Effective Date: 19 January 2026
Smollan is a global group of companies (“Smollan”, “we”, “our”, “us”) providing retail, marketing, technology, and related services across multiple jurisdictions.
This Privacy Notice applies to personal data processed by Smollan and its affiliates worldwide. The relevant Smollan entity that collects and processes your personal information is the data controller (or responsible party under South Africa’s POPIA) and determines how and why your data is processed.
For visitors to https://www.smollan.com and associated services, Global Smollan Holdings registered in Mauritius at c/o BTG Management Services (Mauritius) Limited, Block 9A & 9B, Cascavelle Business Park, Petite Rivière Noire Road, Cascavelle, 90522, Republic of Mauritius, with Reg number 082910/GBC, acts as the primary data controller.
Where you engage with Smollan in another country, a local Smollan entity may act as the controller, joint controller, or data processor, depending on the purpose and context of processing.
For a complete list of Smollan’s global entities, their roles, and relevant contact details, please contact us via the details provided in the Contact Us section of this Privacy Notice.
This Privacy Notice explains how Smollan may collect, use, store, share, and protect your information when you interact with us.
It applies to personal information collected through our websites, mobile applications, recruitment platforms, vendor onboarding systems, and any other channels where we process your data as part of providing our products and services.
For the purposes of this Privacy Notice, “personal information” (also referred to as “personal data”) means:
By accessing our websites, engaging with us, or using our services, you acknowledge that your personal information will be processed in accordance with this Privacy Notice and applicable data protection regulations.
Smollan is committed to upholding globally recognised data protection standards and applying best practice principles across all our operations to ensure transparency, fairness, and the highest level of security wherever your data is processed.
We collect personal information directly from you when you interact with our platforms, as well as through automated means such as cookies and tracking technologies when you browse our websites.
Your data is used to provide services, process job applications, manage vendor relationships, and ensure we meet our legal and regulatory obligations across the regions we operate in.
We may share your personal information with trusted third parties where necessary to deliver our services, comply with our legal obligations, manage our business operations, or protect our legitimate interests.
We take appropriate steps to ensure that any third parties receiving your data apply equivalent levels of security and comply with applicable data protection laws, including through Data Processing Agreements or equivalent contractual safeguards.
Other companies within the Smollan Group that provide operational, administrative, HR, finance, IT, or marketing support.
These entities may act as data controllers, joint controllers, or processors, depending on the context.
Regions: South Africa, EU, UK, AFRICA, LATAM, MEA, SEA and other regions where Smollan operates.
Providers of secure hosting, collaboration, productivity, and data storage platforms (e.g., Microsoft, Google, OneTrust).
Used for internal communications, data processing, website operations, and productivity tools.
Regions: Global.
Service providers assisting with candidate applications, onboarding, background screening, and right-to-work verifications.
Includes third-party recruitment platforms and background-check providers, used only where legally permitted and with appropriate consent where required.
Regions: Regional or country-specific, depending on where the role or candidate is located.
Digital marketing, analytics, and social media platforms (e.g., LinkedIn, Google Analytics) that help us deliver campaigns, assess engagement, and improve content performance.
Regions: Global.
Auditors, legal counsel, consultants, and other professional advisors engaged to support operational, financial, legal, or risk management matters.
Regions: Global.
Where required by law, we may share your personal information with regulators, courts, law enforcement authorities, tax authorities, or public agencies to:
Regions: Country-specific depending on the jurisdiction involved.
Where Smollan provides services to clients, we may share limited personal information necessary for project delivery, vendor onboarding, or client-requested reporting.
Regions: Determined by client project locations.
If Smollan undergoes a merger, acquisition, restructuring, or sale of assets, your personal information may be transferred to the acquiring organisation, subject to appropriate safeguards.
Credit reference agencies, fraud prevention bodies, and security service providers engaged to detect, investigate, and prevent identity theft, cyberattacks, and fraudulent activity.
