How we handle your information

The responsible party is To supply: registered legal name of the organising entity, registration number To supply: company / NPO registration number, at To supply: physical address for service. We run Young Entrepreneurs Pitch Initiative (YEPI), the entrepreneurship track of the Wisdom for Business Conference 2026.

Our Information Officer is To supply: full name, reachable at To supply: e.g. privacy@yepi.co.za.

Depending on how far your application goes, we collect:

• About you: your full name, date of birth, email address and mobile number. A link to a professional profile if you choose to give one.
• Your identification: either a South African ID number, or a passport number and the country that issued it. One of the two is required to apply. We use it to confirm you are eligible, and for an ID number we also check it against the date of birth you gave. It is never used to rank or score your application.
• Your venture: its name, what it does, where it operates, its stage, any website or social links, and optionally whether it is CIPC-registered — again, for information only, never for scoring or exclusion.
• Traction: how long you have been going, what progress you have made, and how many people are involved.
• Your pitch: your executive summary, your elevator pitch, your pitch deck, and any supporting documents you attach.
• Your consent record: which confirmations you ticked, when, and the version of this notice in force at the time.
• Assessment notes (about you, not from you): private scores and notes the committee records. These are never shown to applicants.

What we do not ask for. Applying requires one identification number and nothing else of that kind. We do not ask to see the document itself, nor for a CIPC registration number, a visa or permit, or banking details at any point in applying or becoming a finalist. Those are only requested from winners, at the moment a grant is about to be paid.

This is the stage where further documents are needed, because money is about to move. Before a grant is paid we will ask for proof that the venture is CIPC-registered (or that registration is in process), proof that you may lawfully receive funds in South Africa — for a passport holder that means a valid visa or permit — and the banking and tax details our finance team requires.

We ask for these only from people who have been selected, only once they have been selected, and only to make the payment and meet our legal and banking obligations.

• Your consent (section 11(1)(a)) — to receive, read and assess your application, and to contact you about it. You may withdraw consent at any time, though we cannot un-assess an application already judged.
• Performing an agreement (section 11(1)(b)) — to pay a grant to a selected venture.
• Legal obligation (section 11(1)(c)) — to keep financial records and satisfy banking and tax requirements for funds we disburse.
• Our legitimate interests (section 11(1)(f)) — to run the programme, prevent abuse of the application process, and keep the platform working.

We do not sell your information, and we do not use it to advertise to you or profile you for anyone else.

Inside the programme: the organising committee, and the mentors and judges involved in the stage your application has reached. Finance and compliance staff see payment documents only, and only for winners.

Outside the programme, we use service providers (operators, in POPIA’s language) who process information on our instructions and may not use it for their own purposes:

• MongoDB Atlas — stores the application database.
• Vercel — hosts the platform and stores uploaded files.
• Resend — delivers the emails we send you.

Our database is hosted in To supply: confirm the MongoDB Atlas region (currently outside South Africa), and files and email are handled by providers that operate internationally. This means your personal information is transferred outside South Africa.

Section 72 of POPIA allows this where the recipient is subject to laws or binding agreements that give comparable protection, or where the transfer is necessary to perform our agreement with you. We rely on the data-processing terms we have with these providers. You may ask us for details of those safeguards.

Please read this before attaching a pitch deck. Uploaded files are stored in Vercel Blob and each one is given a web address containing a long random string. The address is not listed anywhere, not searchable, and not guessable in practice — but anyone who has that address can open the file without signing in, and the address keeps working for as long as the file exists. If a document is too sensitive to be handled on that basis, do not upload it. Send only what the committee needs to judge your pitch.

When we delete a file under our retention rules, its address stops working.

We set two cookies, both strictly functional. Neither tracks you, and we run no advertising or analytics cookies.

• yepi_draft — links your browser to your unfinished application so you can come back to it. Expires after 30 days.
• yepi_status — keeps you signed in to your status page after you follow an emailed link. Expires after 30 days.

Both are cryptographically signed, marked HttpOnly so page scripts cannot read them, and contain only a reference to your application — never your name, your answers or your files.

• Applications you started but never submitted: 30 days from the last time it was saved.
• Applications that were not selected: 12 months after the programme concludes.
• Applications that received funding: 5 years, to meet financial record-keeping obligations.

After that we delete the record and the uploaded files. We may keep anonymous, aggregated figures — how many people applied, from which provinces — which cannot be traced back to you.

Under POPIA you may:

• Ask whether we hold information about you, and get a copy (sections 23 and 24).
• Ask us to correct anything that is wrong or incomplete.
• Ask us to delete information we no longer have a reason to keep.
• Object to processing based on our legitimate interests (section 11(3)).
• Withdraw your consent, which stops any further processing that relied on it.
• Complain to us, or directly to the Information Regulator (South Africa).

Write to our Information Officer at To supply: e.g. privacy@yepi.co.za. We will respond within a reasonable time, and we will not charge you to make a request or penalise you for making one.

Withdrawing consent or asking us to delete your application while the programme is running will end your participation, because we cannot assess a pitch we no longer hold.

Traffic to and from the platform is encrypted in transit. Session cookies are signed and HttpOnly. Uploads are accepted only from a live application session, only into that application’s own area, and only within set file-type and size limits. Access to applications is limited to the people running the programme.

No system is perfectly secure. If a breach puts your personal information at real risk, we will notify you and the Information Regulator (South Africa) as section 22 requires.

YEPI is open to founders aged 18–35. We do not knowingly process the personal information of anyone under 18. If you believe a child has applied, tell us and we will delete the record.

If we change how we handle your information we will publish an updated notice with a new version number here, and tell applicants by email where the change is significant. The version recorded against your application is the one you agreed to.

For anything in this notice, write to our Information Officer at To supply: e.g. privacy@yepi.co.za, or to the programme at To supply: e.g. hello@yepi.co.za.

If you are not satisfied with our response you may complain to the Information Regulator (South Africa) at inforegulator.org.za.