POPIA Compliance
Framework.

1. Purpose & Scope

This framework sets out how Blah-Blah.Com ("Blah-Blah") meets its obligations as a responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It applies to all personal information processed by Blah-Blah in connection with www.blah-blah.co.za and the delivery of its services.

In line with the Information Regulator's amended Regulations (effective 17 April 2025), this framework is a living document that is reviewed and continuously improved as our processing activities evolve.

2. Company & Information Officer

• Responsible party: BLAH-BLAH COM, Registration No. 2026/262065/07
• Registered office: 57 Van der Merwe Street, Peerless Park East, Kraaifontein, Cape Town, Western Cape, 7570
• Information Officer: Kyle Vermeulen (Founder & Sole Director)
• Contact: legal@blah-blah.co.za

3. Governing Legislation

• Protection of Personal Information Act 4 of 2013 (POPIA)
• Promotion of Access to Information Act 2 of 2000 (PAIA), where applicable
• Companies Act 71 of 2008, where relevant to record-keeping

4. The Eight Conditions for Lawful Processing

• Accountability — the Information Officer is accountable for ensuring compliance with all conditions below
• Processing Limitation — we collect only the personal information reasonably necessary to respond to enquiries and deliver services, and only on a lawful basis
• Purpose Specification — personal information is collected for specific, defined purposes and not repurposed without informing the data subject
• Further Processing Limitation — we do not use personal information for a new purpose incompatible with the original purpose without additional consent
• Information Quality — we take reasonable steps to keep personal information accurate, complete, and up to date
• Openness — our Privacy Policy is published on our Website and data subjects are informed at the point of collection
• Security Safeguards — we apply reasonable technical and organisational measures
• Data Subject Participation — data subjects may access, correct, or request deletion of their information at any time

5. Data Subject Rights & How to Exercise Them

Data subjects may exercise any right listed in our Privacy Policy by contacting legal@blah-blah.co.za or via WhatsApp on +27 69 031 5657. Requests are acknowledged and, where reasonably possible, actioned free of charge and within a reasonable time, in line with the Information Regulator's 2025 amended Regulations.

6. Security Safeguards

• Website hosted with Netlify, using industry-standard encryption in transit (HTTPS/TLS)
• Access to systems and stored data restricted to authorised personnel only
• Passwords and credentials are not shared or stored in plain text

7. Cross-Border Transfer Safeguards

Where personal information is processed by service providers located outside South Africa (for example, cloud hosting or AI service providers), Blah-Blah takes reasonable steps to ensure such transfers meet the requirements of section 72 of POPIA.

8. Data Breach Response Procedure

In the event of a security compromise involving personal information, Blah-Blah will, as soon as reasonably possible:

• Contain and investigate the breach
• Assess the risk to affected data subjects
• Notify the Information Regulator
• Notify affected data subjects in writing, describing the breach and recommended protective measures
• Document the incident and any corrective action taken

9. Record of Processing Activities

10. Framework Review

This framework is reviewed at least annually, or sooner if our processing activities change materially, and is continuously improved in line with regulatory guidance from the Information Regulator.