ResponsAgility (Pty) Ltd (“ResponsAgility”) is committed to protecting your privacy and complying with applicable data protection and privacy laws. This Privacy Policy will inform you as to how we process your Personal Information when you engage with us and tell you about your privacy rights and how the law protects you (as Data Subject).

It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your Personal Information. This Privacy Policy supplements other notices and privacy policies and is not intended to override them.

By providing Personal Information to ResponsAgility, registering a Service Account, submitting an enquiry, or clicking a “Submit”, “Register” “Contact”, “Connect”, “WhatsApp”, “Email” or similar button, you consent to the processing of your Personal Information in accordance with this Privacy Policy.

IMPORTANT INFORMATION AND WHO WE ARE

Privacy Policy Updates

We regularly review our Privacy Policy. The latest update date is on the first page. Older versions are available upon request. Future changes will be posted on our website or shared during your interactions with us, and will apply immediately once published.

Please keep your Personal Information accurate and up to date by informing us of any changes during your relationship with us.

Third-Party Sites: We do not control third-party sites linked to ours. These sites may use cookies or collect your data. We are not responsible for how these sites handle user information.

Third-Party links: Our Site(s) may link to external websites, plugins, or apps. Sharing your Personal Information with them is at your own risk—we are not liable for any loss or damage resulting from such disclosures, as we do not control how third parties use your data. Always read their privacy policies when you leave our site.

THE DATA WE COLLECT ABOUT YOU

We collect your Personal Information, as defined in this Policy. It does not include data where the identity of the Data Subject has been removed (anonymous data).

We may Process different kinds of Personal Information about you when we engage with you, which we have grouped together as follows:

You may choose to provide additional Personal Information to us, in which event you agree to provide accurate and current information, and not to impersonate or misrepresent any person or entity or falsely state or otherwise misrepresent your affiliation with anyone or anything.

Special Personal Information: We do not collect any Special Personal Information about you, except during provision of our Services or where required by law, which shall be collected as per the applicable legal requirements and, where necessary, with your consent.

Children Information (Children Data): we do not process the Personal Information of a child.

Submission of Personal Information on Behalf of Another: If you submit someone else's personal information, you must obtain their consent first. We will assume you have this consent and process the information as instructed. By submitting such information, you agree to indemnify us against any third-party claims related to a lack of proper consent or legal exception.

If you fail to provide Personal Information: If required by law or contract, we may not be able to offer or continue Services if you do not provide requested Personal Information. If this happens, we will let you know

HOW IS PERSONAL INFORMATION COLLECTED?

We use different methods to collect data from and about you including through:

COOKIES

See our Cookies Policy.

HOW WE USE YOUR PERSONAL INFORMATION

We do not sell Personal Information in exchange for monetary consideration. However, certain disclosures of Personal Information to service providers, analytics providers, advertising providers and technology providers may constitute "sharing", "targeted advertising" or a similar activity under applicable privacy laws. Most commonly, we will use Personal Information in the following circumstances:

where you have given us your consent; or

where we need to perform the contract, we are about to enter into or have entered into with you; or

where it is necessary for the protection of the Data Subject’s legitimate interest; or

where it is necessary for our legitimate interests (or those of a Third-Party) and your interests and fundamental rights do not override those interests; or

where we need to comply with a legal obligation.

We will get your consent before sending third-party direct-marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us or using such automated facilities made available by us.

Purposes for which we will use Personal Information:

The table below outlines how we use Personal Information and the legal grounds for doing so, including legitimate interests where relevant.

We may process your data under multiple lawful bases depending on its use. Contact us if you need clarification about which legal basis applies to your case.

Personal Information may also be processed for advertising, marketing, analytics, profiling, recommendation and platform personalisation purposes, subject to applicable law and any consent requirements.

Marketing: We strive to provide you with choices regarding certain Personal Information uses, particularly around marketing and advertising.

Promotional Offers

For Clients:

We may use your contact details to send service-related communications. You may opt out at any time (see section 5 iii below).

For Non-Clients:

We may collect your email through staff or our mailing system. Before sending any direct marketing, we will obtain your consent (opt-in).

Third-party marketing.

We will get your express opt-in consent before we share your Personal Information with any third-party for marketing purposes.

TAKE NOTE:. We may share anonymised, aggregated data for advertising, but IMPORTANT: we never disclose information that identifies individuals

Opting Out

You can ask us or third-parties to stop sending you marketing messages at any time by logging into the website or unsubscribe on the email communication or by contacting us at any time and requesting to op-out of our marketing services.

