent you contacting us.
You can withdraw consent at any time by clearing this site’s data in your browser, which resets the banner, or by emailing us. Withdrawing does not affect anything already lawfully done beforehand.
6. Cookies and analytics
We use cookies to keep the site working, to measure how it performs, and to understand how it is used so we can improve it. They fall into three groups:
Group What it does Consent Strictly necessary Keeps the site functioning and secure — remembering your cookie choice, protecting forms against abuse, and keeping you signed in if you are a member of staff. Not required. The site cannot work without these. Performance and analytics Tells us which pages are visited, how long they take to load, where visitors come from, and where people abandon a form. We use this to find what is slow or confusing and fix it. Reported to us in aggregate, not read as a record of one person’s browsing. Required Advertising Measures whether a campaign led to an enquiry, and supports advertising on Meta and LinkedIn. Required
Two things are worth stating plainly, because they are how this site is actually built:
No performance, analytics or advertising cookie is set before you accept. The tags are not merely inactive — they are not loaded onto the page at all until consent is given. Your choice is stored in your browser’s own local storage under the name synaptic_consent. It never leaves your device, is not sent to us, and is not used to identify you.
Where enabled and consented to, we use Google Analytics 4, Google Tag Manager, the Meta Pixel and the LinkedIn Insight Tag. These providers set their own cookies and may combine what they collect with data they hold about you independently of us.
Our Cookie Policy sets out each cookie in detail.
7. Who we share it with
We do not sell personal information, and we do not share it for anyone else’s marketing. We share it only with the following, and only so far as each needs it:
Recipient What they receive, and why Google (Workspace, Sheets, Calendar, Meet) Enquiries reach us by email and are recorded in a Google Sheet we use as our client record. Booking a consultation creates an entry in our calendar and sends you an invitation containing a video meeting link. Xneelo Our hosting provider, in South Africa. They hold the website and its database, including submitted enquiries. Google, Meta, LinkedIn Analytics and advertising measurement — only where you have consented. Professional advisers and authorities Where we are legally obliged, or need to establish or defend a legal claim.
8. Sending data abroad
Some of the providers above process information outside South Africa and outside the European Economic Area, principally in the United States and the European Union.
Section 72 of POPIA and Chapter V of the GDPR permit such transfers where the recipient is bound by adequate safeguards. We rely on the contractual terms these providers offer, which incorporate the European Commission’s Standard Contractual Clauses. [CONFIRM WITH COUNSEL AND NAME THE MECHANISM RELIED ON]
9. How long we keep it
Record Retention Enquiries that do not become engagements [24 months] from last contact, then deleted Client records The engagement, plus [7 years] for tax and legal purposes Unsuccessful job applications [12 months], unless you ask us to keep them on file Analytics data As set by each provider’s own retention settings Server logs As retained by our host for security purposes
When a retention period ends we delete the information or irreversibly anonymise it.
10. How we protect it
We keep appropriate safeguards in place, and we take this seriously rather than treating it as a formality. The site is served entirely over an encrypted connection. Administrative access is restricted to named individuals and protected by individual accounts. Access to enquiry records is limited to those who need it to respond to you. Our providers are bound by their own contractual security obligations.
We should be straightforward with you, though: no transmission over the internet and no method of electronic storage is completely secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the Information Regulator as POPIA and the GDPR require.
11. Your rights
Under POPIA and the GDPR you may:
Ask what personal information we hold about you, and receive a copy Have inaccurate or incomplete information corrected Ask us to delete information we no longer have grounds to keep Object to processing we carry out on the basis of legitimate interests Ask us to restrict processing while a dispute is resolved Receive information you gave us in a portable, machine-readable form Withdraw consent at any time, where consent is the basis we rely on Object to direct marketing at any time, without giving a reason
To exercise any of these, email [INFORMATION OFFICER EMAIL]. We will respond within 30 days under POPIA, and within one month under the GDPR. There is no charge unless a request is manifestly unfounded or excessive.
The website has a built-in facility for exporting and erasing enquiry records, so a request about anything submitted through a form here can be answered completely and verifiably.
12. Complaints
If you are unhappy with how we have handled your information, please raise it with us first — we would rather fix it. You also have the right to complain directly to the regulator.
Information Regulator (South Africa) POPIA complaints: POPIAComplaints@inforegulator.org.za General enquiries: enquiries@inforegulator.org.za Telephone: 010 023 5200 · Toll free: 0800 017 160 Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
If you are in the European Economic Area or the United Kingdom, you may instead complain to the supervisory authority in your country of residence or work.
13. Children
This website is aimed at businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
14. Changes to this policy
When this policy changes we post the new version here and update the date at the top. Where a change materially affects your rights, we will draw attention to it rather than rely on you noticing.
15. Contact us
Synaptic Group info@synaptic-grp.com +27 32 008 5008 1 Sagila Lane, Simbithi Office Park, Unit 218 Ballito, KwaZulu-Natal, South Africa Information Officer: Ingrid Thomas, ingrid@synaptic-grp.com