Privacy Policy
Sigmund (Pty) Ltd Last updated: 3 November 2026
1. Who we are
Sigmund (Pty) Ltd ("Sigmund", "we", "us") is a company registered in the Republic of South Africa under registration number 2025/064420/07. Our registered address is 4106 Spaces, 21 Dreyer Street, Sunclare Building, Cape Town, 7708, South Africa.
We build software that automates the collection and screening of documents for applications such as loans, mortgages, rentals and insurance claims.
This policy explains how we handle personal information that we collect through our website at getsigmund.co, through our sales and marketing activity, and through our dealings with customers, suppliers and job applicants. It is written to comply with the Protection of Personal Information Act 4 of 2013 ("POPIA"), South Africa's data protection law.
Information Officer: Tapfuma Masunzambwa, info@getsigmund.co Privacy contact: info@getsigmund.co
2. What this policy does not cover
When one of our customers uses our platform to collect documents from their own applicants, the customer decides what information is collected and why. In POPIA's language, the customer is the responsible party and Sigmund is the operator — we process that information on the customer's instructions and for the customer's purposes.
If you are an applicant who has uploaded documents through a Sigmund-powered portal, this policy is not the one that governs your information. Please refer to the Applicant Privacy Notice shown in the portal and to the privacy notice of the business you are applying to. Our obligations in that role are set out in our Data Protection Policy and in our contract with that business.
Which contract governs that relationship depends on how the customer signed up:
- Self-service customers accept our Terms of Service and Data Processing Addendum when they create an account. Together these form the written operator contract required by section 21 of POPIA.
- Enterprise customers usually negotiate their own master agreement and data processing agreement, which supersede ours for their account.
This Privacy Policy and our Data Protection Policy are notices rather than contracts. They describe what we do; they do not replace the agreements above.
3. Personal information we collect
If you visit our website. Your internet protocol (IP) address, browser type and version, device type, operating system, the pages you view, the time and duration of your visit, and the site that referred you. This is collected through cookies and similar technologies, including advertising cookies set by Meta, described in section 5.
If you contact us or request a demonstration. Your name, email address, telephone number, company name, job title, and anything else you choose to tell us in your message.
If you subscribe to our mailing list. Your name and email address, together with records of which emails we sent you and whether you opened them or clicked a link.
If you are a customer contact or an authorised user of our platform. Your name, work email address, telephone number, job title, account credentials, and records of your activity inside the platform (such as sign-ins and actions taken on applications).
If you are a supplier or service provider. The contact and banking details we need to transact with you.
If you apply for a job with us. Your curriculum vitae, employment history, qualifications, contact details, and the outcome of any checks or interviews.
We do not deliberately collect special personal information (such as information about health, religion, race, trade union membership, or criminal behaviour) through this website. Please do not send us such information unless we have asked for it.
4. Why we process your information, and on what basis
POPIA requires us to have a lawful basis for processing personal information. Ours are as follows.
| What we do | Why | Lawful basis under POPIA |
|---|---|---|
| Operate and secure our website | To make the site work, detect abuse and keep it available | Our legitimate interests (section 11(1)(f)) |
| Understand how the site is used | To improve our content and product | Our legitimate interests (section 11(1)(f)) |
| Measure and improve our advertising on Facebook and Instagram | To understand which adverts bring us customers | Our legitimate interests (section 11(1)(f)) |
| Respond to enquiries and demonstration requests | To answer you and explore whether we can work together | Steps at your request before concluding a contract (section 11(1)(b)) |
| Send marketing emails and newsletters | To keep you informed about Sigmund | Consent, or our legitimate interests where you are an existing customer (sections 11(1)(a), 11(1)(f) and 69) |
| Provide, support and bill for the platform | To perform our contract with your employer | Performance of a contract (section 11(1)(b)) |
| Keep accounting and tax records | Because the law requires it | Legal obligation (section 11(1)(c)) |
| Assess job applications | To decide whom to hire | Steps at your request before concluding a contract (section 11(1)(b)) |
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing that already took place.
5. Cookies, analytics and advertising
Strictly necessary cookies. We use a small number of cookies that keep the site functioning and secure. The site cannot work properly without them, so they are set without asking.
Analytics. We use PostHog, configured without cookies and hosted in the European Union, to understand which pages are visited, how visitors arrive, and where they drop off. Because it is cookieless, no identifier is stored on your device. PostHog processes your internet protocol address and device information to produce aggregate statistics, and we rely on our legitimate interest in understanding and improving our website.
If you object to this, email info@getsigmund.co and we will exclude you. You can also block analytics using your browser's tracking protection or a content blocker.
Advertising. We advertise Sigmund on Facebook and Instagram, and use the Meta Pixel, a tool provided by Meta Platforms, to measure which adverts lead people to visit our website and create an account. The Meta Pixel runs on our public website and on the sign-up and login pages of our web app, and nowhere else. It never runs on the pages applicants use to upload documents. It sets two cookies, _fbp and _fbc, which last up to 90 days, and sends Meta the pages you visit, when you click through to sign up, your internet protocol address, browser information and those cookie identifiers. When you create an account, we also send Meta a hashed (encoded) copy of your email address so it can match your sign-up to an advert you saw. Meta uses this information to measure and deliver our adverts, under its own terms and privacy policy (facebook.com/privacy/policy). We rely on our legitimate interest in understanding which of our adverts work.
