Collect less. Control access. Explain the purpose.

1. Responsible party

Citadel Capital (Pty) Ltd, registration number 2016/144870/07, is the responsible party where it determines the purpose and means of processing personal information. Citadel Capital Partners is its working public brand. The registered office is No 52 Stone Terrace, Rhino Estate, Monavoni, Centurion, Gauteng, 0149.

Privacy requests may be sent to info@citadelcapitalpartners.co.za marked for the attention of the Information Officer, or delivered in writing to the registered office. Section 5 describes how that mailbox is handled.

2. Current website processing

The public pages use no lead-capture form, user account, document upload, advertising tracker or website analytics service. The website is served from a shared web-hosting account held by Black Heath Advisory Inc., the operator named in section 9, with a South African hosting provider; that hosting, and the server logs it produces, fall within the written operator agreement described in section 9. As any web server does, that server records standard access and error logs for each request: the requesting IP address, the page or file requested, the time, the response given and the browser's self-description. Those logs exist to deliver the website, diagnose faults and protect the server against abuse. Citadel does not use them to identify or profile visitors, does not combine them with any other information, and does not extract or keep copies; they are retained by the hosting provider under its own log rotation. That is the only processing that reading this website involves.

3. Engagement information

The Engagement Planner uses only the options selected on the visitor's device to create a discussion brief. It does not request names, contact details or free-text project information and does not intentionally transmit or retain the brief. Direct information shared later through an approved relationship channel will be governed by the purpose, notice, confidentiality and legal basis applicable to that engagement.

The website itself operates no enquiry form or upload facility. A visitor who simply reads it gives Citadel nothing beyond the hosting logs described in section 2. The site invites a visitor to identify themselves in two ways only: by telephoning the number in section 4 or by writing to the role mailbox in section 5.

4. Telephone enquiries

Citadel publishes a telephone number so that a prospective investor, sponsor or adviser has a real route to a conversation. Calling it, or writing to the mailbox described in section 5, are the only ways this website invites a visitor to identify themselves.

Responsible party. Citadel Capital (Pty) Ltd, registration number 2016/144870/07, of No 52 Stone Terrace, Rhino Estate, Monavoni, Centurion, Gauteng, 0149, determines the purpose and means of processing information you give on that call.

What is recorded. Only what is necessary to route and answer the enquiry: the caller's name, the organisation represented, a return contact detail, and a short note of the subject. Calls are not recorded. No profile is built and no automated decision is taken about a caller.

Why. To respond to the enquiry and to establish whether an engagement is appropriate. The lawful basis is Citadel's legitimate interest under section 11(1)(f) of POPIA in responding to a business enquiry that the caller has initiated. There is no marketing list, so there is no marketing consent to give or withhold.

Who handles it. Citadel administration answers the line, which is a shared business line rather than a dedicated Citadel switchboard. Where an enquiry note is handled by administrative personnel outside Citadel Capital (Pty) Ltd, that arrangement is governed by a written operator agreement under section 21 of POPIA. Nothing from a call is shared for marketing, sold or rented.

Where it is held. Enquiry notes are held on Citadel's own business systems in South Africa. This website itself transmits nothing to a third party: it loads no analytics, no advertising tracker, no externally hosted typeface and no third-party script, so no cross-border transfer arises from reading these pages. The hosting logs in section 2 stay with the South African hosting provider.

How long. An enquiry note is kept for 24 months from the last contact, then deleted, unless a mandate, statutory duty or dispute requires it to be retained for longer.

What not to say on the call. The line is not a secure channel. Do not give identity numbers, banking details, account numbers, passwords or confidential project information over it. Detailed material should move to an approved relationship channel and, where appropriate, under a non-disclosure agreement.

Your rights. Under POPIA you may request access to, or correction or deletion of, information Citadel holds about you, and you may object to its processing. Contact the Information Officer using the telephone number on the engagement page. You may also complain to the Information Regulator (South Africa).

5. Email enquiries

Citadel publishes one role mailbox, info@citadelcapitalpartners.co.za. It is a shared mailbox monitored by a role rather than by a named individual, so that it survives leave and departure.

What is collected. Whatever you choose to put in your message: your name, your email address, your organisation, and the content of the enquiry itself. Citadel does not require any of it. An enquiry that gives only what is needed to answer it is a complete enquiry.

Why. To respond to your enquiry, and to establish whether an engagement is worth both parties pursuing. That is processing under section 11(1)(f) of POPIA, being Citadel's legitimate interest in answering people who approach it, and under section 11(1)(b) where a message is a step towards a contract.

What not to send. Do not send identity numbers, banking details, account numbers, passwords, medical information or confidential project material by email. Email is not a secure channel and Citadel does not treat it as one. Detailed material should move to an approved relationship channel and, where appropriate, under a non-disclosure agreement.

