Privacy Policy

Last updated: 19 June 2026 · Effective: 19 June 2026

1. Responsible Party

This Privacy Policy applies to Mirembe Muse (Pty) Ltd (Registration No. 2026-005658), a private company incorporated in the Republic of South Africa ("we", "us", "the Company"). Our Information Officer is Nandawula Regine Kabali-Kagwa, reachable at legal@mirembemuse.co.za.

2. Scope & Applicable Law

We process personal information in compliance with the Protection of Personal Information Act, No. 4 of 2013 (POPIA) and its associated regulations. This policy governs all personal information collected through mirembemuse.co.za, our services, and our products.

3. Information We Collect

›Contact details: name, email address, telephone number
›Business details: company name, industry, job title
›Booking and service details: selected services, preferred dates, project notes
›Newsletter preferences: subscription status, language preference
›Technical data: IP address (processed by Arcjet for security), browser type, pages visited (PostHog analytics)
›Payment data: processed directly by PayFast or LemonSqueezy — we do not store card details

4. Lawful Grounds for Processing

We process personal information on the following grounds under POPIA:

›Contract: to fulfil our obligations when you book a service or purchase a product
›Consent: to send you The Mirembe Brief newsletter (you may withdraw consent at any time)
›Legitimate interest: to prevent fraud, improve our services, and maintain security
›Legal obligation: to comply with South African financial and tax legislation

5. Retention Periods

›Newsletter subscribers: until you unsubscribe, plus 1 year for suppression records
›Service booking records: 5 years (South African financial compliance requirement)
›Contact form enquiries: 3 years
›Technical logs: 90 days

6. Third-Party Processors

We use the following processors, each bound by appropriate data processing agreements: Supabase (database, EU region), Resend (transactional email), PostHog (analytics), Arcjet (bot and fraud protection), PayFast (payment processing, South Africa), LemonSqueezy (digital product payments), Vercel (hosting, EU region).

7. Cross-Border Transfers

Some processors operate outside South Africa. We ensure adequate protection through contractual safeguards and, where applicable, transfer mechanisms recognised under POPIA.

8. Your Rights as a Data Subject

Under POPIA, you have the right to:

›Request access to your personal information (submit a PAIA request — see our PAIA Manual)
›Request correction of inaccurate personal information
›Request deletion of your personal information (subject to legal retention requirements)
›Object to processing of your personal information
›Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, email legal@mirembemuse.co.za with the subject line "POPIA Data Subject Request". We will respond within 30 business days.

9. Cookies

We use essential cookies required for the website to function (session management, security tokens) and analytics cookies (PostHog) to understand how visitors use the site. Analytics cookies are only set with your consent.

10. Contact the Information Regulator

If you are not satisfied with our response to a data subject request, you may contact the Information Regulator of South Africa at inforeg@justice.gov.za or +27 (0)10 023 5207.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to newsletter subscribers and via a notice on this page. Continued use of our services after the effective date constitutes acceptance.