CL Legacy Solutions
Privacy Policy
In short: we collect only what we need to answer your enquiry, assess a travel-insurance application and arrange cover. We do not sell your personal information. Non-essential cookies stay off unless you accept them. You can ask what we hold about you, ask us to correct it, or ask us to delete it.
1. Who we are and how to reach us
CL Legacy Solutions (Pty) Ltd (registration number 2026/411320/07), trading as CL Legacy Solutions (“we”, “us”, “our”), is the responsible party for the personal information described in this policy, as defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”).
| Detail | Information |
|---|---|
| Responsible party | CL Legacy Solutions (Pty) Ltd |
| Company registration number | 2026/411320/07 |
| [email protected] | |
| Telephone / WhatsApp | +27 (0) 82 066 1655 |
| Website | cllegacysolutions.co.za |
| Service area | South Africa (national) |
We are a travel insurance agent. We arrange travel-insurance cover for South African travellers in partnership with a licensed travel-insurance provider. We are not an insurer and we do not underwrite policies ourselves. Cover is subject to underwriting and to the policy terms, conditions, exclusions and excesses of the insurer.
Our regulatory status. CL Legacy Solutions (Pty) Ltd is not a registered financial services provider (FSP) and does not hold an FSP licence. We do not give regulated financial advice, bind cover, set premiums, issue policies or act as an insurer in our own right. We introduce enquiries and applications to our licensed travel-insurance partner (the travel agency / authorised FSP), which is responsible for any advice, underwriting, issuing the policy and handling claims. Cover is only in force once that partner has accepted the application and the insurer has issued the policy, and it remains subject to the insurer’s terms, conditions, exclusions and excesses.
Our licensed partner is subject to the Financial Advisory and Intermediary Services Act 37 of 2002 and to insurance record-keeping obligations. Those obligations are among the reasons certain application records are retained for the periods described in section 9.
Our Information Officer is the head of the business, who may be contacted at [email protected]. Any Deputy Information Officer we appoint can also be reached through that address. Requests under POPIA or the Promotion of Access to Information Act 2 of 2000 (“PAIA”) should be sent there.
2. What personal information we collect
2.1 Information you give us
- Enquiries (email, telephone, WhatsApp or the contact details on this site): your name, email address, phone number and the content of your message.
- Traveller details on a travel-insurance application: full name, South African ID or passport number, country of residence, date of birth, phone number and email address.
- Travel details: destination, departure and return dates, airline, date of first payment, trip type (leisure, business or both) and, where relevant, the business/leisure split.
- Health and lifestyle information you choose to provide: whether you do manual labour, the nature of your work or business, any chronic condition, medication and treating doctor, and participation in extreme or adventure sports. This is “special personal information” relating to health under section 26 of POPIA.
- Children travelling with you: first names, surnames, dates of birth and ID or passport numbers. This is personal information of a child (a person under 18) under section 34 of POPIA.
- Beneficiary details: first name, surname and cellphone number.
- Your confirmation that the information is true and complete, and your consent to the processing described here.
2.2 Information collected automatically when you use this site
- Your IP address, browser/user-agent information and the date and time of a submission. A hashed form of your IP address is kept for 20 seconds solely to prevent repeat submissions.
- A Cloudflare Turnstile token used to confirm that a form submission comes from a person rather than an automated script.
- Your cookie consent choices and a record that consent was given or refused.
- If you accept analytics cookies and Google Analytics is enabled: usage data such as pages viewed, approximate location derived from IP, device type and referring page.
We collect personal information directly from you (section 12 of POPIA). We do not buy personal information from data brokers, and we do not obtain it from third-party lists. The “Download a copy” button on the application creates a file on your own device; we do not receive a copy of that file.
3. Why we collect it and on what legal basis
We collect personal information for specific, explicitly defined and lawful purposes (section 13 of POPIA), and we will not use it for a new, incompatible purpose without first telling you and obtaining consent where required (section 15).
| Purpose | Information used | Legal basis (POPIA section 11) |
|---|---|---|
| Answering an enquiry and corresponding with you | Name, email, phone, message | Your consent; our legitimate interest in responding to you (s11(1)(a) and (f)) |
| Assessing a travel-insurance application, obtaining a quote and arranging cover | Traveller, travel, health/lifestyle, children’s and beneficiary details | Steps taken at your request to conclude or perform a contract (s11(1)(b)); your consent |
| Passing your application to the licensed travel-insurance provider for underwriting, policy administration and claims | The application details above | Performance of the contract with you (s11(1)(b)); your consent |
| Administering cover, handling claims and keeping records | Application details, reference number, correspondence | Contract (s11(1)(b)); compliance with a legal obligation (s11(1)(c)); your legitimate interest in having a usable record of your cover |
| Protecting the site and preventing spam, fraud and abuse | IP address, Turnstile token, timestamps | Our legitimate interest in keeping the service secure (s11(1)(f)) |
| Understanding how the site is used and improving it | Aggregated analytics data | Your consent, given through the cookie banner |
| Meeting legal, regulatory and record-keeping obligations | As required by the obligation | Legal obligation (s11(1)(c)) |
3.1 Special personal information
Health-related information is special personal information. Section 26 of POPIA prohibits processing it unless a section 27 gateway applies. We rely on your specific, informed consent under section 27(1)(a), given when you tick the consent box on the application form and submit it. Because we are an agent and not an insurer or medical scheme, we do not rely on the section 32 health-information authorisations. You may withdraw that consent at any time, although we may then be unable to continue assessing your application.
3.2 Children’s personal information
Section 34 of POPIA prohibits processing a child’s personal information unless section 35 applies. We rely on the prior consent of a competent person — the child’s parent or legal guardian. By submitting children’s details on the application, you confirm that you are that competent person and that you consent to the processing described here on the child’s behalf. If you are not the parent or guardian, please do not submit a child’s details.
4. Is providing the information voluntary, and what happens if you don’t?
Providing your information is voluntary. No law requires you to give it to us. However:
- Fields marked with an asterisk on the application form are needed to assess the application and arrange cover. If you leave them out, we cannot assess the application, request a quote or arrange cover.
- If you do not consent to the processing of health information, or omit health details that are relevant to the cover, the insurer may be unable to offer cover or may decline a later claim.
- If you do not provide children’s details, those travellers cannot be included on the application.
- You may browse the site without completing the application form. Non-essential cookies are optional and the site works without them.
5. Who we share your information with
We share personal information only with recipients who need it for the purposes above, and only to the extent needed (section 18(1)(h) of POPIA):
| Recipient / category | Why |
|---|---|
| Our licensed travel-insurance partner (the travel agency / authorised FSP; legal name and FSP number to be confirmed) and the insurer underwriting the cover | Underwriting, quotation, issuing and administering the policy, and handling claims |
| Our email and hosting providers (including the WP Mail SMTP mail relay and the web host) | Delivering application notifications and hosting the website and its database |
| Cloudflare (Turnstile) | Verifying that form submissions are genuine and blocking automated abuse |
| CookieYes (cookie consent platform) | Recording and honouring your cookie choices |
| Google Analytics (only if enabled and only after you consent) | Aggregated, consented usage measurement |
| Professional advisers (legal, accounting, IT/security) | Advice and support, under duties of confidentiality |
| A regulator, court, law-enforcement body or other authority | Where we are legally required to disclose information, or to establish, exercise or defend a legal right |
Service providers that process personal information on our behalf act as operators and are bound by written agreements requiring them to keep the information confidential and secure (sections 20 and 21 of POPIA). We do not sell, rent or trade your personal information, and we do not use it for automated decision-making that produces legal effects for you (section 71 of POPIA). We do not disclose your information for someone else’s direct marketing.
Our licensed travel-insurance partner is not merely an operator: for the regulated advice, underwriting and claims activities it performs, it is a responsible party in its own right and applies its own privacy notice. We share with it only the information needed for those activities.
6. Transfers outside South Africa
Some of the providers above (for example Cloudflare, Google, and possibly the external mail-filter service used for our email) may process information on servers outside South Africa. Section 72 of POPIA prohibits such a transfer unless one of its grounds applies.
Where a transfer occurs, we rely on one or more of the following: your consent; the transfer being necessary to conclude or perform the contract with you; or a binding agreement or binding corporate rules requiring the recipient to provide a level of protection substantially similar to POPIA’s conditions for lawful processing, including limits on onward transfer. Where a recipient is in a country that does not afford adequate protection, we will tell you and seek your consent before transferring. You may request details of the safeguards for a particular transfer by emailing us.
7. Cookies and similar technologies
Cookies and similar identifiers can be personal information under POPIA because the definition includes online identifiers. Our consent banner is provided by CookieYes and groups cookies as follows:
| Category | Purpose | Consent |
|---|---|---|
| Necessary | Security, form submission, remembering your consent choice and keeping the site working | Always active — strictly necessary, so consent is not required |
| Functional | Optional enhancements such as embedded content and preferences | Off until you accept |
| Analytics | Understanding how visitors use the site (for example Google Analytics) | Off until you accept |
| Performance | Measuring and improving site performance | Off until you accept |
| Advertisement | Advertising and remarketing | Off until you accept |
Only strictly necessary cookies are set before you choose. All other categories are denied by default and are enabled only after you select “Accept all” or choose them in “Manage preferences”. We also apply Google Consent Mode, so analytics tags do not fire until the corresponding consent is given. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer or the cookie button at the bottom-left of the page, and you can also block cookies in your browser settings. Blocking strictly necessary cookies may stop the application form from working.
8. Direct marketing
We do not send unsolicited electronic direct marketing. We will only contact you about products or offers where you have asked us to, where you have consented, or where the law permits and you have not objected. Any direct-marketing message we send will identify us and include a simple way to opt out (section 69 of POPIA). We keep a record of opt-out requests and honour them. To opt out, email [email protected].
9. How long we keep your information
Section 14 of POPIA requires us to keep records only for as long as is necessary to achieve the purpose for which they were collected, unless a law, a contract, or your consent permits or requires longer retention. Our approach is:
- General enquiries and correspondence: kept while we are dealing with your enquiry and for a short period afterwards (normally up to 24 months), then deleted.
- Travel-insurance applications and related records: kept for as long as needed to assess the application, arrange and administer the cover, deal with any claim, and meet the licensed travel-insurance partner’s record-keeping obligations under the Financial Advisory and Intermediary Services Act 37 of 2002 and insurance law, as well as other applicable law — typically up to five years after the end of the trip or policy, unless a longer period is legally required or you consent to it.
- Consent records: kept for as long as needed to demonstrate that consent was obtained and to honour your choices.
- Technical and security records: the rate-limit record of a hashed IP address is deleted after 20 seconds. Server and security logs are kept for a limited period for security and troubleshooting.
When a retention period ends, we delete, destroy or de-identify the information so that it can no longer be linked to you. We may retain information for longer where POPIA section 14(2) permits it for a legal obligation, a contract, historical, statistical or research purposes, or with your consent, and we apply appropriate safeguards in those cases. Backups are overwritten on a rolling cycle. You may ask us for the specific retention period that applies to your record.
10. How we protect your information, and what happens if something goes wrong
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access or disclosure (section 19 of POPIA). These include: HTTPS in transit; a private, access-controlled application record in the WordPress database; input validation and sanitisation; a REST nonce and server-side verification of every submission; rate limiting and Cloudflare Turnstile to block automated abuse; limited administrator access; and no non-essential tracking without consent.
If there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and, where their identity can be established, the affected data subjects as soon as reasonably possible, as required by section 22 of POPIA. The notice will describe the nature of the compromise and the steps you can take to protect yourself.
11. Your rights and how to exercise them
Under sections 5, 11, 23, 24 and 25 of POPIA you have the right to:
- be notified that we are collecting your personal information and why (section 18);
- ask whether we hold personal information about you, and to access that information (section 23, using the PAIA request process);
- ask us to correct, update or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
- ask us to destroy or delete a record we are no longer authorised to retain;
- object, on reasonable grounds relating to your particular situation, to processing based on consent, a legal obligation, a legitimate interest or a public-law duty (section 11(3));
- withdraw consent at any time — this does not affect the lawfulness of processing already carried out;
- not be subject to a decision made solely by automated means where that decision produces legal effects for you (section 71); and
- lodge a complaint with the Information Regulator.
To exercise any of these rights, email [email protected] with the subject line “POPIA request” and tell us what you need. We may ask for reasonable proof of identity before acting, to protect your information. We will respond within 30 days, or within the extended period allowed by PAIA where a request is complex, and we will tell you if an extension applies. Access to your own personal information is free; a prescribed fee may apply to copies of other records under PAIA. Requests for access to records are handled under the PAIA process using the prescribed form.
12. Complaints to the Information Regulator
If you believe we have processed your personal information in a way that infringes POPIA, please contact us first so we can try to resolve it. You also have the right to complain directly to the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Complaints: [email protected] (PAIA access complaints: [email protected])
- General enquiries: [email protected] · 010 023 5200 · toll-free 0800 017 160
- Complaints may also be lodged through the Regulator’s eServices portal at eservices.inforegulator.org.za
General information about POPIA is available at popia.co.za.
13. Access to information (PAIA)
In addition to POPIA, the Promotion of Access to Information Act 2 of 2000 gives you the right to request access to records held by a private body. Our PAIA manual, which sets out the categories of records we hold and how to request them, is available on request from [email protected] and will be published on this website. If a PAIA request is refused or not answered, you may lodge a complaint with the Information Regulator using PAIA Form 5.
14. Changes to this policy
We may update this policy when our practices, the services we use, or the law changes. We will post the revised policy on this page with a new “Last reviewed” date, and where a change materially affects how we use your information we will take reasonably practicable steps to bring it to your attention. We encourage you to check this page when you use the site.
15. Contact us
Questions about this policy, your personal information, or your rights under POPIA or PAIA can be sent to:
CL Legacy Solutions (Pty) Ltd
Email: [email protected]
Telephone / WhatsApp: +27 (0) 82 066 1655
Hours: Monday–Friday, 08:00–17:00
Service area: South Africa