Privacy Policy

1. Who We Are

MARATTO AFRICA LTD is the data controller for personal data processed via maratto.africa. We operate MARATTO™, Africa's Outsourced Technology Transfer Office, helping universities identify, protect, and commercialise their research.

• Company: MARATTO AFRICA LTD
• Company number: 17169961 (registered in England and Wales)
• Registered office: 3rd Floor, 45 Albemarle Street, Mayfair, London W1S 4JL, United Kingdom
• Privacy contact: privacy@maratto.africa

MARATTO™ is part of the Dazzle Africa ecosystem. References to “we,” “us,” and “our” in this policy mean MARATTO AFRICA LTD.

2. What Data We Collect

2.1 Data you provide directly

• Registration and account data: name, job title, institution or organisation name, country, email address, and password (stored hashed)
• Profile category: University, Investor, Donor, Industry, Domain Expert, Researcher, or Partner
• Researcher and institutional profile data submitted via account workflows, including academic affiliation, research interests, and publication references
• Form submissions and correspondence: any content you submit via contact, register interest, partnership enquiry, or complaints forms

2.2 Data collected automatically

• IP address and browser metadata via Vercel hosting infrastructure (used for security, fraud prevention, and basic operations)
• Page views and performance metrics via Vercel Analytics (cookieless; aggregated)
• User behaviour, clicks, scroll depth, and session recordings via PostHog (loaded only after explicit consent)

2.3 Data we receive from third parties

Publicly available institutional and researcher metadata is curated from open sources including OpenAlex and used to construct university and researcher profile data within the platform. Where such data identifies an individual, you may request review, correction, or removal via privacy@maratto.africa.

2.4 Data we do not collect

• Payment card information (we do not process card payments directly; any future payment processing will be handled by a regulated third party with its own privacy notice)
• Special category data under UK GDPR Article 9 or POPIA Section 26, unless you voluntarily submit such data in correspondence

3. How We Use Your Data

We process personal data for the following purposes:

• To respond to enquiries and Register Interest submissions
• To create and manage your account on the MARATTO platform
• To provide services under any engagement letter or agreement entered into with your institution
• To contact you about MARATTO services, programmes, and updates you have opted into
• To operate, secure, and improve the platform using aggregated analytics
• To map and curate university and researcher information for the publicly visible institutional directory
• To comply with legal, regulatory, and reporting obligations

We do not sell your data. We do not share your data with third parties except as described in Section 4.

4. Third-Party Service Providers

We use the following providers to operate the platform. Each acts as a processor under our written instructions, with appropriate data processing terms in place.

5. Legal Basis for Processing

We process personal data under one or more of the following lawful bases:

• Consent (UK GDPR Article 6(1)(a); POPIA Section 11(1)(a)): marketing communications, PostHog session tracking, and non-essential cookies. You may withdraw consent at any time.
• Contract (UK GDPR Article 6(1)(b); POPIA Section 11(1)(b)): account management and delivery of MARATTO services to you or your institution.
• Legitimate interests (UK GDPR Article 6(1)(f); POPIA Section 11(1)(f)): responding to enquiries, securing the platform, basic cookieless analytics, and curating institutional directory data. A Legitimate Interests Assessment is carried out and available on request.
• Legal obligation (UK GDPR Article 6(1)(c); POPIA Section 11(1)(c)): compliance with applicable laws and regulatory reporting.

Where applicable, we may also rely on the Data (Use and Access) Act 2025 (DUAA) “recognised legitimate interests” basis for specific processing activities listed in that Act.

6. Your Rights

Under UK GDPR, EU GDPR (where applicable), and South Africa's Protection of Personal Information Act, 2013 (POPIA), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data, subject to legal retention obligations
• Withdraw consent at any time
• Object to processing based on legitimate interests
• Request restriction of processing
• Receive your data in a structured, machine-readable format (data portability)
• Object to solely automated decisions that produce legal or similarly significant effects
• Lodge a complaint with us directly (see Section 10) or with a supervisory authority

To exercise any of these rights, contact privacy@maratto.africa. We will respond within one month. We may pause this period where we reasonably need further information to verify your identity or clarify the scope of your request, as permitted under the DUAA 2025.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy.

You may request earlier deletion at any time by contacting privacy@maratto.africa. We will action verified requests within one month unless we have a legal obligation requiring continued retention, in which case we will explain the basis.

8. International Data Transfers

MARATTO AFRICA LTD is established in the United Kingdom. Personal data is primarily processed in the United Kingdom, European Union, and United States.

Where we transfer personal data outside the United Kingdom or European Economic Area, we rely on one or more of the following safeguards:

• The United Kingdom's adequacy decision for the European Economic Area, and the European Commission's adequacy decision for the United Kingdom (renewed until 27 December 2031)
• The International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses for transfers to the United States and other jurisdictions without an adequacy decision
• Supplementary safeguards as required under the DUAA 2025 “not materially lower” data protection test

For transfers from South Africa under POPIA, we rely on Section 72 transfer mechanisms including binding contractual terms and adequacy of the recipient jurisdiction.

9. Information Officer (POPIA)

In accordance with Section 56 of South Africa's Protection of Personal Information Act, 2013, we have appointed an Information Officer responsible for compliance with POPIA in respect of South African personal data processed by MARATTO.

• Information Officer: Phin Mpofu-Masamba II
• Contact: privacy@maratto.africa
• South African supervisory authority: Information Regulator (South Africa), inforeg@justice.gov.za, inforegulator.org.za ↗

The Information Officer is responsible for handling data subject requests, complaints, and regulatory enquiries relating to South African personal data.

10. Complaints Process

If you believe we have processed your personal data unlawfully or contrary to this policy, you have the right to complain to us directly.

To submit a complaint:

• Email complaints@maratto.africawith the subject line “Data Protection Complaint” and a description of the issue, or
• Submit our complaints form at maratto.africa/complaints

Our commitment:

• We will acknowledge your complaint within 30 days of receipt, as required under the Data (Use and Access) Act 2025
• We will investigate without undue delay and aim to provide a substantive response within three months
• We will communicate our findings in plain language and explain any steps we have taken or will take

Escalation:

If you are dissatisfied with our response, or if you prefer to complain to a supervisory authority directly, you may contact:

• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint ↗, 0303 123 1113
• South Africa: Information Regulator, inforeg@justice.gov.za, inforegulator.org.za ↗
• European Union: Your local data protection authority

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy at maratto.africa/cookies. You can manage your preferences via the cookie banner or the Cookie Preferences link in our footer.

Under the DUAA 2025, certain low-intrusion cookies (such as those used for basic analytics or service functionality) no longer require consent, provided a clear opt-out mechanism is offered. Marketing and tracking cookies continue to require your explicit consent under PECR.

12. Children

MARATTO is a professional platform aimed at university, research, investor, donor, industry, and partner audiences. It is not directed at children under 18 and we do not knowingly collect personal data from minors.

If you believe we have inadvertently collected personal data from a child, please contact privacy@maratto.africa and we will delete it promptly.

13. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest where supported by our processors, access controls, audit logging, and regular review of our security posture. No system is perfectly secure and we cannot guarantee absolute security, but we work to industry-standard practices.

14. Changes to This Policy

We will update this page when our practices or applicable law change. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated by email to active account holders where reasonably possible. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

This policy was last reviewed against the Data (Use and Access) Act 2025 (UK), UK GDPR, EU GDPR, and South Africa's Protection of Personal Information Act, 2013 (POPIA).