Privacy – IGHAC

Section 1. Who We Are and How to Reach Us

This Privacy Policy applies to the International Gambling Harm Advisory Committee NPC (CIPC Reg. 2026/687049/08), a non-profit company incorporated in South Africa under the Companies Act 71 of 2008, operating as an independent advisory body on gambling harm (referred to throughout this policy as "IGHAC", "we", "us", or "our").

IGHAC is the responsible party (data controller) for personal information processed through this website, the IGHAC Member Platform, and IGHAC's research and administrative activities.

Information Officer. In accordance with section 55 of the Protection of Personal Information Act 4 of 2013, IGHAC has designated an Information Officer. Registration with the Information Regulator of South Africa is in progress, and this notice will be updated with the registration reference once it is issued.

Name: PJ Van Staden
Role: Information Officer, IGHAC NPC
Direct email: Pierre@ighac.org
Alternative: info@ighac.org, with the subject line marked Formal
Postal address: available on written request

The Information Officer is responsible for encouraging compliance with POPIA, dealing with requests made to IGHAC under the Act, working with the Information Regulator, and ensuring that IGHAC's personal information impact assessments are carried out. You may also lodge a complaint directly with the Information Regulator of South Africa at any time.

Section 2. Legal Framework

IGHAC processes personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), which governs the processing of personal information of South African data subjects. For personal information relating to data subjects in the United Kingdom, Ireland, and Kenya, IGHAC applies the privacy protections required under applicable local legislation, including the UK General Data Protection Regulation (UK GDPR), Ireland's Data Protection Act 2018 (incorporating the EU GDPR), and Kenya's Data Protection Act 2019.

POPIA is the governing framework for IGHAC's processing. IGHAC is incorporated and established in South Africa, and its processing is carried out in South Africa. Where a data subject is located in the United Kingdom, Ireland or Kenya, the applicable local law also applies to that processing on its own terms and is complied with in addition to POPIA. IGHAC does not elect between these frameworks: each applies where its own scope provisions say it applies. Where a specific obligation differs, IGHAC applies the more protective requirement as a matter of operational practice, but this is a practice standard and is not the lawful basis for any processing. The lawful basis for each processing activity is stated under the applicable statute.

Section 2A. Special Personal Information

Certain information that IGHAC may process, including information concerning a person's health or mental health, is special personal information under section 26 of POPIA. The processing of special personal information is prohibited unless one of the grounds in section 27 applies, or unless the Information Regulator has granted an authorisation under section 57.

IGHAC applies the following position:

IGHAC does not process identified individual harm assessment data. Where a member practitioner uses an assessment tool through the Member Platform, the identified record belongs to that practitioner and their client relationship. IGHAC is not the responsible party for that record.
Where IGHAC processes assessment-derived information for research or programme purposes, it does so only in aggregate, de-identified form from which an individual cannot be identified, whether directly or indirectly, and which therefore falls outside the definition of personal information.
Where a specific research study requires the processing of identified or identifiable special personal information, that study proceeds only with a separate, explicit and informed research consent obtained under section 27(1)(a), under a protocol approved by the ethics committee of a recognised academic institution, and, where required, with the authorisation of the Information Regulator under section 57.
No output of the IGHAC Member Platform constitutes a clinical diagnosis, a clinical referral decision, or medical advice. Clinical decisions remain the responsibility of the registered practitioner.

This section states IGHAC's operating position. IGHAC has commissioned an independent legal opinion on special personal information processing under sections 26, 27 and 57 of POPIA, and this section will be updated to reflect that opinion when it is received. Where the opinion requires a narrower position, the narrower position will be adopted.

Section 3. What Personal Information We Collect

IGHAC collects only the personal information necessary for its operational purposes. The categories of personal information we collect include:

Identity information: Full name, professional title, and institutional affiliation provided when you contact us, apply for membership, or register for events
Contact information: Email address, telephone number, and geographic location (country or region) provided voluntarily
Professional information: Professional background, qualifications, areas of practice, and employer, where relevant to membership or partnership enquiries
Member account information: Login credentials (passwords are stored in encrypted form and never in plain text), account preferences, and platform usage data for individual and organisational participants
Assessment data: Where IGHAC's harm assessment tools are used by member practitioners, de-identified outcome data may be retained for research purposes with the explicit consent of the practitioner. No individual-level identified assessment data is retained by IGHAC without explicit consent
Technical data: IP address, browser type, device type, and pages visited, collected automatically through standard website analytics for the purpose of website maintenance and improvement
Communications: The content of emails and other written communications you send to IGHAC

Section 4. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

Processing and managing membership applications and ongoing membership relationships
Providing access to the IGHAC Member Platform and associated services
Sending member communications including newsletters, research alerts, and event invitations, where you have consented to receive these
Responding to enquiries, applications, and formal correspondence
Administering partnership agreements and research collaborations
Processing anonymised and aggregated research data for IGHAC's research programme, where consented
Maintaining IGHAC's organisational records and meeting statutory compliance obligations
Improving this website and the Member Platform through anonymised analytics

IGHAC does not use personal information for marketing purposes beyond member communications you have opted into, and does not sell or rent personal information to any third party under any circumstances.