Who processes it. The mailbox is hosted in a Microsoft 365 environment operated on Citadel's behalf by Black Heath Advisory Inc., registration number 2013/084518/21, a related practice of the same principal, as an operator under section 21 of POPIA and under a written operator agreement. Named administrators of that environment can technically access the mailbox; the agreement limits that access to delivering the service or responding to a security incident, requires it to be logged, and prohibits its use for any Black Heath purpose. This is an interim arrangement adopted on cost grounds and is under review by 4 September 2027.

Where it is stored. On Microsoft infrastructure outside South Africa, operated by Microsoft Ireland Operations Limited. That is a cross-border transfer under section 72 of POPIA. It is permitted because Microsoft is bound by its Data Protection Addendum, incorporating the European Union Standard Contractual Clauses, which provides protection substantially similar to the Act.

How long it is kept. An enquiry that does not become an engagement is deleted within 12 months. An enquiry that becomes an engagement is retained under that engagement's own retention rule, set by the professional and statutory obligations applying to the work.

Your rights. Section 12 of this notice sets out how to ask what Citadel holds about you, to have it corrected, or to have it deleted. Those rights apply to anything you send to this mailbox.

6. Automated assistant

The Citadel Assistant provides automated answers from controlled public website information. It uses browser-based topic matching and is not an external generative-AI service. Conversation text is not intentionally transmitted to or retained by Citadel. The assistant attempts to reject apparent contact, account, identity or confidential information before adding it to the visible conversation.

Visitors must not enter identity numbers, contact details, bank details, personal financial records, health information, confidential project data, privileged information or documents. The assistant does not profile, qualify or score a visitor and does not make a decision producing legal or similarly significant effects.

7. Purposes and lawful processing

Where personal information is processed, Citadel will identify a defined lawful purpose such as responding to an authorised enquiry, administering a relationship, conducting due diligence, meeting legal or regulatory obligations, securing its systems, establishing or performing a contract, or pursuing a legitimate interest that does not unjustifiably prejudice a data subject. Consent will be used only where it is the appropriate basis and can be withdrawn.

8. Information categories and sources

Depending on the relationship, information may include identity and contact details, organisation and role, beneficial ownership, professional history, correspondence, contractual and transaction records, due-diligence information, financial and regulatory records, declarations, system metadata and any other information lawfully required for the stated purpose. Information may come from the person, their authorised organisation, public registers, professional advisers, counterparties or lawful screening sources.

9. Sharing, operators and cross-border processing

Citadel engages one operator. Black Heath Advisory Inc., registration number 2013/084518/21, operates the Microsoft 365 mail environment for citadelcapitalpartners.co.za and holds the shared web-hosting account from which this website is served, both under one written agreement concluded in terms of section 21 of POPIA. Microsoft Ireland Operations Limited is engaged as a sub-operator for the mail platform itself, so mail is processed outside South Africa under section 72. The South African hosting provider is a sub-operator for the web server and its logs, and that processing stays in South Africa. The public pages of this website engage no other operator: they use no analytics, no external typeface, no advertising tracker and no third-party script, and the automated assistant runs entirely in your browser.

Beyond that, information may be made available only as necessary to approved professional advisers, regulators, public authorities, investors, project participants or service providers under an appropriate legal basis and safeguards. Citadel does not sell personal information. Any data room, external AI provider or change of hosting must undergo operator, location, security, retention and cross-border assessment before activation.

10. Retention and deletion

Personal information is retained only for the purpose, legal recordkeeping requirement, regulatory obligation, contract, audit or defence of a claim. Each channel on this site has its retention rule stated in its own section: hosting logs in section 2, telephone enquiry notes in section 4 and email enquiries in section 5. The assistant conversation exists only in the browser session. The saved assistant acknowledgement remains on the device until withdrawn or browser storage is cleared; where a browser refuses to store it, the assistant still works and simply asks for the acknowledgement again next time.

11. Security and incidents

Citadel applies safeguards proportionate to the information and risk, including data minimisation, access restriction and separation of public information from controlled diligence. The website is served with a content security policy and transport security headers, administrator access to the mail environment is limited and logged under the operator agreement, and the hosting account is held under the operator's own access controls. Suspected vulnerabilities in the website may be reported through the route published at /.well-known/security.txt. No internet service can be represented as absolutely secure.

12. Data-subject rights

Subject to applicable law, a data subject may request confirmation, access or correction; object to processing; request deletion where legally available; withdraw consent; or complain to the Information Regulator. Reasonable identity and authority verification may be required before a request is acted on.

Information Regulator (opens in a new tab)Official access and complaint forms (opens in a new tab)

13. Children

The website is directed to professional and institutional audiences and is not intended to collect personal information from children. Such information should not be submitted through the website.

14. Changes

This notice will be updated whenever processing, operators, hosting, AI functionality, contact routes or legal requirements materially change. The effective date identifies the current version.