You can object at any time by emailing info@getsigmund.co, and we will stop sharing your information with Meta from then on. We cannot recall information Meta has already received. You can also block these cookies in your browser, or manage how Meta uses information from other websites in your Facebook or Instagram settings ("Your activity off Meta technologies").
6. Marketing communications
If you have given us your consent, or if you are an existing customer and the message relates to something similar to what we already provide you, we may send you marketing emails about Sigmund.
Every marketing email includes an unsubscribe link. You can also email info@getsigmund.co at any time and we will remove you. We do not sell or rent your contact details to anyone.
Section 69 of POPIA restricts unsolicited electronic direct marketing. If you have asked us to stop, we will stop, and we will keep a record of your objection so that we do not contact you again by mistake.
7. Who we share your information with
We share personal information only where it is necessary, and only with:
- Service providers who process information on our behalf ("operators"). These include our cloud infrastructure provider, our email and mailing list platform, our analytics provider, our customer relationship management system, and our accounting provider. Each is bound in writing to process the information only on our instructions, to keep it confidential, and to secure it. The providers that process applicant data on our behalf are listed at getsigmund.co/subprocessors.
- Advertising platforms. We share limited information with Meta Platforms to measure our adverts, as described in section 5. Meta processes this information as an independent responsible party under its own privacy policy.
- Professional advisers, such as our attorneys, auditors and insurers, where they need it to advise us.
- Regulators, courts or law enforcement, where we are legally obliged to disclose it.
- An acquirer, if Sigmund is ever sold or merged, subject to the same protections set out here.
We do not sell personal information.
8. Where your information is processed
We process and store information in cloud facilities located in the Republic of South Africa and the European Union.
Section 72 of POPIA permits a transfer of personal information outside South Africa where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection. Our processing in the European Union rests on this ground: personal information held there is protected by the General Data Protection Regulation, which upholds principles substantially similar to POPIA's, and our agreements with the relevant providers incorporate the European Commission's Standard Contractual Clauses.
We may change the providers and facilities we use, provided processing continues to take place in a jurisdiction that meets section 72.
Some of our service providers may process limited information (such as your email address) outside South Africa and the European Union. Where they do, we contract on terms that impose comparable protections.
Information we share with Meta for advertising is processed by Meta Platforms Ireland Limited and may be transferred to Meta Platforms, Inc. in the United States, under Meta's data transfer terms, which incorporate the European Commission's Standard Contractual Clauses.
9. How long we keep it
We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires.
| Category | Retention period |
|---|---|
| Website analytics | 12 months |
Advertising cookies (_fbp, _fbc) |
Up to 90 days on your device. Meta's own retention applies to information it receives. |
| Enquiry and demonstration requests that do not become customers | 24 months from last contact |
| Mailing list subscriptions | Until you unsubscribe, plus a suppression record thereafter |
| Customer account and contract records | Duration of the contract plus 5 years (Companies Act and tax requirements) |
| Accounting and tax records | 5 years, as required by the Tax Administration Act and the Companies Act |
| Unsuccessful job applications | 6 months, unless you ask us to keep them longer |
When a retention period ends, we delete the information or de-identify it so that it can no longer be linked to you.
10. How we protect it
We apply reasonable technical and organisational measures as required by section 19 of POPIA, including encryption of data in transit and at rest, access restricted to named individuals on a least-privilege basis, logging of system and access events, regular encrypted backups, and written confidentiality obligations for everyone who works with us. Further detail is set out in our Data Protection Policy.
No system is perfectly secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.
11. Your rights
Under POPIA you have the right to:
- Be told what personal information we hold about you, and to receive a copy of it (sections 23 and 24).
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (section 24).
- Object to processing that we base on legitimate interests, on reasonable grounds relating to your situation (section 11(3)). This includes sharing information with Meta to measure our adverts.
- Withdraw consent that you previously gave.
- Object to direct marketing at any time (section 69).
- Not be subject to a decision based solely on automated processing that has legal consequences for you, without human involvement (section 71).
- Complain to the Information Regulator (section 74).
To exercise any of these, email info@getsigmund.co. A formal request for access to records is made using Form 2 under the Promotion of Access to Information Act 2 of 2000 ("PAIA"), and our PAIA Manual is available at getsigmund.co/paia. We will respond within 30 days, or tell you if we need longer.
We may ask you to verify your identity before we act on a request, so that we do not disclose your information to someone else.
12. Children
Our website and platform are not directed at children under 18, and we do not knowingly collect information about them through this website. Section 34 of POPIA prohibits processing the personal information of children except in defined circumstances. If you believe a child has given us information, contact us at info@getsigmund.co and we will delete it.
13. Changes to this policy
We may update this policy from time to time. The current version is always at getsigmund.co/privacy, with the date of the last update at the top. If we make a material change, we will tell you by email or by a notice on the site before it takes effect.
14. Complaints
Please raise any concern with us first at info@getsigmund.co — we would rather resolve it directly.
You are also entitled to complain to the regulator:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 Telephone: 010 023 5200 Email: POPIAComplaints@inforegulator.org.za General enquiries: enquiries@inforegulator.org.za Website: https://inforegulator.org.za (complaints are lodged through the Regulator's eServices portal)