Privacy Notice

Protection of Personal Information Act, 2013 (POPIA) · Last updated November 2026

The ZACS Platform is used by Cotton South Africa (the “responsible party”) to administer the statutory cotton levy, and is operated on its behalf by Agvio Systems (Pty) Ltd (the “operator”). This notice explains what personal information we process, why, how long we keep it, and the rights you have under POPIA.

1. Information we process

• Account details — your name and email address (your email is your login), and a securely hashed password (we never store your password in readable form).
• Organisation contact details — the named contact's name, email and phone number.
• Business records — the ginnery's physical address, VAT number and company registration number, used on statutory levy invoices.
• Levy returns & invoices — the monthly production figures you submit and the levy calculations and invoices generated from them.
• Activity log — a record of key actions (logins, submissions, approvals) for security and accountability. This log references user ID numbers only, not names or email addresses.

2. Why we process it (purpose)

To register and authenticate users, capture and finalise monthly cotton-levy returns, calculate the levy, generate and deliver invoices, and meet statutory reporting obligations. We collect only what is needed for these purposes.

3. How long we keep it (retention)

We do not keep personal information longer than necessary. Indicative periods:

Information	Retention
Levy returns, calculations & invoices	Retained for the statutory tax period (currently 5 years), after which the linked personal details are anonymised.
User accounts (name & email)	Anonymised on request, or once an account has been deactivated for 12 months.
Activity log	Retained for security; stores ID references only (no names/emails).

4. How we protect it

Passwords are stored using strong one-way hashing; data is transmitted over encrypted (HTTPS) connections; and access is role-based, so each organisation sees only its own returns, invoices and team members.

5. Your rights

Under POPIA you may:

• request access to the personal information we hold about you;
• request correction of information that is inaccurate or out of date;
• request deletion / erasure of your personal information where we are no longer required to keep it (your historical levy records may be retained in anonymised form);
• object to processing, and lodge a complaint with the Information Regulator.

Note: ginnery administrators can also erase a team member's personal data directly from the Team page once that member has been deactivated.

6. How to exercise your rights

Contact our Information Officer at privacy@agviosystems.co.za. We will respond within a reasonable period. Quick links:

Request access Request correction Request deletion

7. Complaints to the Information Regulator

If you are not satisfied with how we handle your information, you may complain to the Information Regulator (South Africa): enquiries@inforegulator.org.za · inforegulator.org.za.