Where you opt out of receiving these marketing messages, this will not apply to Personal Information provided to us as a result of a Service purchase, service experience or other transactions .

Automated processing and decision making

ResponsAgility is committed in protecting personal information when utilising AI Systems

Use of AI Systems:-

Do we use AI Systems: Yes we do

For what purpose do we use AI Systems: We may use AI Systems to assist with the generation of assessment reports, behavioural insights, recommendations and analytics. AI Systems are not used to score assessments or determine behavioural outcomes. Where required by law, decisions materially affecting a Data Subject will be subject to human oversight.

We ensure that all AI Systems processing and automated decision-making complies with applicable data protection laws.

We conduct comprehensive reviews of all AI-generated content to ensure accuracy and reliability. Our team of experts verifies this content to maintain high standards of quality and relevance;

You are welcome to contact us (click here) at any time (in writing) to request an explanation on how your personal information is processed by AI Systems.

Kindly take note: your rights as per par. 12) below also applies in terms of personal information processed by AI Systems.

Where required under applicable law, Data Subjects may request additional information regarding significant automated decision-making, profiling or similar processing activities involving their Personal Information.

Change of purpose.

We will use your Personal Information only for its original purpose unless a compatible reason arises. If you want more details on this compatibility, please contact us.

For any unrelated use, we will notify you and explain the legal basis.

Your information may also be processed without your knowledge or consent when required or permitted by law.

DISCLOSURES OF PERSONAL INFORMATION

We may share Personal Information with the following parties for the purposes outlined above:

Internal Third-Parties: Our group companies, partners, or correspondents, who are required to follow this Policy when processing your Personal Information.

External Third-Parties: Defined in the Definitions section, as well as those specified by your instructions.

Third-Parties involved in business changes: If we sell, transfer, or merge our business or assets, new owners may use your Personal Information per this Privacy Policy.

During the preceding 12 months we may have disclosed the categories of Personal Information described in section 2 to service providers, contractors, hosting providers, analytics providers, payment providers, advertising providers, professional advisers and regulatory authorities for the purposes described in this Privacy Policy.

All Third-Parties must protect your Personal Information, act lawfully, and only process it for approved purposes per our instructions. Service providers are not permitted to use your Personal Information for their own purposes.

We may also share Personal Information with External Third-Parties if necessary to:

Comply with laws, regulations, or legal requests;

Enforce our Terms of Use and investigate potential violations;

Address fraud, security, or technical issues;

Protect against imminent harm to the rights, property, or safety of ResponsAgility, website users, or the public, as allowed by law.

We may disclose Personal Information to analytics providers, advertising partners, cloud service providers and technology providers in connection with providing, maintaining, securing, improving and promoting the Services.

INTERNATIONAL TRANSFERS

We may transfer Personal Information internationally, including to countries that may not provide the same level of protection as the jurisdiction in which the Personal Information was collected. Where required by law, appropriate contractual, technical, organisational or other safeguards will be implemented. All transfers comply with the relevant Data Protection Legislation.

We maintain records of all cross-border transfers and safeguards, and will provide this information on request.

By submitting your Personal Data, you consent to its transfer outside your country when necessary

DATA SECURITY

We've implemented technological and organisational safeguards to protect Personal Information from loss, unauthorised access, alteration, or disclosure. Access is restricted to those with a business need, all of whom are bound by confidentiality.

Procedures are in place for suspected breaches; we will notify you and regulators if legally required.

Certain legislation obliges us to report specific offences to authorities within set timeframes. We cannot be held responsible for any resulting consequences from such reporting.

DATA RETENTION

How long will we use your Personal Information for?

As long as needed to fulfil the purposes it was collected for and meet legal, regulatory, tax, accounting, or reporting requirements. If necessary, we may retain it longer for complaints or best practices related to our relationship with you.

You may request deletion of your data; see your legal rights below.

Retention periods depend on the type and sensitivity of your Personal Information, risk of unauthorised disclosure, processing purposes, and applicable laws.

Sometimes we anonymize your data for research or statistics so it’s no longer linked to you, and may use this indefinitely without further notice.

For purposes of determining appropriate retention periods, we consider the nature and sensitivity of the Personal Information, the purposes for which the Personal Information was collected, the potential risk of harm arising from unauthorised use or disclosure, legal and regulatory obligations, dispute resolution requirements and our legitimate business needs.

