Last updated: 21 September 2026

1. Introduction
Eksteenskuil Agricultural Co-operative (“EAC”, “the Co-operative”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.
This Privacy and POPIA Policy explains how we collect, use, store, protect and disclose personal information when you:

• Visit https://www.eksteenskuil.co.za;

• Contact or communicate with us;

• Subscribe to receive news or announcements;

• Submit an enquiry, application or registration;

• Participate in training, projects, events or community programmes; or

• Otherwise interact with the Co-operative.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African legislation.
This policy must be read together with our Cookies Policy and any specific privacy notice provided when information is collected.

2. Responsible Party
For purposes of POPIA, the responsible party is:
Organisation: Eksteenskuil Agricultural Co-operative
Registration number: ?
Physical address: Sand Island, Keimoes, 8860, Northern Cape
Postal address: Sand Island, Keimoes, 8860, Northern Cape
Website: https://www.eksteenskuil.co.za
Telephone: +27(0) 54 050 1156
General email: eksboere@gigs.co.za
The responsible party determines why and how personal information is processed.

3. Information Officer
Questions, requests or objections relating to personal information may be directed to the Co-operative’s Information Officer:
Information Officer: Mrs Filomaine Schwartz
Email: eksboere@gigs.co.za
Telephone: +27(0) 054 050 1156
Address: Sand Island, Keimoes, 8860, Northern Cape
The Information Officer is responsible for promoting and monitoring the Co-operative’s compliance with POPIA and handling requests concerning personal information.

4. Definitions
For purposes of this policy:

• Consent means a voluntary, specific and informed indication of permission to process personal information.

• Data subject means the person or organisation to whom personal information relates.

• Operator means a person or organisation that processes personal information on behalf of the Co-operative under a contract or mandate.

• Personal information means information relating to an identifiable natural person or, where applicable, an identifiable juristic person.

• Processing includes collecting, receiving, recording, storing, updating, using, sharing, linking, restricting, deleting or destroying personal information.

• Special personal information includes information concerning religious or philosophical beliefs, race or ethnic origin, trade-union membership, political persuasion, health, sex life, biometric information or criminal behaviour.

• Website means the Eksteenskuil website accessible at https://www.eksteenskuil.co.za.
   

5. Personal Information We May Collect
Depending on how you interact with us, we may collect:

5.1 Identification and contact information

• Full name and surname;

• Email address;

• Telephone or mobile number;

• Physical or postal address;

• Organisation, employer or business name;

• Position or role; and

• Preferred language or communication method.

5.2 Enquiry and communication information

• Information submitted through contact forms;

• Email, telephone or WhatsApp correspondence;

• Questions, requests, complaints and feedback; and

• Records of our responses and communication with you.
   

5.3 Training, programme and event information
Where online applications or registrations are offered, we may collect:

• Training or programme interests;

• Attendance and participation information;

• Qualifications, skills or experience;

• Employment, farming or business information;

• Accessibility or support requirements;

• Application documents; and

• Information required by training providers, programme partners or funders.

We will only collect identity numbers, financial information, health information or other sensitive information when it is necessary, lawful and clearly explained at the point of collection.

5.4 Member, farmer and stakeholder information
Where applicable, we may process:

• Membership or farming-unit information;

• Agricultural and production-related information;

• Product, market-access or development-support information;

• Stakeholder and partner contact details; and

• Records relating to services or support provided by the Co-operative.

5.5 Photographs and media
We may process photographs, video recordings, audio recordings, testimonials or success stories from training, agricultural, community and stakeholder activities.
Where an identifiable person is featured for promotional or website purposes, we will obtain appropriate permission unless another lawful justification applies.

5.6 Website and technical information
When you use the Website, we or our authorised service providers may collect:

• Internet Protocol address;

• Browser and device type;

• Operating system;

• Pages visited;

• Time and date of visits;

• Referring website;

• General location information;

• Website interactions; and

• Diagnostic and security information.

Further information is available in our Cookies Policy.

6. How We Collect Personal Information
We may collect personal information:

• Directly from you;

• Through website forms;

• Through email, telephone, WhatsApp or other communication;

• Through training, membership, project or event registrations;

• During meetings and stakeholder engagements;

• From an authorised representative;

• From programme partners, referral organisations or service providers;

• From publicly available sources where lawful; and

• Automatically through cookies and website technologies.

Where reasonably practicable, we will collect personal information directly from you.

