Privacy Policy

Franchise in a Box (Pty) Ltd

Effective date: 21 May 2026

Last updated: 21 May 2026

1. Introduction

Franchise in a Box (Pty) Ltd (“Franchise in a Box”, “we”, “us”, or “our”) is committed to protecting the privacy of visitors to our website at franchiseinabox.co.za (the “Website”) and any personal information you provide to us through the Website or in the course of our business. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the rights you have in relation to that information.

This Policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) of the Republic of South Africa. By using the Website or submitting personal information to us, you acknowledge that you have read and understood this Policy.

2. Who we are and how to contact us

Responsible party: Franchise in a Box (Pty) Ltd

Physical address: 655 Marine Drive, Brighton Beach, Durban, South Africa

Telephone: 082 451 1604

Email: robin@franchiseinabox.co.za

Information Officer: Robin van Rensburg

Information Officer email: robin@franchiseinabox.co.za

All enquiries relating to this Policy, requests to access or correct personal information, or complaints regarding our processing of personal information should be addressed to the Information Officer at the contact details above.

3. Personal information we collect

We collect personal information that you provide to us directly, and certain limited information collected automatically when you use the Website.

3.1 Information you provide

When you submit our contact form, request a consultation, subscribe to communications, or otherwise correspond with us, you may provide the following:

  • Your name (first and last)
  • Your email address
  • Your telephone or mobile number
  • The content of any message you send us, including details about your business or franchising enquiry
  • Any other information you voluntarily provide in correspondence with us

3.2 Information collected automatically

When you visit the Website, certain information is collected automatically by our systems and by the third-party services we use:

  • IP address, approximate geographic location (city or region), and internet service provider
  • Browser type and version, operating system, screen size, and device type
  • Pages viewed, time spent on each page, referring URL, and outbound links clicked
  • Date and time of your visit

This information is collected through Google Analytics and through standard server logs. It is used in aggregate to understand how visitors use the Website and to improve our content and user experience.

4. Cookies and similar technologies

The Website uses cookies (small text files stored on your device) and similar technologies. We use the following categories:

4.1 Strictly necessary cookies

These cookies are essential for the Website to function properly (for example, to remember the state of an embedded map or to maintain a session while you complete the contact form). They do not require your consent.

4.2 Analytics cookies

We use Google Analytics to understand how visitors interact with the Website. Google Analytics sets cookies that allow it to recognise repeat visits and measure usage patterns. The data collected is processed by Google LLC and may be stored on servers outside South Africa. Google’s privacy practices are available at https://policies.google.com/privacy.

4.3 Managing cookies

You can control and delete cookies through your browser settings. Disabling cookies may affect the functionality of certain features of the Website but will not prevent you from accessing our content.

5. How we use your personal information

We process personal information for the following purposes:

  • To respond to enquiries you submit through the contact form or by email, telephone, or WhatsApp
  • To provide the franchise development services you request, including franchise readiness assessments, documentation, training, and related consulting
  • To send you occasional newsletters, updates, or follow-up communications where you have consented or where this is in our legitimate interest as a service provider responding to a prior enquiry
  • To improve the Website and our service offerings based on aggregated usage data
  • To comply with our legal, regulatory, and accounting obligations
  • To establish, exercise, or defend legal claims

6. Lawful basis for processing

Under POPIA, we process personal information on one or more of the following lawful bases:

  • Your consent, which you provide by submitting the contact form, requesting communications, or otherwise voluntarily sharing your information
  • The performance of a contract, or steps taken at your request prior to entering into a contract for our services
  • Our legitimate interests as a business, where these are not overridden by your rights and interests (for example, responding to enquiries and improving our service)
  • Compliance with a legal obligation imposed on us

7. Marketing communications and consent

From time to time we may send you newsletters, service updates, or follow-up communications relating to franchise development. We will only do so where you have provided consent, or where you are an existing enquirer or client and the communication relates to similar services.

Every marketing communication we send will include a clear method to unsubscribe. You may also withdraw your consent at any time by emailing robin@franchiseinabox.co.za with the word “Unsubscribe” in the subject line. Withdrawal of consent will not affect the lawfulness of any processing carried out before your withdrawal.

8. Who we share your information with

We do not sell your personal information. We share it only with the following categories of recipients, and only as necessary for the purposes set out above:

8.1 Service providers (operators) acting on our instructions

  • Our website host and email service provider (currently UK2 Group / StackCP), which processes server-side data including form submissions and outbound email
  • WPForms, which processes contact form submissions on our behalf
  • Google LLC, which provides Google Analytics and Google Maps services used on the Website
  • Any future email marketing platform we adopt for newsletters, in which case this Policy will be updated

Each of these service providers is contractually or legally required to process personal information only on our instructions and to apply appropriate security safeguards.

8.2 Professional advisors and authorities

We may disclose personal information to our legal, accounting, or other professional advisors where reasonably necessary, and to any regulatory authority, court, or government body where we are required to do so by law.

9. Cross-border transfers

Some of the third parties listed above (notably Google and our hosting provider) operate servers outside the Republic of South Africa. Where personal information is transferred outside South Africa, we rely on POPIA section 72, which permits cross-border transfers where the recipient is subject to a law, binding corporate rules, or a binding agreement providing an adequate level of protection substantially similar to POPIA.

10. How long we keep your information

We retain personal information only for as long as is necessary for the purposes for which it was collected, or as required by law. In practice:

  • Contact form submissions and enquiry correspondence are retained for up to three (3) years from the date of last contact, after which they are deleted unless an active service engagement is in progress
  • Client records relating to engagements are retained for a minimum of five (5) years after the end of the engagement, in line with applicable tax and accounting rules
  • Newsletter subscriber data is retained until you unsubscribe or request deletion
  • Analytics data is retained in accordance with Google Analytics’ default retention settings (currently 14 months)

11. Security

We apply reasonable technical and organisational measures to safeguard personal information against loss, unauthorised access, alteration, or disclosure. These measures include SSL encryption of data in transit, access controls on our administrative systems, regular software updates, and limiting access to personal information to those of our personnel and service providers who need it to perform their roles.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. We will notify you and the Information Regulator without undue delay if we become aware of a security compromise that creates a real risk of harm to you, as required by section 22 of POPIA.

12. Your rights as a data subject

Under POPIA you have the following rights in relation to your personal information. You may exercise any of these rights by contacting the Information Officer at robin@franchiseinabox.co.za:

  • The right to be notified that we are collecting your personal information, and that it has been accessed or acquired by an unauthorised person
  • The right to request access to personal information we hold about you
  • The right to request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully
  • The right to object, on reasonable grounds, to the processing of your personal information
  • The right to object to processing for direct marketing purposes
  • The right to withdraw consent at any time, where processing is based on consent
  • The right to submit a complaint to the Information Regulator

13. Complaints to the Information Regulator

If you believe that we have not handled your personal information in accordance with POPIA, you may lodge a complaint with the Information Regulator of South Africa:

The Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Email: complaints.IR@justice.gov.za

Website: https://inforegulator.org.za

14. Children

The Website and our services are intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact the Information Officer and we will take steps to delete it.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this Policy reflects the most recent revision. We encourage you to review the Policy periodically. Where changes are material, we will take reasonable steps to bring them to your attention, including by notice on the Website.

16. Governing law

This Privacy Policy is governed by the laws of the Republic of South Africa, including POPIA and the Electronic Communications and Transactions Act 25 of 2002.

 

— End of Privacy Policy —