How we handle
your information.

Introduction.

HIMARK (Pty) Ltd ("HIMARK", "we", "our", "us") is a private company registered in the Republic of South Africa, operating as an independent strategic growth consultancy. This Privacy Notice explains how HIMARK collects, uses, discloses, and protects personal information of prospective clients, engaged clients, applicants, suppliers, and visitors to our website and digital channels.

This notice is issued in compliance with the Protection of Personal Information Act, 4 of 2013 ("POPIA") of the Republic of South Africa. Where applicable to international clients, we observe the principles of the General Data Protection Regulation ("GDPR") for European data subjects.

By submitting an Application for Engagement, corresponding with us, or otherwise providing personal information to HIMARK, you acknowledge that you have read and understood this notice.

Information we collect.

HIMARK collects personal information directly from data subjects, primarily through the Intake form on our website, professional correspondence, and during engagement onboarding. Categories of information we may process include:

[ Identity & Contact ]

• Full name, role, and organisation of the applicant
• Direct email address and direct telephone line
• Physical and postal addresses, where provided in correspondence

[ Engagement Information ]

• Nature of the strategic objective and commercial constraints described in your application
• Tier of engagement of interest and supplementary commercial context shared during scoping
• Records of correspondence, meetings, and consultations during the engagement lifecycle

[ Technical & Usage Information ]

• IP address, browser type, device type, and approximate location, collected via standard web logs
• Interaction data with the Atlas assistant, including chat transcripts and channel of origin (web, WhatsApp, voice)
• Performance metadata used to maintain service quality and security

HIMARK does not intentionally collect special personal information as defined in section 26 of POPIA (including health, religious, biometric, or similar categories). Please do not share such information with us unless we have specifically requested it for a legitimate engagement purpose.

Lawful basis.

HIMARK processes personal information only where one or more of the following lawful bases apply, in line with section 11 of POPIA:

• Consent — where you have voluntarily provided information through the Intake form or other channels for the purpose of engagement enquiry
• Performance of a contract — where processing is necessary to evaluate, scope, deliver, or invoice a HIMARK engagement
• Legitimate interest — where processing is necessary for our legitimate operational interests, balanced against your privacy rights
• Legal obligation — where processing is required by South African law, including tax, regulatory, or anti-money-laundering obligations

How we use information.

Personal information collected by HIMARK is used strictly for the following purposes:

• Reviewing and responding to Applications for Engagement, including pre-qualification correspondence
• Delivering the contracted scope of work to engaged clients, including advisory sessions, deliverables, and reporting
• Operating and improving the Atlas assistant and the AIRaaS product line
• Maintaining commercial records, issuing invoices, and complying with statutory reporting obligations
• Securing our digital infrastructure, detecting fraudulent activity, and investigating misuse
• Communicating updates relevant to existing engagements or — only with explicit consent — limited firm announcements

HIMARK does not engage in mass marketing, advertising profiling, or the sale of personal information under any circumstances.

Disclosure & sharing.

HIMARK shares personal information only where strictly necessary, and only with parties bound by confidentiality and data-protection obligations consistent with this notice.

• Operational service providers — limited to vetted technology vendors providing infrastructure to HIMARK, including communications, accounting, and customer-relationship platforms
• Professional advisors — including legal, tax, and audit professionals retained by HIMARK on a confidential basis
• Regulatory and law-enforcement authorities — where compelled by valid legal process or required by South African law

HIMARK does not share, license, or otherwise commercialise personal information with third parties for marketing or advertising purposes.

International transfers.

Some of our service providers operate outside the Republic of South Africa. Where personal information is transferred across borders, HIMARK ensures that:

• The recipient is bound by laws or contractual provisions providing protection substantially similar to POPIA
• The transfer is necessary for the conclusion or performance of a contract concluded in your interest
• You have consented to the transfer where consent is the applicable lawful basis

A list of categories of cross-border processors used by HIMARK is available upon written request.

Retention.

HIMARK retains personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law, whichever is longer.

• Application records of unsuccessful applicants are retained for twelve (12) months from the date of submission
• Engagement records of contracted clients are retained for seven (7) years from the date of engagement closure, in line with prudent commercial and tax-record requirements
• Atlas assistant transcripts are retained for ninety (90) days by default, unless extended for an active engagement
• Aggregated, de-identified data may be retained indefinitely for analytical and product-improvement purposes

Your rights.

Subject to POPIA and applicable law, you have the following rights with respect to your personal information:

• Right of access — to confirm whether HIMARK holds your personal information and to obtain a record of it
• Right to correction — to request that inaccurate or incomplete information be corrected or completed
• Right to deletion — to request the destruction of personal information no longer required for the purpose for which it was collected
• Right to object — to object to processing on legitimate grounds, including direct marketing
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time
• Right to lodge a complaint — with the Information Regulator of South Africa

Security.

HIMARK applies technical and organisational measures consistent with prudent industry practice to protect personal information against loss, unauthorised access, alteration, and disclosure. These measures include encrypted transmission of data in transit, access controls on operational systems, role-based limitations on internal access, and regular review of our security posture.

No system is impenetrable. Should HIMARK become aware of a personal-information breach that creates a reasonable risk of harm, we will notify the Information Regulator and affected data subjects in line with section 22 of POPIA.

Contact & complaints.

HIMARK has appointed an Information Officer responsible for compliance with POPIA. Queries, requests, and complaints regarding the handling of personal information should be directed in writing to:

If you believe HIMARK has not adequately addressed a complaint regarding the handling of your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

HIMARK reserves the right to update this Privacy Notice from time to time. Where changes are material, we will notify affected data subjects directly. The current effective version is recorded at the head of this document.