Public Authority Data Request Policy

Last updated: 19 Oct 2026

Purpose and scope

NelCapeTown (Pty) Ltd, trading as Solution Adventurists ("the Company"), discloses personal information to public authorities only when the law requires it, and only after the review set out below.

This policy applies to every request from a government, regulator, law-enforcement or intelligence body for personal information the Company holds. That includes Platform Data received from Meta (for example through the WhatsApp Business Platform) and personal information held on behalf of clients.

It covers data on all Company systems, including the Company's local server in South Africa and its DigitalOcean droplet hosted in London, United Kingdom.

Responsibility

The Company's director, Cornelius Johannes Prinsloo, acts as Information Officer under the Protection of Personal Information Act, 2013 (POPIA) and handles all public authority requests.

• Any request received by anyone else working with the Company is passed to the Information Officer the same day, without any data being disclosed.
• No one may disclose personal information to a public authority without the Information Officer's written approval.

Legality review

Every request is reviewed for legality before any response is given. The Information Officer checks:

1. Identity and authority — the request genuinely comes from the stated authority, verified through an official channel, not just the contact details in the request.
2. Legal basis — the request cites a specific law, warrant, subpoena or court order that applies to the Company and to the data requested.
3. Jurisdiction — the authority has power over the Company or the data. Foreign requests are handled through South African legal channels (for example mutual legal assistance) unless South African law says otherwise.
4. Scope — what is asked for matches what the legal basis allows.

Where the answer to any check is unclear, the Company obtains legal advice before responding.

Challenging unlawful or overbroad requests

The Company refuses or challenges any request that fails the legality review or asks for more than the law allows.

• The Company first asks the authority, in writing, to clarify or narrow the request.
• If the request remains unlawful or overbroad, the Company declines in writing and states its reasons.
• Where appropriate, the Company uses available legal remedies, such as applying to court to set aside or limit the request.
• Requests for bulk or indiscriminate access to personal information are always refused unless a court orders otherwise.

Data minimisation

When disclosure is legally required, the Company discloses only the minimum personal information needed to comply.

• Only the records, fields and date range the legal basis covers are disclosed.
• Information about people not named in the request is removed or redacted where possible.
• Data is sent through a secure channel, encrypted where practical, and never by unprotected email or messaging.

Documentation and request log

Every request is recorded in the Company's request log, whether it is complied with, narrowed or refused. Records are kept for at least five years.

The log has no entries as at the date of this policy.

Notification, review and version history

• Notifying affected parties: unless the law prohibits it, the Company tells the affected client, or Meta where Platform Data is involved, about a request before disclosing anything.
• Review: this policy is reviewed every 12 months, and whenever the law or the Company's data hosting changes.