Privacy Policy

Fulfil Consulting (Pty) Ltd & Thrive Now (Pty) Ltd – Supreme Good

Effective Date: 01 April 2026

Last Updated: 02 April, 2026

1. Introduction

1.1. Fulfil Consulting (Pty) Ltd (registration number 2016/043073/07) and Thrive Now (Pty) Ltd (registration number 2023/743471/07) are private companies registered in the Republic of South Africa (collectively, the “Companies”).

1.2. For the purposes of this Privacy Policy, the Companies act jointly as responsible parties (as contemplated in the Protection of Personal Information Act 4 of 2013 (“POPIA”)) in determining the purposes and means of processing Personal Information. References in this Privacy Policy to “we”, “us” or “our” refer collectively to the Companies.

1.3. We are committed to protecting the privacy and Personal Information of all individuals and organisations with whom we interact.

1.4. We provide leadership courses and related services to individuals and organisations, delivered through in‑person engagements and facilitated through our learning management system application, “Supreme Good” (the “Platform”). In the course of providing these Services, we interact with individuals and organisations and process Personal Information where necessary to deliver the Services. We recognise the sensitivity of such information and take our data‑protection obligations seriously.

1.5. This Privacy Policy explains how we collect, use, store, disclose, and protect Personal Information in compliance with applicable data protection laws, including the Protection of Personal Information Act 4 of 2013 (“POPIA”).

1.6. By accessing or using the Platform and Services, or by providing us with Personal Information, you acknowledge that we may lawfully process such information in accordance with the terms of this Privacy Policy.

2. Contact Details

2.1. We have appointed an Information Officer who is responsible for overseeing compliance with this Privacy Policy and applicable data protection laws. You may contact them regarding any questions, requests, or complaints as follows:

Information Officer: Bradford Wills
Email: bradford@supremegood.org

3. Privacy Policy Application

3.1. This Privacy Policy applies to all Personal Information processed by us in the course of providing our Services, including through the Platform, our website, in-person engagements, and related interactions (collectively, the “Services”).

3.2. Specifically, this Privacy Policy applies to all individuals (“data subjects”) whose Personal Information is processed by the Companies, including individuals in foreign jurisdictions, in connection with the use of the Platform and Services, including but not limited to:

users granted access to the learning management system;
employees, contractors, and representatives of client organisations who are granted authorised access to the Platform;
administrators, managers, or other authorised personnel responsible for managing or overseeing access to the Platform;
individuals who communicate with us via the Platform, website, or electronic correspondence; and
website visitors whose Personal Information is collected through cookies or similar technologies.

3.3. This Privacy Policy does not apply to third‑party services or platforms that operate independently of the Companies, even if accessed via links on the Platform.

3.4. We provide our Services to individuals and organisations in multiple jurisdictions. By accessing or using the Services from outside South Africa, you acknowledge that your Personal Information may be transferred to and processed in South Africa.

3.5. Where applicable, we will process Personal Information in accordance with applicable data protection laws and will take reasonable steps to ensure that appropriate safeguards are in place for cross-border processing.

4. Personal Information

4.1. Under POPIA, “Personal Information” means any information relating to an identified or identifiable, living, natural person or, where applicable, an existing juristic person. We process Personal Information in accordance with applicable laws, including where necessary to perform a contract, comply with legal obligations, or pursue legitimate interests.

4.2. Our Services require limited Personal Information from you, in order for us to provide operational functionality, which may include:

Identity and Contact Information:

Full name, date of birth, age, and identity or passport number;
Physical address, postal address, email address, and telephone numbers;

Financial Information:

Banking details for payment of any fees.

Technical and Usage Information:

Login credentials (passwords are encrypted and not visible to staff);
Internet Protocol (IP) address, browser type and version, and device identifiers;
Pages visited and interactions with our website; and
Cookies and similar tracking technologies.

Learning and Usage Information:

Course participation;
Notes created by students;
Quiz attempts and quiz results;

5. How We Collect Your Personal Information

5.1. We collect information, including Personal Information, from you in a variety of ways:

Directly From You When You:

access or use our Services;
register or interact with our Platform;
participate in learning activities;
communicate with us by telephone, email, in person, or via our website; or
use any of the tools, applications, data, or any services provided by us.

Through Automated or Passive Means

When you visit our website or make use of our Services or Platform, we may passively collect Technical and Usage Information using 4 cookies, server logs, and similar technologies. See Section 12 (Cookies) for further details.

