1. About this policy

Red September (Pty) Ltd, trading as Red September (“Red September”, “we”, “us” or “our”), respects your privacy and is committed to processing personal information lawfully, transparently and securely.

This Privacy and Cookie Policy explains how we collect, use, store, share and protect personal information when you:

• Visit www.redseptember.co.za
• Submit an enquiry or request a proposal
• Subscribe to our newsletter
• Download a report, playbook, case study or other resource
• Apply for a position with us
• Engage with our advertising, marketing communications or services
• Communicate with us through email, telephone, social media or another channel

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable laws.

For the purposes of POPIA, the responsible party is:

2. Personal information we collect

The personal information we collect depends on how you interact with us.

Information you provide directly

This may include:

• Your name and surname
• Email address
• Telephone number
• Company or brand name
• Job title or designation
• Information included in an enquiry or message
• Marketing and communication preferences
• Information submitted when downloading a resource
• Correspondence and records of communications with us
• CVs, employment history and other recruitment information
• Information necessary to establish or manage a business relationship

Please do not submit sensitive or special personal information unless it is necessary and we have requested it.

Information collected automatically

When you use our website, we and our technology providers may collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages viewed and actions taken
• Dates, times and duration of visits
• Referring website or campaign source
• Approximate geographic location
• Cookie identifiers and advertising identifiers
• Website performance, diagnostic and security data

Information received from other sources

We may receive personal information from:

• Advertising and social media platforms
• Analytics providers
• Referral partners
• Publicly available professional or business sources
• Clients, suppliers and service providers
• Recruitment platforms or professional networks

Where information is obtained from another source, we will process it only where permitted by law.

3. Why we process personal information

We may process personal information to:

• Respond to enquiries and requests
• Prepare proposals or discuss potential projects
• Provide and manage our services
• Maintain relationships with clients, suppliers and partners
• Send resources that you have requested
• Send newsletters, insights and marketing communications where permitted
• Measure website traffic, engagement and campaign performance
• Improve our website, content, services and user experience
• Build and measure advertising audiences
• Prevent fraud, misuse and security threats
• Recruit employees and contractors
• Maintain business, financial and legal records
• Comply with applicable laws and regulatory requirements
• Establish, exercise or defend legal claims

4. Grounds on which we process information

Depending on the circumstances, we process personal information because:

• You have given us consent
• Processing is necessary to respond to your request
• Processing is necessary to enter into or perform a contract
• Processing is required by law
• Processing protects your legitimate interests or those of another person
• Processing supports our legitimate business interests, provided those interests do not unjustifiably interfere with your privacy

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

5. Marketing communications

We may send you marketing communications when:

• You have consented to receive them
• You are an existing client and the communication relates to similar services, where permitted by law
• Another lawful basis allows us to contact you

You can unsubscribe at any time by using the unsubscribe link in an email or contacting us directly.

We may retain limited information, such as your email address, on a suppression list after you unsubscribe. This helps us ensure that we do not send you further marketing communications.

Unsubscribing from marketing will not prevent us from sending necessary service, contractual or administrative communications.

6. Cookies and tracking technologies

Our website uses cookies, pixels, tags and similar technologies. Cookies are small files stored on your device when you visit a website.

Strictly necessary cookies

These cookies support essential website functions, security, form submissions and the storage of your cookie preferences. They cannot always be disabled without affecting the operation of the website.

Analytics and performance cookies

These technologies help us understand:

• How visitors find our website
• Which pages and resources are used
• How visitors navigate the website
• Whether the website is functioning correctly
• How our marketing campaigns perform

We may use services such as Google Analytics for this purpose.

Advertising cookies and pixels

These technologies may be used to:

• Measure advertising performance
• Understand whether an advertisement resulted in a website visit or enquiry
• Create advertising or remarketing audiences
• Deliver more relevant advertising on third-party platforms

Depending on the tools enabled on the website, these may include Google Ads and the LinkedIn Insight Tag.

Google Tag Manager may be used to manage and deploy analytics and advertising tags on the website.

Managing cookies

Where required, non-essential analytics and advertising technologies will be used only after you have made a selection through our cookie preference tool.

