×

VDBL Group

Privacy Policy

Effective date: October 2026. This policy applies to vdblgroup.com and all services offered by VDBL Group.

1. Responsible Party

VDBL Group (Pty) Ltd, registration number 2026/855908/07, trading as VDBL Group, is the responsible party as defined under the Protection of Personal Information Act 4 of 2013 (POPIA) in respect of all personal information processed through vdblgroup.com and in the course of providing its advisory services.

VDBL Group is a remote HR and labour advisory practice. It is not a law firm and does not provide legal representation.

2. Personal Information Collected

2.1 Website enquiries

VDBL Group collects the following personal information through the website enquiry form:

• Name
• Business name
• Email address, contact number, or both
• The topic of the enquiry, as selected from a list, and any short description provided

2.2 Free light check

When a business owner completes the free light check at vdblgroup.com/check, VDBL Group collects:

• Name
• Business name
• Cellphone number
• The approximate number of workers, as a range
• Answers (yes, no or not sure) to 15 questions about the business's employment practices, and the language chosen

The questions are about the business and its practices. They do not ask for the names or personal details of any worker, and owners should not include such details in their answers.

2.3 WhatsApp, email, phone and video calls

Personal information shared with VDBL Group by WhatsApp, by email to info@vdblgroup.com, or during phone or video calls is collected and processed to respond to and handle that communication.

2.4 Client documents

When a business engages VDBL Group, the client may send documents that contain personal information about its employees, such as staff lists, job titles, wages, working hours, start dates, contracts, payslips, time records and disciplinary records. In respect of this information the client remains the responsible party, and VDBL Group processes it only on the client's instructions and only to deliver the agreed service, as set out in the client agreement.

2.5 Publicly available sources

VDBL Group may collect and process contact information in respect of individuals at South African businesses where that information has been made publicly available by the business itself. The information collected for this purpose is limited to:

• Name and professional title
• Business email address
• Business telephone number

Such information is sourced only from business websites and company contact pages, LinkedIn and comparable professional networking platforms, company registrations and public business directories, and industry publications and publicly accessible professional profiles.

Where contact information is sourced from publicly available sources, VDBL Group will initiate no more than one unsolicited communication per recipient, for the sole purpose of requesting consent to further contact. No further marketing communication will be sent unless the recipient has expressly consented to receive it.

VDBL Group does not purchase personal information from data brokers or commercial marketing lists.

VDBL Group does not collect special personal information as defined under section 26 of POPIA, including information relating to health, race, ethnicity, religion, sexual orientation or criminal behaviour, through its website or in the course of its business development activities.

3. Manner of Collection

Personal information is collected by the following means:

• Through the enquiry form at vdblgroup.com and the free light check at vdblgroup.com/check
• Through WhatsApp messages exchanged with VDBL Group
• Through email correspondence to info@vdblgroup.com
• Through phone or video calls in connection with an enquiry, a free light check or an active engagement
• Through documents sent by clients during an engagement
• Through publicly available online sources, as described in clause 2.5

4. Purpose of Processing

4.1 Enquirers, free check users and clients

Personal information is processed for the following purposes:

• To respond to enquiries
• To prepare the free light check report and discuss it with the owner
• To discuss the matter raised and the appropriate next steps
• To provide the HR, labour or advisory services requested
• To communicate with the client during an active engagement
• To comply with applicable legal and regulatory obligations

4.2 Prospective clients

Contact information sourced from publicly available sources is processed for the following purposes:

• To make a single, individual approach to a business that may require HR and labour advisory services, for the purpose of requesting consent to further contact
• To communicate further only where the prospective client has expressly consented

VDBL Group does not conduct bulk email campaigns, mass cold calling or automated commercial messaging. All outreach is conducted on an individual and targeted basis. Every recipient may opt out of further contact at any time in accordance with clause 11.

5. Lawful Basis for Processing

• Consent: where a person submits an enquiry or completes the free light check, the act of submission, together with the consent notice shown with the form, constitutes consent to the processing of that information for the purposes in clause 4.1.
• Consent for direct marketing: in accordance with section 69 of POPIA, direct marketing by means of electronic communication, including email, SMS and WhatsApp, is sent only to persons who have given their consent, or to existing clients in respect of similar services, subject in each case to the right to opt out.
• Legitimate interest: VDBL Group relies on legitimate interest only in receiving and responding to enquiries submitted voluntarily, and in making the single initial approach described in clause 2.5 to request consent to further contact. In each instance, the legitimate interest of VDBL Group has been weighed against the interests and rights of the data subject, and the data subject retains the right to object.
• Contractual necessity: where a service agreement is in force between VDBL Group and a client, personal information is processed to the extent necessary to perform the agreed services.
• Legal obligation: personal information is processed where required to comply with applicable South African law.