7. Why We Process Personal Information
We may process personal information to:

• Respond to enquiries and requests;

• Communicate with members, farmers, partners and community stakeholders;

• Administer training, projects, events and development programmes;

• Assess applications or requests for support;

• Coordinate agricultural production and farmer-development activities;

• Support market-access and partnership initiatives;

• Maintain membership, participation and stakeholder records;

• Send requested news, notices and programme updates;

• Manage the Website and improve its content and performance;

• Protect the security and integrity of our systems;

• Maintain attendance, reporting and monitoring records;

• Meet funder, accreditation, contractual or legal requirements;

• Produce lawful statistical, historical or research information;

• Publish authorised photographs, testimonials or community stories;

• Prevent or investigate fraud, misuse or unlawful activity; and

• Exercise or defend legal rights.

We will not use personal information for a purpose that is materially incompatible with the purpose for which it was originally collected unless permitted by law or authorised by the data subject.

8. Lawful Grounds for Processing
Depending on the circumstances, we may process personal information where:

• You have provided consent;

• Processing is necessary to perform a contract or take steps requested before entering into a contract;

• Processing is required by law;

• Processing protects your legitimate interests;

• Processing is necessary for the proper performance of a public-law duty by a public body; or

• Processing is necessary to pursue the legitimate interests of the Co-operative or a third party, provided that your rights and interests are appropriately considered.

Where processing depends on consent, you may withdraw that consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.

9. Voluntary and Mandatory Information
Unless otherwise stated, providing personal information through the Website is voluntary.
However, certain information may be required to:

• Respond to an enquiry;

• Process an application;

• Register you for training or an event;

• Provide a requested service;

• Verify eligibility; or

• Meet a legal, contractual or reporting requirement.

If required information is not provided, we may be unable to process the request or provide the relevant service. We will identify mandatory fields where reasonably practicable.

10. Special Personal Information
We do not intend to collect special personal information through the general Website unless it is necessary for a specific, lawful purpose.
Where special personal information is required, we will:

• Explain why it is needed;

• Limit collection to what is relevant;

• obtain consent or rely on another lawful authorisation;

• Apply appropriate confidentiality and security measures; and

• Restrict access to authorised persons.

Visitors should not submit unnecessary health, biometric, criminal, religious or other special personal information through general contact forms.

11. Personal Information of Children
For purposes of POPIA, a child is generally a natural person under 18 years of age who is not legally competent to make the relevant decision without assistance.
The general Website is not intended to collect personal information directly from children without appropriate supervision.
Where the Co-operative offers youth training, educational or community programmes, personal information about children will only be processed:

• With the prior consent of a competent person, such as a parent or lawful guardian;

• Where processing is necessary to establish, exercise or defend a right or obligation in law; or

• Where another lawful authorisation under POPIA applies.

Parents or guardians who believe that a child’s information has been collected unlawfully should contact the Information Officer.

12. Direct Marketing and Communications
We may send newsletters, programme notices, opportunity alerts or promotional communications where:

• You have consented;

• You have requested the information;

• You are an existing member, participant or stakeholder and the communication is permitted by law; or

• Another lawful justification applies.

Every electronic marketing communication will, where required, provide a reasonable method to unsubscribe or opt out.
You may withdraw consent or object to direct marketing at any time by:

• Using the unsubscribe option in the communication; or

• Contacting the Information Officer.

We will not sell your contact information to third parties for their independent marketing.

13. Sharing Personal Information
We may share relevant personal information with:

• Website, hosting, email, cloud-storage and information-technology providers;

• Consultants and contractors providing authorised services;

• Training providers, assessors and accreditation bodies;

• Funders, project partners and programme stakeholders;

• Agricultural or industry-development partners;

• Professional advisers, including accountants, auditors and legal advisers;

• Government departments, regulators or law-enforcement authorities where legally required; and

• Other parties where you have consented or where disclosure is otherwise lawful.

Only information reasonably required for the relevant purpose will be shared.
Service providers processing personal information on our behalf must be subject to appropriate confidentiality, security and data-protection requirements.

14. International Transfers
The Website and related services may use hosting, email, analytics, cloud-storage or technology providers that process information outside South Africa.
Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with section 72 of POPIA. This may include relying on:

• Laws that provide an adequate level of protection;

• Binding agreements or contractual safeguards;

• Your consent;

• The performance of a contract; or

• Another ground permitted under POPIA.