You can accept, reject or manage non-essential cookies through the cookie settings displayed on our website. You may also delete or block cookies using your browser settings. Blocking certain cookies may affect some website features.

Third-party providers may process information according to their own privacy policies. Their processing may include combining information collected through our website with information obtained through other websites or services.

7. When we share personal information

We may share personal information with trusted operators and service providers that help us operate our business, including:

• Website hosting and technical support providers
• Cloud storage and IT service providers
• Customer relationship management platforms
• Email and newsletter platforms
• Analytics and reporting providers
• Advertising and social media platforms
• Cybersecurity, fraud prevention and monitoring providers
• Professional advisers, including legal and accounting advisers
• Recruitment and human resources service providers

These parties may process personal information only for the agreed purpose and must apply appropriate confidentiality and security measures.

We may also disclose information:

• Where required or permitted by law
• In response to a lawful request from a regulator, court or law-enforcement authority
• To protect our rights, users, employees or property
• During a merger, restructuring, sale or transfer of all or part of our business

We do not sell or rent personal information.

8. Information processed for clients

Red September may process personal information on behalf of clients when providing advertising, marketing, development, analytics, CRM or related services.

In these circumstances, the client will generally be the responsible party and Red September will act as an operator. The client’s privacy notice and our agreement with that client will govern the processing.

Questions about information collected through a client’s website, campaign, form or platform should usually be directed to that client.

9. Cross-border processing

Some of our service providers, technology platforms or data centres may be located outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with section 72 of POPIA. This may include using providers or contractual arrangements that offer an appropriate level of protection.

10. Retention of information

We retain personal information only for as long as reasonably necessary to:

• Fulfil the purpose for which it was collected
• Maintain an active business relationship
• Respond to enquiries or disputes
• Comply with legal, tax, accounting or reporting obligations
• Establish, exercise or defend legal claims
• Maintain security, fraud prevention and audit records

Retention periods may differ according to the type of information and the reason it was collected.

When personal information is no longer required, we will delete, destroy or de-identify it in a reasonably secure manner, unless continued retention is authorised or required by law.

11. Security

We take reasonable technical and organisational measures to protect personal information against:

• Loss or damage
• Unauthorised access
• Unlawful processing
• Accidental destruction
• Unauthorised alteration or disclosure

These measures may include access controls, secure hosting, encryption, authentication, monitoring, backups and internal data-handling procedures.

No online service or transmission method is completely secure. We cannot guarantee absolute security, but we will respond to suspected security incidents and provide notifications where required by law.

12. Your rights

Subject to POPIA and any applicable limitations, you may:

• Ask whether we hold personal information about you
• Request access to your personal information
• Ask us to correct or update inaccurate information
• Request deletion of information that is no longer required or was processed unlawfully
• Object to certain processing
• Withdraw consent where processing is based on consent
• Opt out of direct marketing
• Request information about the parties that have had access to your information
• Lodge a complaint with the Information Regulator

We may need to verify your identity before responding to a request. Certain requests may be refused or limited where permitted or required by law.

13. Children’s information

Our website and services are primarily intended for businesses and adults. We do not knowingly collect personal information from children through the website without appropriate authorisation.

If you believe that a child has submitted personal information to us, please contact us so that we can investigate and take appropriate action.

14. Automated processing and profiling

Analytics and advertising technologies may group users into audiences based on website activity, campaign interaction or similar signals.

We do not use information collected through this website to make decisions based solely on automated processing that produce legal consequences or similarly significant effects for website visitors.

15. Third-party websites

Our website may link to external websites, platforms or services. We do not control and are not responsible for their content, security or privacy practices.

You should review the privacy policy of any third-party service before providing personal information.

16. Changes to this policy

We may update this policy when our processing activities, technology, services or legal obligations change.

The latest version will be published on this page with the revised “Last updated” date. Where a change is material, we may provide an additional notice where reasonably practicable.

17. Contact us

Questions, requests or complaints concerning personal information may be directed to:

Please include enough information for us to identify you and understand your request.

You may also lodge a complaint with the Information Regulator: