Privacy Policy
Last updated 1 October 2026
1. Who we are
www.thesmdp.com is operated by Growth Matters South Africa (Pty) Ltd, registration number 2011/011131/07, VAT number 4910267519, Arch Collab, 3rd Floor, 34 Whitely, Melrose Arch, Birnam, 2196, South Africa ("GMSA", "we", "us"). GMSA delivers the Sales Management Development Program (SMDP) with Growth Matters International.
We are the responsible party for the personal information described here. Our Information Officer is Christo Jansen van Rensburg, reachable at ethics@growthmattersintl.com.
2. What we collect
| When | What we collect |
|---|---|
| You reserve a seat | First and last name, work email, company, job title, country, and whether you or your company is paying |
| You claim a referral price | The referring graduate's full name, email and mobile number |
| You claim a graduate price | Your graduation year, and your employer at graduation if you have changed employer |
| You arrive through a facilitator's link | Which facilitator's link you used, and the date |
| You arrive from an advert or campaign link | The campaign tags and ad-click identifier in the link |
| You accept analytics or advertising cookies | Pages viewed, device and browser type, approximate location from your IP address |
| You email or call us | What you tell us |
Information we add from other sources. When you reserve a seat, our customer relationship system (Membrain) uses FullContact to add publicly available business information to your record, such as your job title, your company's size and industry, and links to your professional profiles. We do this in our legitimate interest in keeping accurate records of the businesses we work with. You can object at any time (section 9), and we will remove the added information. We never enrich the details of a graduate who referred you: those are kept only in our reservation database and used for the single message described in section 4.
We do not collect card details. You pay by bank transfer.
3. Why we use it
- To process your reservation and enrolment: holding your seat, sending your pro-forma and tax invoices, confirming payment, onboarding you and running the program. The basis is our contract with you.
- To check a claimed price: matching graduate details against our records and confirming a referral with the graduate you name. The basis is our legitimate interest in applying prices correctly.
- To credit facilitators: recording which facilitator introduced you so they receive their commission. The basis is our legitimate interest.
- To measure and improve our marketing: understanding which channels and adverts lead to enrolments. The basis is your consent where cookies are involved, otherwise our legitimate interest.
- To meet legal obligations: tax, accounting and record-keeping requirements.
We will only send you marketing about other programs if you have agreed to it, and you can opt out at any time.
4. The graduate who referred you
If you claim a referral price, you give us the name, email and mobile number of the SMDP graduate who referred you. By doing so you confirm that they agreed to you sharing those details with us, and to us contacting them once to confirm the referral.
We contact the graduate once, within 2 business days, to confirm the referral. In that message we tell them what details we received, who gave them to us, why we hold them, and how to ask us to delete them. We use their details only to confirm the referral, and delete them 12 months after the program ends unless they are, or become, one of our customers.
5. Cookies and similar technology
We ask for your consent before setting any cookie that the site does not need in order to work. If you accept, we use:
- a first-party cookie that remembers which facilitator's link you used, for up to 90 days, so they are credited if you reserve on a later visit;
- PostHog analytics, to see how the site is used;
- Google Ads measurement, to see which adverts lead to reservations.
If you decline, the site works just the same. A facilitator whose link you used is still credited if you reserve during that same visit. You can change your choice at any time from the Cookie settings link in the footer.
6. Who we share it with
We share your information only with people who need it to deliver your enrolment:
- the facilitator of your class, and the facilitator whose link you used;
- Growth Matters International, which co-delivers the program;
- the graduate who referred you, only to confirm the referral;
- the service providers in section 7, who process it on our instructions;
- authorities, where the law requires it.
We do not sell personal information.
7. Service providers and transfers outside South Africa
| Provider | What it does | Where data is held | Transfer mechanism |
|---|---|---|---|
| Vercel | Hosts the website | United States and Vercel's global network | Vercel Data Processing Addendum, incorporating the EU Standard Contractual Clauses (2021) and the UK Addendum |
| Supabase | Stores reservations | Frankfurt, Germany | Supabase Data Processing Addendum, incorporating the EU Standard Contractual Clauses (2021) |
| Resend | Sends our emails | United States | Resend Data Processing Addendum, incorporating the EU and UK Standard Contractual Clauses |
| PostHog | Website analytics, with consent | Frankfurt, Germany (PostHog Cloud EU, an independent EU instance) | Held in the EU under GDPR; no transfer to the United States. Covered by your consent in 7.2. |
| Advertising measurement, with consent | United States | Google Ads Controller-Controller Data Protection Terms, incorporating the EU Standard Contractual Clauses (controller to controller) | |
| Membrain | Our customer relationship system | Sweden and the United States (Membrain's hosting provider, Nordic Server Central, operates in both) | Membrain Data Processing Agreement (Licence Appendix B), with sub-processors published at membrain.com/legal/subprocessors. Covered by your consent in 7.2. |
| FullContact | Adds publicly available business details to buyer records in Membrain | United States | A sub-processor under Membrain's Data Processing Agreement. Covered by your consent in 7.2. |
| Microsoft 365 | Our email, files and staff sign-in | South Africa. Exchange Online, SharePoint, OneDrive and Teams are committed to South Africa; email filtering currently runs in South Africa without a commitment. | Not needed while held in South Africa. Any processing elsewhere is covered by your consent in 7.2. |
7.1 Where your reservation is kept. Your reservation is stored in the European Union, in Supabase's data centre in Frankfurt, Germany. The website's server code that handles it is set to run in Frankfurt too. Both are subject to GDPR. Some processing still happens outside the European Union, as the table above shows. Vercel's global network and support operations are based in the United States, and our emails, analytics and advertising measurement use the other providers listed.
7.2 Buyers: your consent. When you reserve a seat, we ask for your explicit consent to your personal information being processed outside South Africa by the providers above. We rely on that consent under section 72(1)(b) of POPIA. Google Ads measurement is covered the same way: it loads only once you accept advertising cookies. Reserving is entirely your choice, so this consent is freely given. You can withdraw it by cancelling your reservation.
7.3 Transactional email. We send reservation confirmations, pro-forma invoices, reminders and payment confirmations through Resend (Plus Five Five, Inc.) in the United States. These transfers are necessary to perform our contract with you, and for them we rely on section 72(1)(c) of POPIA. We do not send marketing email on this basis.
7.4 Referring graduates and your finance team. If you claim a referral price, you confirm that the graduate agreed to you sharing their details and to us contacting them once to confirm the referral. We keep their details in our Frankfurt database and use them for that one message only. We never email anyone who has not opted in to hear from us. We do not collect your finance team's details: your pro-forma invoice comes to you, to forward internally if your company is paying.
Separately, every provider holds, or conforms to, ISO/IEC 27001. That is how they meet the security requirements of POPIA section 19 and GDPR Article 32.
8. How long we keep it
- Reservations that are never paid: deleted 12 months after the hold expires.
- Enrolment and invoice records: kept for 5 years after the program ends, as tax law requires.
- Analytics data: kept for no longer than 24 months.
9. Your rights
You may ask us to confirm what information we hold about you, correct it, delete it, or stop using it for marketing. You may object to processing based on our legitimate interests. Email our Information Officer at ethics@growthmattersintl.com; we reply within 30 days.
If you are unhappy with our response, you may complain to South Africa's Information Regulator (inforegulator.org.za). If you live in the EU or UK, you may also complain to your local data protection authority.
If you live outside South Africa, the law where you live may give you further rights, and we honour them:
- European Union and United Kingdom. GDPR and UK GDPR apply. Our legal bases are listed in section 3. You may also ask us to restrict processing or to give you your information in a portable format, and you may withdraw consent at any time.
- Australia. We handle your information in line with the Australian Privacy Principles. You may complain to the Office of the Australian Information Commissioner.
- Singapore and the rest of Asia Pacific. We handle your information in line with Singapore's Personal Data Protection Act and the equivalent law where you live. You may withdraw consent, and complain to the Personal Data Protection Commission or your local regulator.
- United States. We do not sell personal information. Advertising cookies load only with your consent, which you can withdraw at any time. If your state gives you rights to know, correct or delete your information, or to opt out of targeted advertising, you can use them by emailing us. We will not treat you differently for doing so.
10. Security
Access to reservation data is limited to named GMSA and Growth Matters International staff who sign in with their company Microsoft accounts. Data is encrypted in transit and at rest.
11. Changes
We will post any change to this policy on this page and update the date at the top.