15. Retention of Personal Information
We retain personal information only for as long as reasonably necessary to:

• Fulfil the purpose for which it was collected;

• Meet legal, contractual, accreditation or funder requirements;

• Resolve disputes;

• Maintain appropriate organisational records; or

• Establish, exercise or defend legal rights.

Retention periods depend on the type of information and the applicable legal or operational requirement.
When personal information is no longer lawfully required, we will securely delete, destroy or de-identify it. De-identified information may be retained for legitimate statistical, historical, research or reporting purposes.

16. Security of Personal Information
We take reasonable technical and organisational measures appropriate to the nature of the information and the risks involved.
These measures may include:

• Limiting access to authorised persons;

• Password and access controls;

• Multi-factor authentication where available;

• Secure website and email services;

• Antivirus and system-security controls;

• Backups and recovery procedures;

• Confidentiality obligations;

• Secure disposal of records;

• Service-provider due diligence; and

• Procedures for responding to security incidents.

No internet transmission or electronic-storage method is completely secure. We cannot guarantee absolute security, but we will take reasonable steps to protect personal information against loss, damage, unauthorised access, unlawful processing, destruction or disclosure.
Where required by POPIA, security compromises will be reported to the Information Regulator and affected data subjects as soon as reasonably possible.

17. Your Rights Under POPIA
Subject to applicable law, you have the right to:

• Be informed when personal information is collected;

• Be informed of certain security compromises;

• Ask whether we hold personal information about you;

• Request access to your personal information;

• Request correction or updating of inaccurate information;

• Request deletion or destruction of information that we are no longer authorised to retain;

• Object to processing on reasonable grounds;

• Withdraw consent where processing relies on consent;

• Object to direct marketing;

• Request information about third parties or categories of third parties that have accessed your information;

• Lodge a complaint with the Information Regulator; and

• Institute civil proceedings where permitted by law.

We may request proof of identity before processing a request. This is necessary to prevent unauthorised access to personal information.
Access requests may also be processed in accordance with the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and the Co-operative’s PAIA Manual, where applicable.

18. How to Exercise Your Rights
Requests relating to access, correction, deletion, objection, withdrawal of consent or direct marketing should be submitted to the Information Officer.
Your request should include:

• Your full name;

• Sufficient contact information;

• A clear description of the request;

• Details that will help us locate the relevant information; and

• Appropriate proof of identity.

We will respond within a reasonable period and in accordance with applicable law.
A lawful or prescribed fee may apply to certain formal access requests. If a fee applies, you will be informed before the requested records are provided.

19. Cookies
The Website uses cookies and similar technologies for security, core website functionality, preferences and, where enabled, analytics or marketing.
Non-essential cookies will be managed through the Website’s cookie-consent mechanism where applicable.
Please consult our Cookies Policy for information about:

• The cookie categories used;

• Their purposes;

• Third-party cookies;

• Cookie retention; and

• How to manage your preferences.

20. Third-Party Websites
The Website may contain links to external websites, social-media platforms or services not controlled by the Co-operative.
We are not responsible for the privacy practices, content or security of independent third parties. You should review the privacy policies of those third parties before providing them with personal information.

21. Automated Decision-Making
We do not currently use the Website to make decisions based solely on automated processing that produce legal consequences or substantially affect visitors.
If this changes, this policy and the relevant collection notices will be updated.

22. Complaints
We encourage you to contact our Information Officer first so that we can attempt to resolve your concern.
You also have the right to lodge a complaint with the Information Regulator of South Africa:
Information Regulator South Africa
Website: https://inforegulator.org.za
eServices and complaints portal: https://eservices.inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Telephone: 010 023 5200

23. Changes to This Policy
We may update this policy when:

• Our services or information-processing activities change;

• New website features or integrations are introduced;

• Legal or regulatory requirements change; or

• Our security or operational practices are updated.

The revised policy will be published on this page and the “Last updated” date will be amended.
Material changes may also be communicated through the Website or another appropriate channel.

24. Contact Us
Questions about this policy or our processing of personal information may be directed to:
Eksteenskuil Agricultural Co-operative
Information Officer: Mrs. Filomaine Schwartz
Email: eksboere@gigs.co.za
Telephone: +27(0) 050 1156
Physical address: Sand Island, Keimoes, 8860, Northern Cape
Website: https://www.eksteenskuil.co.za