6. Disclosure of Personal Information

VDBL Group does not sell, rent or trade personal information and does not share it with third parties for their own marketing or commercial purposes.

VDBL Group may disclose personal information only:

• Where required by South African law, a court order or a competent authority with lawful authority to compel disclosure
• Where the data subject has given explicit consent to disclosure to a specific third party for a specific purpose

VDBL Group makes use of third-party service providers, which currently include, but are not limited to:

• WhatsApp (Meta), for messages exchanged with VDBL Group
• Web3Forms, which delivers enquiry form and free light check submissions to VDBL Group by email
• Brevo, for sending email
• Google, for email and the secure storage of client records
• Cloudflare, which hosts vdblgroup.com

VDBL Group may engage additional or alternative service providers from time to time, provided that each processes personal information solely on behalf of VDBL Group and subject to obligations of confidentiality and security consistent with POPIA.

7. Transfer of Information Outside South Africa

Certain service providers engaged by VDBL Group store or process personal information on servers located outside the Republic of South Africa. Any such transfer takes place in accordance with section 72 of POPIA, on one or more of the following grounds:

• the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection substantially similar to that afforded by POPIA;
• the transfer is necessary for responding to a request made by the data subject or for the performance of a contract with the data subject; or
• the data subject has consented to the transfer.

8. Retention of Personal Information

• Enquiry and free light check information where no engagement follows: a maximum of 12 months from the date of submission, thereafter securely deleted.
• Information relating to an active or concluded engagement, including client documents: 5 years from the date the engagement ends, unless the client agreement provides otherwise or the client asks for its documents to be returned or deleted earlier and no legal obligation requires them to be kept.
• Contact information sourced from publicly available sources where no engagement follows: a maximum of 12 months from the date of last contact, thereafter securely deleted. Where an opt-out request has been received, the record is deleted without delay and only the minimum needed to prevent further contact is kept on a do-not-contact list.

9. Security of Personal Information

VDBL Group implements reasonable and appropriate technical and organisational measures to safeguard personal information against loss, damage, unauthorised access, disclosure and destruction. These measures include access-controlled accounts and devices, the segregation of each client's records, and the secure deletion of personal information from any working device or temporary location once the purpose for which it was processed has been fulfilled and the information has been securely filed.

No method of electronic transmission or storage is entirely secure. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, VDBL Group will notify the Information Regulator and the affected data subjects as required by section 22 of POPIA.

10. Rights of Data Subjects

• The right to ask whether VDBL Group holds personal information about the data subject, and to obtain a copy of it.
• The right to ask for inaccurate, misleading or incomplete personal information to be corrected.
• The right to ask for personal information to be deleted where it is no longer needed for the purpose for which it was collected, or where consent has been withdrawn and no other lawful ground for processing applies.
• The right to object to processing based on legitimate interest, on grounds relating to the data subject's particular situation.
• Where processing is based on consent, the right to withdraw that consent at any time, without affecting processing that took place before it was withdrawn.

Requests to exercise any of these rights may be directed to the Information Officer of VDBL Group at info@vdblgroup.com or on WhatsApp at 069 801 3350. VDBL Group may require reasonable proof of identity before acting on a request.

11. Direct Marketing and the Right to Opt Out

VDBL Group sends direct marketing communications only to persons who have consented to receive them, or to existing clients in respect of similar services. Any person may object to or withdraw consent for further marketing at any time, free of charge and without giving reasons.

To do so, the recipient may reply "unsubscribe", "opt out" or "stop" to any message, or send a written request to info@vdblgroup.com. Every marketing communication will include a simple means of opting out. VDBL Group will give effect to the request within five business days, after which no further marketing communication will be sent.

An opt-out from outreach does not affect processing needed to fulfil an existing engagement or to comply with a legal obligation.

12. Cookies and Website Data

vdblgroup.com does not use advertising cookies or tracking tools that identify individual visitors. VDBL Group may make use of privacy-friendly website analytics that do not use cookies or identify individual visitors, solely to understand overall website usage. The website stores the visitor's language choice in the browser so the site opens in the same language next time. This choice stays on the visitor's device and is not sent to VDBL Group.

The website loads its font from Google Fonts and is hosted by Cloudflare. In delivering the website, these providers may receive technical information such as the visitor's IP address, in line with their own privacy policies.

13. Amendments

VDBL Group may amend this Privacy Policy from time to time to reflect changes in the law, its processing practices or its services. The effective date above will be updated with each revision. The current version is always available on vdblgroup.com.

14. Contact and Complaints

A data subject who is not satisfied with how VDBL Group has handled a privacy concern may lodge a complaint with the Information Regulator of South Africa: