Privacy notice

Who this notice covers

This notice explains how Natroceutics collects and uses personal information
through its webinar registration platform, for practitioners and other
attendees registering in South Africa, the United Kingdom, Ireland and
elsewhere. Natroceutics is the responsible party for this processing under
South Africa's Protection of Personal Information Act (POPIA), and the data
controller under the UK and EU General Data Protection Regulation (GDPR) for
attendees in those regions.

What we collect

When you register: your name and title, email address, mobile number,
country, whether you are a practitioner, and — if you are a South African
practitioner — your professional council registration number, needed to
issue a CPD certificate in your name. If you attend, we record that you
attended and for how long, which determines whether you receive a
certificate. If you register for a paid South African event, PayFast
processes your payment directly; we never see or store your card details.

Why we collect it

To administer your registration, confirm your attendance, and issue your CPD
certificate — this is necessary to provide the event you registered for. If
you tick the separate marketing checkbox, we also use your name and email to
send you information about future Natroceutics webinars; this is based on
your consent alone; declining it does not affect your registration, and it
never affects whether you receive your certificate.

Who we share it with

We use a small number of service providers to run this platform, and share
only what each one needs to do its job:

• Vercel hosts the website and admin system.
• Neon holds the database, in Frankfurt, Germany — inside the EU.
• Resend sends registration confirmations and certificates by email.
• PayFast processes South African card payments directly; we do not
handle or store your card details.
• Mailchimp sends marketing communications, and only for people who
ticked the marketing checkbox at registration.
• Zoom (once connected) will host the webinar itself and may supply
attendance data.

None of these providers may use your information for their own purposes.

Where your information is stored

Our database is hosted in the European Union. For UK and Irish attendees,
this means your information does not leave the EU. For South African
attendees, it means your information is processed outside South Africa,
which POPIA permits provided the recipient is subject to comparable
safeguards — as our EU hosting is.

How long we keep it

Registration, attendance and certificate records are kept for five years,
to remain available if a CPD certificate is ever queried by an accrediting
body. *(Five years is a working assumption pending confirmation with our
accrediting bodies — see the Setup screen.)* If you asked to receive
marketing and later unsubscribe, we stop holding your details for that
purpose immediately; your registration and certificate records are
retained regardless, since they exist independently of marketing consent.

Your rights

You may ask us, at any time, to tell you what information we hold about
you, to correct it if it is wrong, or to delete it, subject to our need to
keep CPD records for the period above. You may withdraw marketing consent
at any time without affecting anything else. To make any of these requests,
contact us using the details below.

If you believe we have not handled your information properly, you may
complain to South Africa's Information Regulator (POPIA) or, for UK and
Irish attendees, to the ICO or the Data Protection Commission respectively.

Contact

For any question about this notice or your information, contact us at the
support address shown on our registration pages.

This notice was last reviewed on 2026-07-20.