6. Legal Basis For Processing Your Personal Information

6.1. We will only process your Personal Information where we have a lawful basis for doing so under the applicable data protection law. The table below summarises the lawful grounds we may rely upon:

Lawful Ground	POPIA (South Africa) – Condition
Consent	Section 11(1)(a) POPIA – voluntary, specific, informed consent
Contract	Section 11(1)(b) POPIA – necessary to conclude or perform a contract
Legal Obligation	Section 11(1)(c) POPIA – obligation imposed by law
Legitimate Interest	Section 11(1)(f) POPIA – legitimate interest not overridden by data subject’s interests
Vital Interests	Section 11(1)(d) POPIA – protection of life or health
Public Task / Public Interest	Section 11(1)(e) POPIA – performance of a public law duty

7. Reasons for Collecting Your Personal Information

7.1. We collect and process your Personal Information for the following legitimate purposes:

Delivering Our Services:

create, manage, and administer user accounts on the Platform;
authenticate users and provide secure access to the Services;
deliver educational content, courses, assessments, and learning materials;

Communication and Relationship Management:

communicate with you regarding your use of the Platform and Services;
respond to enquiries, requests, or support issues;
provide service‑related notices, updates, and administrative communications;
manage our ongoing relationship with you as a user, learner, or authorised representative.

Organisational Management:

administer and manage users, roles, and permissions on the Platform;
enable authorised managers or administrators to oversee learning progress where applicable;
analyse de‑identified and aggregated information to improve the design, functionality, and performance of the Platform;
conduct internal reporting, auditing, and business planning activities.

Safety, Security, and Legal Compliance:

protect the security, integrity, and availability of the Platform and Services;
detect, prevent, and respond to fraud, misuse, unauthorised access, or security incidents;
maintain backups, disaster recovery, and system reliability;
comply with applicable laws, regulations, and regulatory guidance; and
exercise or defend legal rights, or comply with lawful requests from authorities.

Direct Marketing (with your consent):

provide you with information about products, services, updates, or offerings that may be relevant to you; and
communicate promotional or informational content relating to the Companies.

7.2. We will not use your Personal Information for purposes incompatible with those stated above without providing you with prior notice and, where required, obtaining your consent.

7.3. We may collect certain non-personal information automatically when you interact with our Services. This may include your browser type, device type, operating system, Internet service provider, and other technical information relating to your use of the Services.

8. Sharing of Your Personal Information

8.1. We do not sell your Personal Information. However, we may share it in the following limited circumstances:

We share Personal Information with trusted third-party service providers who process it on our behalf for purposes including:
- IT systems, website hosting, and cybersecurity;
- Payment processing and banking;
- Email, cloud storage, and communications platforms;
- Record storage and archiving;
- Any other service providers necessary for the provision of the Services or Platform functionality.
We may disclose Personal Information to courts, regulatory bodies, or law enforcement authorities where required by law.
Where Personal Information is provided to us by an organisation (such as your employer), that organisation is responsible for ensuring that it has the necessary authority and legal basis to share such Personal Information with us.

9. Protection of Your Personal Information

9.1. We implement appropriate and proportionate technical and organisational measures to protect your Personal Information against unauthorised access, loss, misuse, alteration, or destruction. Our measures include, inter alia:

physical, technical, and network security;
multifactor authentication (“MFA”), access controls and role‑based permissions;
secure storage, destruction and encryption of records of Personal Information;
backups and disaster recovery mechanisms;
Personal Information breach reporting and remediation; and
confidentiality obligations imposed on third‑party processors.

9.2. Upon registration, you will be provided with a username and a temporary password. When you first access the Platform, you will be required to set a permanent password. You are responsible for updating your password and for maintaining the confidentiality of your login credentials at all times.

10. Retention and Removal of Personal Information

10.1. We will retain your Personal Information only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law.

10.2. If your Services account remains inactive (no access, no use) for longer than 6 (six) months, whether you decide to stop using our Services or you simply no longer use our Services or for any other reasons, we will be entitled to remove your Personal Information from our Services if you have not already done so.

11. Cross-Border Data Transfer

11.1. We operate in multiple jurisdictions and may process Personal Information in South Africa, the European Union (including data centres in Frankfurt, Germany and Stockholm, Sweden), and other countries where our service providers, affiliates, or infrastructure are located. Hosting locations may change from time to time based on operational requirements.

11.2. Personal Information may be transferred to and processed in South Africa or other jurisdictions from which you access our Services. Transfers may also occur from South Africa to third-party service providers or affiliates located in other countries, including the United States, European Union member states, and the Asia-Pacific region, where necessary to provide the Services.

11.3. These transfers may occur for purposes including, but not limited to, delivering educational programmes, enabling platform functionality, supporting international clients and users, and maintaining system administration, technical support and disaster recovery.