Smollan works with a range of trusted third parties to support our operations across multiple regions. Depending on your relationship with us, your personal information may be shared with the following categories of recipients:
Regions: Global, depending on the nature of the processing and your engagement with Smollan.
We take the security of your personal information seriously. We implement appropriate technical, organisational, and administrative measures to protect it against unauthorised access, loss, alteration, or disclosure, in line with applicable data protection laws.
Where we share personal information with trusted third-party service providers, we require them to apply equivalent security standards through contractual agreements.
While we take reasonable steps to protect your data, no security system is completely infallible. If a personal data breach occurs, Smollan will respond in line with applicable legal requirements, including notifying affected individuals and regulators where necessary.
Smollan operates globally and may transfer your personal information to other Smollan group companies, affiliates, service providers, or trusted third parties located outside your country of residence.
Where your data is transferred internationally, we ensure that appropriate safeguards are in place to protect your information and comply with applicable data protection laws. These safeguards may include the use of Adequacy Decisions, Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement, Binding Corporate Rules (BCRs), or other permitted mechanisms under local law.
If you would like more information about these safeguards or wish to request a copy of the relevant contractual clauses, please contact us at informationofficer@smollan.com.
Some jurisdictions impose specific cross-border transfer requirements and require specific safeguards or authorisations for transfers. Smollan ensures that all international transfers comply with the local data protection requirements where your information is collected.
Smollan processes your personal information in compliance with applicable data protection laws in the regions where we operate, applying globally recognised privacy standards.
Depending on the context and purpose of processing, we may rely on one or more of the following lawful bases:
| Lawful Basis | Illustrative Processing Activities |
|---|---|
| Consent |
|
| Performance of a Contract |
|
| Legitimate Interests |
|
| Compliance with Legal Obligations |
|
| Vital Interests (applies in limited cases) |
|
Smollan may process sensitive personal information, such as health data, disability status, racial or ethnic origin, biometric data, or criminal records, only where permitted by applicable data protection laws.
This typically occurs where:
For more detail on the lawful bases we rely on, please refer to the Lawful Basis for Processing section above.
Smollan retains personal information only for as long as necessary to fulfil the purposes described in this Privacy Notice or as required by applicable laws, regulations, or contractual obligations.
Where it is not possible to specify fixed retention periods, we determine retention based on factors such as:
Once personal information is no longer required, we will securely delete, anonymise, or archive it in accordance with legal obligations.
You may request deletion of your personal information, where applicable, by contacting us via the details provided in the Contact Us section.
As part of our recruitment process, Smollan may use AI-assisted tools to support the assessment of candidate applications. These tools may analyse information you provide, including your CV, qualifications, application form responses, and screening results, to assist our recruitment team in identifying suitable candidates.
Smollan uses AI-assisted tools to support recruitment but ensures that final hiring decisions are always made by human recruiters. We also require our AI service providers to comply with Smollan's data protection and security standards and take reasonable steps to ensure AI tools are used fairly, transparently, and only for the purposes described in this Privacy Notice.
To exercise these rights, please contact us via the details provided in the Contact Us section of this Privacy Notice.
Subject to applicable data protection laws in the country where you reside, you may have the following rights in relation to your personal information:
If you wish to exercise any of these rights, please select this LINK and complete the online form. We may request additional information to verify your identity before fulfilling your request.
Where we process your personal information based on your consent, you have the right to withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before withdrawal.
Questions, comments or requests regarding this Privacy Notice or any of our processing should be made to our Data Privacy Team by completing the form available via this LINK or post at: Data Privacy, Smollan, P.O. Box 51537, Raedene, Johannesburg, South Africa, 2124.
If you are located in the European Union or United Kingdom and wish to contact us regarding our data processing activities, you may do so via our designated representatives pursuant to Article 27 of the General Data Protection Regulation (GDPR).
European Union: Advantage Smollan BV LINK
United Kingdom: Advantage Smollan Limited LINK