Privacy Policy
Last updated: September 2026
This policy explains what personal information Grey Matter Knowledge collects, why, on what legal basis, how long it is kept and how you can access, correct or delete it. It is written to satisfy two laws at once. The first is the Protection of Personal Information Act (POPIA), South Africa's data protection law. The second is the General Data Protection Regulation (GDPR), the European Union's data protection law, kept in United Kingdom law in the same form.
1. Who is responsible for your information
Grey Matter Consulting Ltd, trading as Grey Matter Knowledge, is the party responsible for the personal information described in this policy. Under POPIA this party is called the responsible party. Under the GDPR it is called the controller. The Information Officer, the person you contact about your information, is Francois du Plessis, reachable at francois@greymatterknowledge.com.
2. What is collected
| When | What |
|---|---|
| Completing the free assessment | Your fourteen section scores and your email address, once you choose to see your profile |
| Ticking the optional newsletter box | Nothing further. The same email address is used, with a separate consent record |
| Buying a product | The product purchased, the price paid and the date, held by Paddle as the seller of record. Grey Matter Knowledge never receives or stores your card number |
| Booking a consultation | The date and time you choose, passed to Cal.com to arrange the booking |
Your fourteen section scores, encoded in a profile code, carry no personal information on their own. The scores become personal information the moment an email address is attached to them, which happens for every respondent who chooses to see a profile.
3. Why it is collected and on what legal basis
The email address collected when you see your profile is processed because doing so is necessary to deliver the profile to you and to let you return to it later. POPIA describes this as processing necessary for the performance of an action requested by you (section 11(1)(b)). The GDPR describes the same thing as performance of a contract or steps taken at your request (Article 6(1)(b)). No separate consent is needed for this use, since it is what you asked for.
A second, separate use, sending you occasional communication about the toolbox and the corrective guide, or the optional newsletter of essays, is processed only with your consent, given by ticking the relevant box. Each box defaults to unticked. You may withdraw either consent at any time by using the unsubscribe link in any email or by writing to the Information Officer.
The record of a purchase is processed under the contract of sale. Its retention afterwards is required by tax law.
4. Who else sees it
Paddle.com Market Limited processes your payment as the seller of record and holds your card details. Grey Matter Knowledge never receives them. Resend delivers the emails this site sends. Cal.com arranges consultation bookings. Supabase, a database provider, stores the profile and consent records described above. None of these providers is given your information for their own marketing purposes. No part of your information is sold to anyone.
5. How long it is kept
A profile with an email address and no purchase attached to it is deleted after twenty-four months of inactivity, or sooner if you ask. A purchase record, including the profile it relates to, is kept for five years, the period South African and international tax law requires records of this kind to be kept.
6. Your rights
At any time and free of charge, you may ask to see what personal information is held about you, to have an inaccuracy corrected, to have your information deleted (subject to the tax retention period above for a purchase record) or to withdraw a consent you previously gave. Send the request to the Information Officer's address above. If a request under this policy is not handled properly, a South African resident may complain to the Information Regulator, while a resident of the European Union or the United Kingdom may complain to their own national data protection authority.
7. Children
The free assessment has a separate student edition intended for school and university use. A respondent under eighteen is asked for a parent's or guardian's email address rather than their own, consistent with the position POPIA takes on the personal information of children.
8. Security
Information is stored with providers that encrypt data in transit and at rest. No card data is ever held by Grey Matter Knowledge, since Paddle collects and stores it directly.
9. Changes to this policy
If this policy changes in a way that affects how your information is used, the date at the top of this page is updated and, where the change is material, respondents with an email address on file are told by email.
This policy has not yet had a formal legal review. A review by a qualified adviser, covering the wording above, the consent design and the two lawful bases described in section 3, is planned before this page is treated as final.