Section 5. Research Data Processing

Where IGHAC's Member Platform is used by participating practitioners to conduct harm assessments, the following data processing principles apply:

Individual assessment results belong to the practitioner and their client relationship. IGHAC does not access, store, or process identified individual assessment records without explicit informed consent
Aggregate, de-identified data from assessment completions conducted through the RiskAnalytix™ scan tools (RiskAnalytix is a trademark of Free Me South Africa (Pty) Ltd, used under licence, and is not an IGHAC mark) may be processed by IGHAC for research and programme improvement purposes. This data cannot be traced back to any individual
Where a member practitioner participates in a specific IGHAC research study, a separate research consent process applies

Section 6. Sharing of Personal Information

IGHAC shares personal information only in the following circumstances:

Service providers: IGHAC uses third-party service providers for website hosting, email services, and platform infrastructure. These providers process personal information only on IGHAC's instruction and are bound by appropriate data processing agreements
Legal obligation: IGHAC will disclose personal information where required to do so by applicable law, court order, or lawful regulatory authority request
With your consent: IGHAC will share personal information with third parties where you have given explicit prior consent
Founding partner: Free Me South Africa (Pty) Ltd is a separate legal entity and is not part of IGHAC. Where FMSA provides a service to IGHAC, it does so as an operator under section 20 of POPIA, processing only on IGHAC's written instruction and only for the specific purpose instructed. IGHAC does not share personal information with FMSA for FMSA's own purposes, for governance purposes, or for any commercial purpose. Research data is held in a store that is separate from any FMSA system.

IGHAC does not share personal information with gambling operators, commercial marketing organisations, or any third party for commercial gain.

Section 7. International Data Transfers

IGHAC is established in South Africa and its processing is carried out here. Four jurisdictions are within IGHAC's research scope: South Africa, Kenya, the United Kingdom and Ireland. Personal information may be transferred outside the Republic where a service provider hosts data abroad, or where a research collaboration involves an institution in another jurisdiction.

Any such transfer is made only on a basis permitted by section 72 of POPIA, which requires that the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, or that the data subject consents, or that the transfer is necessary to perform a contract. IGHAC does not transfer special personal information, including health-related information, or the personal information of children, to a third party in a foreign country that does not provide an adequate level of protection. Were that ever contemplated, prior authorisation would first be obtained from the Information Regulator under section 57 of POPIA.

Section 8. Retention of Personal Information

IGHAC retains personal information only for as long as necessary for the purposes for which it was collected, and as required by applicable law or professional standards. Specific retention periods include:

Membership records: for the duration of membership plus five years following termination
Enquiry and correspondence records: three years from the date of last communication
Research consent and participation records: in accordance with the ethical approval under which the specific study was conducted
Financial records: as required by South African tax and accounting legislation

Section 9. Security of Personal Information

IGHAC implements appropriate technical and organisational measures to protect personal information against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include encrypted storage of passwords and sensitive data, access controls limiting data access to authorised personnel, secure connection protocols for all website and platform communications, and regular review of our data processing and security practices.

No data transmission over the internet is completely secure. While we take all reasonable steps to protect your information, we cannot guarantee the absolute security of data transmitted to or from this website.

Section 10. Your Rights as a Data Subject

Depending on the jurisdiction in which you are located, you may have the following rights in relation to personal information IGHAC holds about you:

Right of Access

Request a copy of the personal information IGHAC holds about you.

Right to Correction

Request that inaccurate or incomplete personal information be corrected.

Right to Deletion

Request deletion of your personal information, subject to applicable legal and contractual retention obligations.

Right to Object

Object to processing of your personal information in certain circumstances, including for direct marketing purposes.

Right to Portability

Request your personal information in a commonly used, machine-readable format, where applicable.

Right to Complain

Lodge a complaint with the relevant data protection authority in your jurisdiction.

To exercise any of the rights listed above, contact us at info@ighac.org (marked Privacy) with your full name, email address, and a clear description of your request. IGHAC will respond within the timeframe required by applicable law, typically 30 days.

Section 11. Cookies and Tracking

This website uses cookies and similar tracking technologies to improve the user experience and for website analytics. Cookies used on this website include essential cookies necessary for the website to function, and analytics cookies that collect anonymised data about how visitors use the site. We do not use advertising or third-party commercial tracking cookies.

You may control cookies through your browser settings. Disabling essential cookies may affect the functionality of this website and the Member Platform. Disabling analytics cookies will have no effect on your ability to use IGHAC's services.

Section 12. Children's Privacy

IGHAC's website and services are intended for professional users and are not directed at persons under the age of 18. IGHAC does not knowingly collect personal information from minors. If you believe that a minor has submitted personal information to IGHAC, please contact us immediately so that we can take appropriate steps to remove it.

Section 13. Amendments to This Policy

IGHAC reserves the right to amend this Privacy Policy at any time. Amendments will be effective upon publication on this website. The effective date displayed in the header of this document will be updated to reflect the most recent revision. Where amendments are material, IGHAC will notify registered members by email. Continued use of this website or the Member Platform following the publication of an amended policy constitutes your acceptance of the updated terms.