Privacy notice
How USP&E collects, uses and protects your personal information
| Version | Effective Date | Owner | Status |
| 1.0 | 9 July 2026 | Legal & Compliance | Published |
USP&E Holdings (Pty) Ltd (“USP&E”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Notice explains how we collect, use, share, store and protect personal information when you visit our website at uspeglobal.com (the “Website”), interact with us, or engage with our business.
We comply with applicable data protection laws, including the Protection of Personal Information Act 4 of 2013 (“POPIA”) in South Africa, the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the UK GDPR where applicable, and other relevant data protection legislation.
1. Who We Are and How to Contact Us
We are USP&E Holdings (Pty) Ltd, a private company incorporated under the laws of the Republic of South Africa with registration number 2015/345822/07, registered office at 22 Kildoon Rd, 1st Floor, Bryanston, Johannesburg, 2191, South Africa.
Information Officer (POPIA) and Data Protection Contact:
- Name: James Mckee
- Title: IT Officer
- Email: [email protected]
- Telephone: +27108222324
2. What We Mean by Personal Information
“Personal information” (also known as “personal data”) means any information relating to an identified or identifiable natural person, and in South Africa under POPIA also includes information relating to an identifiable, existing juristic person (such as a company).
3. Personal Information We Collect
We collect personal information in the following ways:
3.1 Information you provide directly
When you interact with us through the Website or otherwise, you may provide:
- Identity information: full name, job title, company name, country of operation
- Contact information: business email address, business telephone number, business address
- Enquiry content: details of the equipment, services or information you are enquiring about, your project requirements, indicative budgets and timelines
- Verification information: where required for export control screening, anti-money-laundering or know-your-customer purposes (such as identity documents, beneficial ownership information, jurisdictions of operation, and end-use information)
- Communications: any correspondence you send to us by email, contact form, WhatsApp, telephone, or other channels
3.2 Information we collect automatically
When you visit the Website, we automatically collect:
- Technical information: IP address, browser type and version, operating system, device identifier, screen resolution, time zone setting
- Usage information: pages viewed, time spent on each page, navigation paths through the Website, referring URLs, search terms used to find the Website
- Cookie and similar technology information: as described in our Cookie Policy
3.3 Information from third parties
We may receive information about you from:
- Sanctions and compliance screening providers (for export control and OFAC/sanctions screening)
- Credit reference agencies and trade reference providers (for commercial credit assessment)
- Publicly available sources (including company registries, professional networks, and government databases)
- Marketing and lead-generation platforms (such as Google Ads, LinkedIn, industry directories)
- Referrals from existing customers or business partners
4. How We Use Your Personal Information
We process personal information for the following purposes and on the following legal grounds:
4.1 To respond to enquiries and provide quotations
We use your information to respond to your enquiries about equipment and services, prepare quotations, and engage in pre-contractual discussions.
Legal basis: performance of, or steps prior to entering into, a contract (POPIA s11(1)(b), GDPR Article 6(1)(b)).
4.2 To perform contracts and supply goods and services
Where you become a customer, we process your information to perform our contractual obligations, including processing orders, arranging logistics, invoicing, and post-sale support.
Legal basis: performance of a contract (POPIA s11(1)(b), GDPR Article 6(1)(b)).
4.3 To comply with legal and regulatory obligations
We process information to comply with applicable laws, including export control laws, sanctions regimes (such as those administered by OFAC, BIS, EU, UK and UN authorities), anti-corruption laws (such as the FCPA and UK Bribery Act), anti-money-laundering laws, tax laws, and accounting and record-keeping obligations.
Legal basis: compliance with a legal obligation (POPIA s11(1)(c), GDPR Article 6(1)(c)).
4.4 For our legitimate business interests
We process information for our legitimate interests, including: improving the Website, developing our products and services, conducting market analysis, protecting our IT systems and the security of personal information, defending and pursuing legal claims, conducting due diligence on counterparties, and conducting business analytics and reporting.
Legal basis: legitimate interests (POPIA s11(1)(f), GDPR Article 6(1)(f)). Where we rely on legitimate interests, we have considered and balanced any potential impact on you and your rights.
4.5 For marketing communications
Where lawful, we send marketing communications about our products, services, industry insights, equipment availability, and events. You can opt out at any time using the unsubscribe link in our emails or by contacting our Information Officer.
Legal basis: consent (where required) or legitimate interests (POPIA s11(1)(a) or (f); GDPR Article 6(1)(a) or (f)).
4.6 With your consent
Where we rely on consent (for example, for certain cookies or optional marketing), you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
5. Cookies and Tracking Technologies
We use cookies and similar technologies on the Website. Detailed information about how we use these technologies, the categories of cookies, and how you can manage your preferences, is set out in our Cookie Policy.
6. How We Share Your Personal Information
We may share your personal information with:
6.1 Within the USP&E group
With our affiliates, subsidiaries and group companies for the purposes set out in this Privacy Notice.
6.2 Service providers and processors
With third-party service providers who process personal information on our behalf and on our instructions, including:
- Website hosting, cloud storage and IT infrastructure providers
- Customer relationship management (CRM) and email marketing platforms
- Analytics providers (such as Google Analytics)
- Advertising and marketing platforms (such as Google Ads, LinkedIn)
- Payment processors (where applicable)
- Logistics and freight forwarding providers
- Compliance screening providers (sanctions, KYC, AML)
- Professional advisors (lawyers, accountants, auditors, insurers)
All processors are bound by written contracts requiring appropriate safeguards.
6.3 Business partners and counterparties
With manufacturers, suppliers, equipment owners and other counterparties to the extent necessary to fulfil your enquiry or contract.
6.4 Regulatory authorities and law enforcement
Where required by law, court order, regulator request, or where necessary to enforce our rights or protect our interests, employees, customers, or the public.
6.5 Corporate transactions
With prospective buyers, investors, lenders or advisors in connection with any actual or proposed sale, merger, reorganisation, financing, or similar corporate transaction.
7. International Transfers of Personal Information
USP&E operates globally. Your personal information may be transferred to, stored in, and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country.
Where we transfer personal information internationally:
- From South Africa: we rely on the lawful transfer mechanisms set out in section 72 of POPIA, including the data subject’s consent, where the transfer is necessary for the performance of a contract, or where the recipient is subject to a law or binding corporate rules providing adequate protection.
- From the European Economic Area or United Kingdom: we rely on adequacy decisions where available, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or other lawful transfer mechanisms.
Copies of safeguards in place are available on request from our Information Officer.
8. How Long We Keep Your Personal Information
We retain personal information only for as long as necessary for the purposes for which it was collected, or to comply with legal, accounting, tax, or reporting requirements. Indicative retention periods are:
- Enquiries that do not result in a contract: 24 months from last contact
- Customer records (where a contract is concluded): 7 years from the end of the contractual relationship, or longer if required by law (for example, by tax or export control record-keeping requirements)
- Marketing contact records: until you opt out, plus a reasonable period for suppression list management
- Sanctions screening records: as required by applicable export control and sanctions law (typically 5 to 10 years)
- Website analytics: as set out in our Cookie Policy
After the applicable retention period, we securely delete, destroy, or anonymise the personal information.
9. How We Protect Your Personal Information
We implement appropriate technical and organisational security measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. These measures include access controls, encryption in transit and (where appropriate) at rest, network security, staff training, vendor management, and incident response procedures.
Despite these measures, no electronic transmission or storage is fully secure. We cannot guarantee absolute security, and you provide personal information at your own risk.
10. Your Rights
Subject to applicable law and to the conditions and exceptions set out in that law, you have the following rights in relation to personal information we process about you:
- Right of access: to confirm whether we process personal information about you and to receive a copy of such information
- Right to correction or rectification: to request that we correct or update inaccurate or incomplete personal information
- Right to deletion or erasure: to request that we delete personal information in certain circumstances (sometimes known as the “right to be forgotten”)
- Right to restrict processing: to request that we limit our use of your personal information in certain circumstances
- Right to data portability: to receive personal information you provided to us in a structured, commonly used, machine-readable format, or to request that we transfer it to another controller (GDPR/UK GDPR only)
- Right to object: to object to processing based on our legitimate interests, or to object to direct marketing at any time
- Right to withdraw consent: where we rely on consent, you may withdraw it at any time
- Right not to be subject to automated decision-making: we do not engage in automated decision-making that produces legal or similarly significant effects on you
To exercise any of these rights, please contact our Information Officer using the contact details in section 1. We may need to verify your identity before responding. We will respond within the period required by applicable law (typically 30 days under GDPR/UK GDPR and a reasonable period under POPIA).
11. Right to Complain
If you have a concern about our processing of your personal information, please contact our Information Officer in the first instance. You also have the right to lodge a complaint with a data protection authority, including:
South Africa: Information Regulator
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001
- Postal: PO Box 31533, Braamfontein, Johannesburg, 2017
- Complaints email: [email protected]
- General enquiries: [email protected]
- Website: https://inforegulator.org.za
European Economic Area: your local supervisory authority. A list is available at edpb.europa.eu.
United Kingdom: Information Commissioner’s Office (ICO), ico.org.uk.
12. Children’s Personal Information
The Website is intended for use by business users and is not directed at children. We do not knowingly collect personal information from children under the age of 18. If you believe we have collected personal information from a child, please contact our Information Officer and we will delete it.
13. Additional Information for Residents of Specific Jurisdictions
13.1 South Africa (POPIA)
Under POPIA, you have rights as a data subject as described in section 10 above, plus the right to be notified of a security breach affecting your personal information where required by section 22 of POPIA.
USP&E processes personal information of South African data subjects in accordance with the conditions for lawful processing set out in sections 8 to 25 of POPIA, namely: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.
In terms of section 69 of POPIA, the processing of personal information for the purposes of direct marketing by electronic communication is prohibited unless the data subject has consented or is an existing customer of USP&E and certain further conditions are met.
13.2 European Economic Area and United Kingdom (GDPR / UK GDPR)
Where the GDPR or UK GDPR applies, USP&E acts as a controller in respect of your personal information. The legal bases on which we rely are identified in section 4. You have the rights set out in Articles 15 to 22 of the GDPR/UK GDPR.
13.3 California (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to limit use of sensitive personal information. We do not sell personal information for monetary consideration.
14. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, services, or applicable law. The current version is identified by the version number and effective date at the top of this document. We encourage you to review this Privacy Notice regularly.
Where changes are material, we will provide reasonable advance notice, including (where appropriate) by posting a notice on the Website or by email.
15. Contact
If you have any questions, concerns, or requests in relation to this Privacy Notice or our processing of personal information, please contact our Information Officer at:
USP&E Holdings (Pty) Ltd — Attention: Information Officer
Email: [email protected]