Legal
Privacy Policy
This policy explains how STATS-LAB (Pty) Ltd collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
Last updated 15 October 2026
1. Who we are
STATS-LAB (Pty) Ltd (registration number 2019/629675/07) is the responsible party for the personal information described in this policy.
Address: 1st Floor, Block B, North Park, Black River Park, 2 Fir Street, Observatory, Cape Town, 7925, South Africa
Telephone: +27 87 550 0344
Email: info@stats-lab.com
Information Officer: Roger Rodney Cupido, Director
2. Client privacy
We treat every enquiry and engagement as confidential. We do not name our clients, discuss their work with others or use them as references without their prior permission. We never sell personal information.
3. What we collect
Contact details: your name, email address, telephone number, institution or organisation, and role.
Enquiry and project details: what you tell us about your study, your supervisor (if you are a student), deadlines and the service you need. When you sign up for a monthly plan, we also keep a record of the terms you accepted and your signature on our non-disclosure agreement, with the date, time and IP address.
Billing details: the name and address of the person or institution paying, VAT or order numbers, and payment records. Online payments are processed by Paystack. We do not see or store your card details.
Research data: datasets and documents you send for analysis. See section 6.
Website data: technical information such as your IP address, browser type and the pages you visit, collected through server logs and cookies. See section 9.
4. How we collect it
Mostly directly from you, when you complete a form on our website, book an appointment through our online booking page, email or phone us, or engage us. Bookings are also subject to our Booking Terms. Sometimes from your supervisor, institution or funder when they arrange or pay for our services. Website data is collected automatically.
5. Why we use it
To answer your enquiry and prepare a quote (to take steps at your request before a contract).
To deliver the services and communicate with you about them (to perform our contract with you).
To take payment, invoice and keep financial records (to perform our contract with you and to comply with tax and company law).
To keep our website secure and working (our legitimate interest).
To send you news about our services, only if you have agreed or you are an existing client and have not opted out (see section 8).
We collect only what we need for these purposes.
6. Research data
6.1 When you send us research data, we process it on your behalf and only to provide the services you asked for. You, or your institution, remain responsible for the data, including ethics approval and participant consent.
6.2 Please remove names and other directly identifying details before you send data, unless we have agreed otherwise in writing.
6.3 We keep research data confidential and do not share it outside our team without your written permission. We do not publish your data or findings.
6.4 We are not a data repository. Keep your own copy of your data. Because publication and reviewers' comments can take many months, we keep your data and our working files for 24 months after the engagement ends, so that we can help with revisions. We then delete them, or sooner if you ask, unless the law requires us to keep them or you ask us in writing to keep them longer.
6.5 We may use artificial intelligence (AI) tools to help with parts of your project, such as searching and organising literature, checking and drafting text, and analysis. We use them only for your project, and only with providers whose terms do not allow them to train their models on what we send. Data that you have de-identified (see 6.2) may be processed by AI tools that meet these conditions. We do not process identifiable personal information, health information or other special personal information with AI tools unless you have agreed in writing first. These tools are service providers under section 7, and some process information outside South Africa (see 7.2). A person at STATS-LAB checks all AI-assisted work, and every reference in it is verified, before it reaches you.
7. Who we share it with
7.1 We share personal information only with:
service providers who help us run our business, such as website hosting, email, online booking (Cal.com), online payments (Paystack), accounting (Xero), our client records system (Supabase and Vercel), automated links between these systems (n8n, running on our own server hosted by xneelo in South Africa), cloud storage and artificial intelligence (AI) tools (see section 6.5), under contracts that require them to protect it;
the person or institution you name as responsible for payment, limited to what they need to settle the account;
professional advisers, auditors or authorities, where the law requires it.
7.2 Some of our service providers store information outside South Africa. When this happens, we use providers that are bound by laws, binding rules or agreements that give protection substantially similar to POPIA, as section 72 of POPIA requires.
8. Marketing
We do not currently run a mailing list. If we start one, we will add you only with your consent, or, if you are an existing client, to tell you about similar services. Every message will include a way to unsubscribe, and you can also opt out by emailing info@stats-lab.com.
9. Cookies
9.1 Our website uses cookies that are needed for it to work, including a cookie that remembers your cookie choices and one that remembers your accessibility settings.
9.2 We use other cookies, such as analytics cookies, only if you accept them in the cookie banner. You can change your choice at any time through the banner or your browser settings.
9.3 Our site does not have comments or user accounts.
10. Security
We protect personal information and research data with reasonable technical and organisational measures, including access controls, encrypted storage and transfer where available, and confidentiality obligations for everyone who works with us. We review these measures at least once a year. If we believe your personal information has been accessed without authorisation, we will notify you and the Information Regulator as POPIA requires.
11. How long we keep it
We keep personal information only as long as we need it for the purposes above, or as long as the law requires. For example, financial records are kept for at least five years. Research data is dealt with as set out in section 6.4.
12. Your rights
You have the right to:
ask whether we hold personal information about you and request a copy;
ask us to correct or delete personal information that is inaccurate, out of date, incomplete or unlawfully held;
object to our processing of your personal information on reasonable grounds, and to direct marketing at any time;
withdraw your consent where we rely on it;
lodge a complaint with the Information Regulator (South Africa) at https://inforegulator.org.za.
To exercise these rights, email info@stats-lab.com. We may need to confirm your identity first. Access requests are handled in line with the Promotion of Access to Information Act 2 of 2000 and our PAIA Manual.
13. Children
Our services are for adults. We do not knowingly collect personal information from children under 18 through this website.
14. Changes to this policy
We may update this policy. The latest version is always on our website with its effective date.
15. Contact us
For questions about this policy or your personal information, contact our Information Officer at info@stats-lab.com or +27 87 550 0344, or write to STATS-LAB (Pty) Ltd, 1st Floor, Block B, North Park, Black River Park, 2 Fir Street, Observatory, Cape Town, 7925, South Africa.