We are Stellenbosch University (the University). We are a tertiary institution in terms of the Higher Education Act and our physical address is Admin Block B, Victoria Street, Stellenbosch. The Policy Innovation Lab in our School of Data Science and Computational Thinking is conducting this survey for research purposes in the context of helping government identify the policies and regulations impeding investment in South Africa. Our privacy regulation can be found here: https://sunrecords.sun.ac.za/controlled/C4%20Policies%20and%20Regulations/SU_Privacy%20Regulations%20202211.pdf

As part of the survey, we may collect personal information which could include:

• Sector of employment, type of municipality, size of business
• Your voluntary responses to AI-generated questions about your perceptions, experiences and views
• The week in which you had the conversation
• We store contact information for up to 24 hours after which it is removed from the dataset

In all cases your responses will be de-identified or anonymised as soon as practicable in accordance with our protocol.

We collect this information directly from you when you complete the online survey by engaging with our chatbot. You choose to participate voluntarily. You may discontinue the survey or conversation at any time. Once you submit your responses, it is no longer feasible to link responses back to you for deletion since we de-identify the data.

We assure you that no under-18s will be knowingly included in this survey.

We will anonymise the information collected from you and use only the anonymised information to analyse the perceptions of business owners and investors regarding policy and regulatory barriers to investment in South Africa.

The anonymised findings may be used for research, policy analysis, reporting, and research dissemination purposes. This may include publication in academic journals, reports, conference presentations, policy briefs, the Policy Innovation Lab website, and other publicly accessible platforms, as well as sharing anonymised or aggregated information with government, public entities, and other researchers.

No identifiable personal information will be used, shared, or published for these purposes, and no information that identifies, or could reasonably identify, an individual participant will appear in any publication, report, presentation, or other publicly accessible material.

We process your personal information in accordance with section 11 of the Protection of Personal Information Act 4 of 2013 (POPIA), on the basis of your consent and the legitimate interest of conducting research.

We will not sell your personal information or share your identifiable personal data for profit. We may use, share, and publish anonymised or aggregated information arising from this research for research dissemination purposes. This may include publication in academic journals, reports, conference presentations, policy briefs, the Policy Innovation Lab website, and other publicly accessible platforms. No information that identifies, or could reasonably identify, an individual participant will be published.

We take the security of your personal information seriously. We have implemented reasonable organisational, technical and physical safeguards appropriate to the sensitivity of the data. While no system can guarantee absolute security, we monitor our systems for vulnerabilities and take steps to mitigate risk.

In the event of a data breach that materially affects your personal information, we will inform you and any relevant oversight authority as required by law.

Under the Protection of Personal Information Act (POPIA) you have the following rights:

• The right to be informed about the personal information we hold about you and how we process that information.
• The right to access the personal information we hold about you.
• The right to request that we correct or delete your personal information where it is inaccurate, incomplete or no longer necessary for the purpose for which it was collected.
• The right to object to the processing of your personal information where applicable.
• The right to withdraw your consent at any time (subject to the limitation that once anonymised, your data may no longer be individually identified or retrievable).

If you wish to exercise any of these rights, please contact us. Contact details are provided below. We may require proof of your identity to protect your information. If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Information Regulator (complaints.IR@justice.gov.za, www.justice.gov.za/inforeg).

We will keep your responses in an identifiable form only for as long as is necessary to complete the survey. This aligns with WhatsApp’s data retention period. After anonymisation, we may retain aggregated or anonymised data indefinitely for research purposes. Any personal identifiers will be removed such that it is no longer possible to trace responses back to you.

If we share anonymised data or transmit data to collaborators inside or outside of South Africa, we will ensure appropriate safeguards are in place. Identifiable personal information will not be transferred outside South Africa without adequate legal safeguards and your explicit consent.

We may update this Privacy Notice when our practices change, or as required by law. We will post the updated version on our website https://policyinnovationlab.sun.ac.za/tool/citizen-generated-data/ and indicate the date of the most recent update.

If you have any questions about this Privacy Notice, our data practices, or you would like to lodge a complaint, please contact:

https://policyinnovationlab.sun.ac.za/contact/ or jameshaw@sun.ac.za

Thank you for reading this Privacy Notice and considering participation in our survey.