Privacy Policy


1. Who are we?

Infinity Environmental is a professional environmental consulting company, with its main operating entity Infinity Environmental (Pty) Ltd, registered in South Africa (hereafter “Infinity”). Depending on the circumstances, we can be both a responsible party and/or an operator, as defined in terms of the Protection of Personal Information Act, 4 of 2013 (POPIA), with respect to your personal information as defined in POPIA. From time to time, we process personal information of our employees, clients, consultants, and/or suppliers (business contacts) and of interested and affected parties in public processes, to enable us to do business with or provide services to them. In this notice, “you” means you as the individual we are engaging with and whose personal information we may need to collect and process to provide the requested services, or to indicate the company you represent. We may need to collect and process your personal information for the purposes described below.

2. What personal information is collected?

Infinity collects and processes a wide range of personal information as part of its business operations. In accordance with Section 18 of POPIA we hereby expressly inform you that when you engage with Infinity (hereafter “Infinity Engagement”), you may need to provide Infinity with the following, but not limited to, personal information:

  • Full names
  • Identity numbers
  • Registration numbers
  • Financial information, including bank account information
  • Statutory information
  • Physical and postal address particulars
  • Telephone numbers
  • Email addresses
  • Unique identifiers

The above personal information will, depending on the circumstances and purposes for which it is processed pursuant to the relevant Infinity Engagement, be:

  • Personal information that you agree to share with us on request, subject to the agreed terms and conditions, or an underlying agreement
  • Personal information that we as the responsible party require to enable legal and regulatory compliance
  • Personal information required for the performance of professional services in terms of a contract to which you are a party
  • Personal information that is necessary and required to protect your legitimate interests or the legitimate interests of another person
  • Personal information that is necessary and required to pursue the legitimate interests of Infinity or a third party

We may collect and record telephone calls and internet communication (including IP addresses), all correspondence we have with you irrespective of the medium of communication, details of your Infinity Engagement, and any visits to our website, mobile application and client portals. In addition, we collect and generate information in relation to your profile as a client or supplier of Infinity. We do not collect any special personal information as defined in Section 26 of POPIA, including your religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sexual orientation, or biometric information.

3. How is your personal information collected?

Infinity may make use of both “active processing” and “inactive processing” methods to collect personal information. When Infinity makes use of “active processing” to collect your personal information, it has directly been provided with your personal information pursuant to an enquiry in respect of our services, or when you provide personal information to Infinity pursuant to a specific Infinity Engagement. In instances where Infinity makes use of “inactive processing”, this means that Infinity has not actively been provided with your personal information, such as when Infinity deploys passive processing means and certain technologies to collect information from you, such as through the uses of cookies, web beacons, embedded scripts, and/or mobile device identifiers. These passive processing means allow Infinity to process certain non-personally identifiable information which can perhaps not be linked to you directly.

4. What do we do with your personal information and why do we collect it?

As a responsible company, employer, professional service provider, and corporate citizen, we only collect and process personal information for the purposes of conducting our business activities, pursuing legitimate interests, conducting legal or regulatory compliance activities as required by law or good business practice, or for the purposes for which the information is provided. The personal information you provide to Infinity in your Infinity Engagement is typically processed for the following purpose(s), which are connected to our legitimate business purposes:

  • Assessing prospective clients and projects, including risk and creditworthiness
  • Showing compliance with the relevant statutory obligations, including government reporting and specific local law requirements
  • Handling or defending complaints, disputes, or claims
  • Performing professional services and duties
  • Promoting Infinity's services
  • Recruitment and employment opportunities
  • Undertaking research relating to professional services activities
  • Sharing information with Infinity's related companies, credit agencies, government agencies, and legal and professional service providers, where appropriate.

This notice applies to all data (including all personal information) past, present, or future submitted by you to Infinity or which we otherwise obtain pursuant to undertaking our normal business activities. 

5. Who do we share your personal information with?

Infinity holds information and data in South Africa. It may also transfer personal information or data to data centres in any country, but only for the abovementioned lawful purposes and always subject to Infinity's Privacy Policy and the provisions of Section 72 of POPIA. For project or business purposes it may be necessary to share your personal information with select business contacts on a need-to-know basis. We give you the assurance that we will consistently apply our Privacy Policy to our business contacts and establish a lawful justification, which may include consent, for the sharing of personal information with any third party. We will conclude written agreements with them to ensure your personal information remains secure and confidential, and that it is only used for the agreed purpose. To assess and determine the risk profile of prospective employees, clients, business partners, and/or projects, we may share your personal information with our preferred verification agencies. The list of current agencies used is available on request from the information officer.

6. Where do we store your personal information?

Infinity has implemented reasonable technical and organisational information security measures to protect personal information. All your personal information is stored securely by Infinity. In storing your personal information, we may transmit or transfer personal information outside South Africa, and, as such, personal information may be stored on servers located in foreign countries that have different data protection laws in place. Despite all our attempts to keep your personal information safe and secure, unauthorised access remains a possibility. Infinity will not take responsibility for anyone outside of Infinity's control breaching its security measures. You must review the conditions of use and security of any third-party websites made available through hyperlinks on its website before use. 

7. How long do we store your personal information?

Infinity will store or retain your personal information for the period required in accordance with Infinity's legitimate interest to do so or for the period necessary to comply with our legal and regulatory obligations related to the storage of specific types of records and/or information.

8. What are your rights?

You have rights when it comes to your personal information, but bear in mind that there may be various considerations in deciding how to deal with any requests you may have. As required by POPIA we have a process through which you can engage with us to request access to information. We will review or process the request and provide a response. Your rights include:

  • Right of access – you can ask us for a copy of the personal information we store
  • Right to know – you can ask us what personal information is or was shared with any of our business contacts or any third party
  • Right to change – you can ask us to update your personal information or delete any personal information that is no longer accurate or relevant
  • Right to object – you can object to our processing of your personal information
  • Right to report – you can lodge a complaint with the information regulator if you are of the view that we are not complying with POPIA. 
The contact details of the Information Regulator are:

The Information Regulator (South Africa)

JD House 27

Stiemens Street

Braamfontein Johannesburg, 2001

PO Box 31533 Braamfontein, Johannesburg, 2107


You agree that the laws of the Republic of South Africa shall apply exclusively to any legal dispute.