Last updated: 18 September 2026
Chainscore (Pty) Ltd respects your information and collects as little of it as we can. This notice explains what we collect, why, who sees it, and what you can ask us to do about it. It is written to meet our obligations under the Protection of Personal Information Act, 2013 (POPIA).
Chainscore (Pty) Ltd, registration number 2026/615120/07, a company registered in South Africa, is the responsible party for the personal information described here.
Our Information Officer can be reached at admin@chainscore.co.za.
When you sign up for a free score, we collect your business name, your name, your email address, your phone number if you give it, your sector, and how you heard about us. We use this to contact you about your assessment and to send you your questionnaire link. Nothing else.
When you complete an assessment, we collect information about your business: registration and tax details, ownership and B-BBEE status, employment numbers, environmental and health and safety practices, governance arrangements, and any disclosures you make about litigation or politically exposed persons. We use this to calculate your ESG readiness score, produce your badge, and — where you have asked for one — prepare your Improvement Roadmap.
We verify some of what you tell us against public registers, including the Companies and Intellectual Property Commission (CIPC) and the South African Revenue Service (SARS), and against publicly available news sources. We do this so that your score means something to a buyer, and we only check what you have told us.
We ask for aggregate ownership percentages, not the identity or personal details of individual shareholders. We do not collect identity numbers, banking details, or employee-level records. If you send us documents containing information we did not ask for, we will not use it and will ask you to resend without it.
Your score and your badge are yours. We do not publish them, sell them, or share them with buyers you have not told us about.
Where you were invited to complete an assessment by a specific corporate buyer, we share your score and assessment outcomes with that buyer — that is the purpose of the assessment, and you will know who they are before you begin.
We use service providers to operate the platform. These currently include Google (Workspace, Forms and Sheets) for collecting and storing assessment responses, and our hosting provider for the signup form and its database. These providers process information on our instructions and may store it on servers outside South Africa. Where that happens, we rely on their contractual data protection commitments as permitted under section 72 of POPIA.
We may disclose information where the law requires it.
We keep signup details for as long as you remain on our list, and for 12 months after your last interaction with us if you do not proceed.
We keep assessment data for [five years] from the date of assessment. Scores are designed to be compared year on year, and the change between cycles is part of what makes them useful — so keeping the history is the point rather than an oversight. If you ask us to delete your data before then, we will, and we will tell you what that means for any badge you hold.
Assessment responses are held in access-controlled Google Workspace accounts. Signup details are held in a password-protected database on our hosting account. Access is limited to people who need it to do the work. We will tell you without undue delay if there is a breach affecting your information, as POPIA requires.
You have the right to:
Email admin@chainscore.co.za and we will respond within a reasonable period. There is no charge for a correction or deletion request.
If you are not satisfied with how we have handled your information, you may complain to the Information Regulator of South Africa:
Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001complaints.IR@justice.gov.za · inforeg1@justice.gov.za
Completing our signup form or an assessment is voluntary, and we ask for your consent before collecting anything. You can withdraw it at any time by emailing us. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
If we change this notice materially, we will update the date above and, where the change affects how we use information you have already given us, tell you directly.