Privacy Policy

OFHAS (Organisational Financial Health Assessment System) runs this website and is the responsible party for the personal information you give us here, as defined by the Protection of Personal Information Act, 2013 (POPIA). This page explains what we collect, why, who helps us process it, and what you can ask us to do with it.

What we collect and why

When you send us an enquiry

The contact form asks for your name, email address, and optionally your phone number, organisation name, the service you are interested in and a message. We store the enquiry, email it to our team so we can reply, and send you a confirmation email. We use it only to respond to you, and we do not add you to any mailing list because you enquired.

When you take the free assessment

To create your account we ask for your name, organisation name, email address and a password (stored only as a one-way hash), plus your organisation's size, annual revenue band, main financial challenge and timeline. We store your assessment answers and results so you can view your report and history. After you complete an assessment we email you a follow-up with your results, and we use your answers to decide how best to help your organisation.

When you share a report

If you share your report, we store the email address you send it to and create a link that expires. The recipient receives one email from us containing that link.

Cookies and analytics

Signing in uses a cookie that is strictly necessary to keep you logged in. We also remember your cookie choice and a few profile details in your browser's local storage.

With your permission we use Google Analytics to understand how visitors find and use the site. Google Analytics sets cookies (named _ga and _ga_*) and sends Google information such as the pages you visit, your device and browser type and your approximate location. It only loads if you click Accept on the cookie notice. If you click Decline, no analytics cookies are set and nothing is sent to Google, and the rest of the site works exactly the same. Analytics never runs on our admin pages or on password-reset and shared-report links.

You can change your mind at any time with the “Cookie settings” link in the footer, which deletes the analytics cookies and asks you again.

The videos on our site are played by Vimeo, which may set its own cookies when the player loads. We ask Vimeo not to track viewers.

Who processes it for us

We use these service providers (operators under POPIA) to run the site:

• Vercel, which hosts the website.
• Neon, which hosts our database.
• Resend, which sends our emails.
• Google, for Google Analytics, only if you accept analytics cookies.
• Vimeo, which plays the videos on our site.
• Stream Labs, which builds and maintains the website for us.

Some of these providers store or process information on servers outside South Africa. Where that happens, we rely on their contractual commitments to protect it to a standard comparable to POPIA.

How long we keep it

We keep your account, assessments and reports until you ask us to delete your account. We keep enquiries for as long as we need them to respond and follow up with you. You can ask us to delete either at any time.

Your rights

You may ask us what personal information we hold about you, ask us to correct or delete it, or object to how we use it. We respond within 30 days. If you are not satisfied with our response you may complain to the Information Regulator of South Africa at inforegulator.org.za.