11.4. Where Personal Information is transferred outside of South Africa, we will take reasonable steps to ensure that such transfer is carried out in accordance with applicable data protection laws, including by ensuring that:

the recipient is subject to laws, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to that provided under POPIA; or
the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken at your request; or
you have consented to the transfer, where required.

11.5. By using the Services, you acknowledge that your Personal Information may be transferred across borders and processed in accordance with this clause. All such transfers will be subject to appropriate contractual, technical, and organisational safeguards to protect the confidentiality, integrity, and security of your Personal Information.

12. Cookies

12.1. We use cookies and similar technologies to enhance your experience when using our Services. Cookies are small data files stored on your browser or device that enable us to recognise you, remember your preferences, and improve the functionality of our Services.

12.2. We use cookies for the following purposes:

essential cookies, which are necessary for the operation of the Services and to enable core functionality such as authentication and security;
performance and analytics cookies, which help us understand how users interact with our Services and improve performance; and
functionality cookies, which allow us to personalise content and remember your preferences.

12.3. Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device.

12.4. You may manage or disable cookies through your browser or device settings. Please note that disabling certain cookies may affect the functionality of the Services.

13. Electronic Communications and Direct Marketing

13.1. We may use your contact details to send you administrative or service-related communications, including updates relating to the Services, responses to your enquiries, and important notices. These communications are necessary for the provision of the Services.

13.2. Where permitted by applicable law, we may send you electronic communications relating to our products or services that may be of interest to you.

13.3. We will only send you direct marketing communications where:

you have provided your consent; or
you are an existing customer and we are permitted to do so under applicable law, provided that you are given the opportunity to opt out at the time of data collection and with each subsequent communication.

13.4. You may opt out of receiving marketing communications at any time by following the unsubscribe instructions included in such communications.

13.5. We will not share your Personal Information with third parties for their own direct marketing purposes without your explicit consent.

14. Security Disclaimer

14.1. While we implement appropriate, reasonable technical and organisational measures to protect your Personal Information, no method of transmission over the Internet or method of electronic storage is completely secure.

14.2. Accordingly, while we take all reasonable steps to safeguard your Personal Information, we cannot guarantee the absolute security of any information transmitted to or from our Services, and you do so at your own risk.

15. Changes to Privacy Policy

We may, in our sole discretion, update this Privacy Policy at any time. When we do, we will revise the update date at the top of this Privacy Policy document and take reasonable steps to notify you of material changes (including by posting an update on our website). We encourage you to review this Policy periodically. Continued use of our Services or website after changes take effect constitutes your acceptance of the updated Policy.

16. Data Subject Rights

16.1. Subject to applicable law, you have the following rights in relation to your Personal Information:

Right of Access – You have the right to request access to the Personal Information we hold about you, including information relating to how it is processed.
Right to Correction – You have the right to request that inaccurate or incomplete Personal Information be corrected.
Right to Deletion – You may request that your Personal Information be deleted or de-identified, subject to applicable legal and operational requirements. Please note that this may affect your ability to access or use the Services.
Right to Object – You may object to the processing of your Personal Information in certain circumstances, as permitted by law.
Right to Restrict Processing – You may request that we limit the manner in which we process your Personal Information.
Right to Portability – Where applicable, you may request a copy of your Personal Information in a structured, commonly used, and machine-readable format.
Right to Complain – You have the right to lodge a complaint with the Information Regulator if you believe your Personal Information has been processed unlawfully.
Right to not be subject to Automated Decision-Making – This is your right to object to (and prevent) any decision that could have a legal or similarly significant effect on you from being made solely in accordance with an automated process. This right is limited, however, if the decision is necessary for performance of any contract between you and us, or is allowed by applicable law, or is based on your explicit consent.

16.2. Many of these rights can be exercised by signing in and directly updating your account information. In any event, you may exercise these rights by contacting us using the details set out in clause 2 above.

17. Children

17.1. Our Services are not directed at children. We do not knowingly accept online Personal Information from children under the age of 18.

17.2. If you are under the age of 18 or otherwise would be required to have parent or guardian’s consent to share Personal Information with us, you must ensure that you obtain the necessary parent or guardian’s consent before you share Personal Information with us. Alternatively, you must not send any information about yourself to us.

17.3. Supreme Good reserves the right to request you to provide proof of your age before receiving any requests for Services ordered via the Platform.

18. Complaint to Information Regulator

18.1. If you have any complaints about this Privacy Policy or our compliance with this Privacy Policy you can lodge a complaint with the Information Regulator.

18.2. The contact details of the Information Regulator are available on its website at: https://inforegulator.org.za/