POPIA Information Notice

Your personal information is collected for the following specific purposes:

1. Verifying your business identity against the CIPC register
2. Creating Digital Product Passport records in the National Forensic Trust Registry
3. Calculating and logging the 2% transaction royalty on declared shipment values
4. Enabling EU customs authorities and AI procurement systems to verify your passport
5. Sending compliance deadline alerts and registry notifications
6. Maintaining the POPIA consent audit trail for the DPP AI assistant

We collect: CIPC registration number, Smart ID number, business name and address, email address, declared shipment values, and document SHA-256 hashes. We do not collect or store the original documents themselves.

Your personal information may be shared with:

• EU customs authorities — when they query your verification URL to confirm passport validity
• CIPC — for identity verification queries
• Cloudflare — as our infrastructure provider (data processor, not controller)
• Law enforcement — only when legally compelled by a valid court order

We do not sell or share your personal information with any third party for commercial purposes.

Your data may be processed on servers in the United States and European Union (Cloudflare edge nodes). These transfers comply with POPIA Section 72 and are subject to appropriate contractual safeguards.

Under POPIA, you have the right to access, correct, and request deletion of your personal information. You may also object to processing and lodge a complaint with the Information Regulator at inforegulator.org.za.

Providing your CIPC number, Smart ID, and email address is mandatory to use the Registry's minting and verification services. Without this information, we cannot create a legally valid Digital Product Passport. Providing information to the DPP AI assistant is entirely voluntary.