Protection of Personal Information Act (POPIA) Privacy Policy

for Gather@19

Last updated: 30 July 2026

General

This is the Privacy Policy for Armata Potentia (Pty) Ltd trading as Gather@19, registration number 2019/425248/07. This policy details how we collect, store, protect, and use Personal Information—that is, information that can be used to identify an individual (natural person) or an established business entity (juristic person)—in connection with the services we may offer through our website www.gather19.co.za (referred to as the “Site”) and through your interactions with us (referred to as the “Services”).

Audience

Personal Information submitted to us by using this Site or our Services is governed strictly by this Privacy Policy and the Protection of Personal Information Act, No. 4 of 2013 (POPIA).

Definitions

Words with capitalised initial letters have specific meanings defined in this section under South African law:

Personal Data

Information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person (company). This includes, but is not limited to, contact details, identity numbers, online identifiers, and financial histories.

Usage Data

Data collected automatically, either generated by the use of the Service or from the website infrastructure itself (e.g., the duration of a page visit, browser type).

Cookies

Small files stored on your device (computer or mobile device) via your web browser.

Responsible Party

The entity that determines the purposes and means of processing Personal Information (historically referred to internationally as the Data Controller).

Operator

An entity or service provider that processes Personal Information on behalf of a Responsible Party in terms of a contract or mandate, without coming under the direct authority of that party.

Data Subject

The voluntary user, client, or visitor whose Personal Information is being processed.

As the Operator

Where we have been contracted by another company (such as your direct provider), please be aware that we act purely as an Operator. We are not responsible for decisions made regarding your data. Please refer directly to the Privacy Policy of the business you are dealing with.

As the Responsible Party

Where you are dealing with us directly by means of our Services or Site, this Privacy Policy applies.

Where you deal with us directly via our Services or our Site, this Privacy Policy applies natively. You are not required to provide us with any Personal Information when simply browsing the Site. However, engaging with us via contact forms, quote requests, or newsletters will require explicit input.

Should you engage us for our Services, you will be required to provide further information as detailed in this Privacy Policy.

What Personal Information Are We Processing and Why?

We process Personal Information lawfully, minimally, and transparently based on your explicit consent, contractual requirements, or legitimate business interest:

Informed Consent (Opt-In)

When you submit a query via our contact forms, subscribe to digital communication, or allow analytical cookies. You may withdraw your consent at any time.

Contractual Performance

When we process transactional data, registration details, or billing information necessary to execute our commercial service agreements.

Legitimate Interest

To monitor, secure, and patch the performance of our Site to ensure it remains free from systemic risk or digital abuse.

Who is Processing Your Data?

We process Personal Information lawfully, minimally, and transparently based on your explicit consent, contractual requirements, or legitimate business interest:

Informed Consent (Opt-In)

When you submit a query via our contact forms, subscribe to digital communication, or allow analytical cookies. You may withdraw your consent at any time.

Contractual Performance

When we process transactional data, registration details, or billing information necessary to execute our commercial service agreements.

Legitimate Interest

To monitor, secure, and patch the performance of our Site to ensure it remains free from systemic risk or digital abuse.

Who is Processing Your Data?

In cases where we act as the Responsible Party, data processing is handled by us using the structural controls below:

Company Name: Armata Potentia (Pty) Ltd trading as Gather@19

Registration Number: 2019/425248/07

Physical Address: Farm Mount Grace, 19 Amatava, Mokopane, 0601

Information Officer: Trudie du Plessis

Dedicated Compliance Email: info@gather19.co.za

Cross-Border Transfers

In some instances, your data may be hosted, processed, or backed up outside of South Africa (for example, on secure cloud infrastructure or downstream international applications like Google or AWS). We take reasonable steps to ensure that any international Operator provides data security baselines that meet or exceed the requirements set out under POPIA.

Third-Party Access (Operators)

We will never sell your information. We only share critical details with trusted technical Operators (e.g., payment gateways, local/international secure hosting infrastructure, or secure CRM software) necessary to deliver our Services. All Operators are contractually bound to process your data with strict confidentiality.

To deliver our services and process your inquiries and transactions efficiently, we share data captured on this website with the following third-party platforms, who act as Operators under POPIA:

Paystack WooCommerce Payment Gateway: Used to securely process online credit card and alternative payment transactions for e-commerce checkouts. Paystack processes transaction details, billing addresses, and payment card information through their secure external PCI-DSS-compliant payment infrastructure.

Elementor / Elementor Pro: Used to capture user data natively through built-in contact forms, inquiry blocks, and checkout layouts. Form entries and customer orders are stored in the website’s database and routed via email or API endpoints based on the specific form configurations.

GSheetConnector for Elementor Forms: Used to automatically sync and transmit submitted Elementor form data directly to secure external Google Sheets spreadsheets to manage customer inquiries and entries.

Yoast SEO: Used to manage on-page search engine optimization properties and automate sitemap metadata generation. No personal user data is collected or transferred externally by this utility.

Technical Security Safeguards & Local Data Processing

To safeguard user data integrity, optimize operational performance, and comply with POPIA’s data minimization and security requirements, we employ several internal software utilities locally within our secure web hosting environment. These tools process data directly on our local server infrastructure without transferring user database payloads to independent third parties:

WP-Optimize – Clean, Compress, Cache: Used to clean the database, compress image uploads, and cache pages to keep the site fast and efficient. Data structures and temporary cache files are managed strictly on a local level during routine automated maintenance tasks.

WPS Hide Login: Used locally to protect the website administration area by changing the login URL and preventing unauthorized access attempts to the default backend directories.

WP Maintenance: Used locally to display a custom waiting or maintenance screen to visitors while site updates or preparations are underway.

Advanced Custom Fields (ACF) & Code Snippets: Used locally by our administrative and development team to structure custom content fields and execute specific custom code functionalities natively within the WordPress environment.

SVG Support: Used purely as a safe administrative design utility to allow the secure upload and inline rendering of scalable vector graphics (SVG) using local CSS/JS. It does not touch or process user personal data.

Security Safeguards & Breach Protocols

We implement robust technical and organisational security measures to protect information against accidental loss, unauthorised destruction, or unlawful access. In the highly unlikely event of a confirmed security compromise or data breach, we will notify the South African Information Regulator and all affected Data Subjects without undue delay via written notification or prominent public publication.

Your Statutory Rights

As a Data Subject in South Africa, you hold the following rights:

  • To confirm whether we hold your Personal Information.
  • To request a record or a description of your Personal Information held by us (subject to the provisions of our PAIA Manual).
  • To request the correction, destruction, or deletion of your Personal Information.
  • To object, on reasonable grounds, to the processing of your data, or to object directly to direct marketing electronic communications.
  • To lodge a complaint with the South African Information Regulator at complaints.IR@inforegulator.org.za.


You may exercise any of these rights seamlessly by contacting our Information Officer directly at info@gather19.co.za.