RECORDS

We will maintain thorough, accurate, and current records of Personal Information processing, including access, control, security, approved subcontractors, purposes and categories of processing, transfers to third countries and safeguards, customer instructions, and an overview of technical and organisational security measures, as well as the retention and disposal of Personal Information.

SOCIAL MEDIA

Our website, app, or services may offer social plug-ins from platforms like Facebook, Instagram, or LinkedIn. If you interact with these networks via our site, your activity may be visible to them and reflected in your profile according to your privacy settings. To prevent this, log out of your social account or adjust your privacy preferences before visiting.

Communication and engagement on external social media networks are governed by their individual terms and privacy policies.

Please use social media responsibly and with care. We will never request personal or sensitive information through social media; for such matters, please contact us directly by phone or email.

Our social media pages may share links, and some platforms shorten URLs. Check the authenticity of links before clicking, as we cannot guarantee safety against spam or hacking and are not liable for any resulting damages.

DATA SUBJECT’S LEGAL RIGHTS

Under certain circumstances, you have the following rights under data protection laws in relation to your Personal Information:

Request for Access: You may request access to the Personal Information we hold about you (a “data subject access request”). A prescribed fee may apply. Please refer to our PAIA Manual on our website.

Request Correction: You may request that inaccurate or incomplete Personal Information be corrected, subject to verification.

Request Deletion: You may request deletion of your Personal Information where there is no lawful basis to continue processing it. Erasure may be refused where required by law. This does not limit our rights to use Aggregate Data and Pattern Data.

Object to Processing: You may object to processing based on legitimate interests or for direct marketing purposes, unless we have compelling legitimate grounds to continue.

Request restriction of processing: You may request restriction of processing where accuracy is disputed, processing is unlawful, the data is required for legal claims, or an objection is under consideration.

Withdraw consent at any time: Where processing is based on consent, you may withdraw consent at any time. This will not affect prior lawful processing and may limit the Services we can provide.

b) If you wish to exercise any of the rights set out above, please contact us at the details mentioned 1)c) above.

c) Fee required: No fee is payable unless prescribed by law. We may charge a reasonable fee or refuse requests that are unfounded, repetitive or excessive.

d) Verification: We may request information to verify your identity and protect your Personal Information.

e) Response Time: We aim to respond within 30 (thirty) days, unless the request is complex, in which case we will notify you.

SUBCONTRACTORS

We may appoint subcontractors to assist in providing our services. All subcontractors are required to adhere to applicable Data Protection Legislation and contractual obligations to ensure the confidentiality and security of your Personal Information.

PERSONAL INFORMATION BREACH

In the event of a security compromise as contemplated in section 22 of POPIA, we are committed to managing the incident promptly, responsibly, and transparently. Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after becoming aware of the compromise, unless the identity of the data subjects cannot be established.

Such notification will be provided in accordance with section 22(4) of POPIA and will include sufficient information to allow affected data subjects to take protective measures, including:

A description of the possible consequences of the security compromise;

A description of the measures taken or proposed to be taken by us to address the security compromise;

Recommendations to the data subject on how to mitigate the potential adverse effects of the security compromise; and

If known, the identity of the unauthorised person who may have accessed or acquired the personal information.

We maintain a record of all breaches, even those not requiring notification, to ensure compliance with the Data Protection Legislation.

15) DEFINITIONS

Artificial Intelligence (AI) System or AI Systems means a computer-based technology which is designed to perform tasks that typically require human intelligence. It encompasses a variety of techniques, such as machine learning and natural language processing, enabling the system to learn, adapt and make decisions autonomously.

Channels: means any of our technology channels made available for you to access our Services, for example, website(s), App(s) or social media sites;

Consent means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of Personal Information.

Data Subject means the person to whom Personal Information relates and, in this document, refers to you as the party providing Personal Information that will be processed by us or a relevant third-party.

Data Protection Legislation means any and all applicable laws relating to the protection of data or of Personal Information and shall include the Protection of Personal Information as per the POPI Act.

1. Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best Service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your Personal Information for our legitimate interests. We do not use your Personal Information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required ore permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Operator means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party.

Platform means the website, software, applications and related technology operated by ResponsAgility through which the Services are provided;

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

PAI Act means the Promotion of Access to Information Act, Act 2 of 2000.

Personal Information means information as defined under applicable data protection legislation.

POPIA means the Protection of Personal Information Act, Act 4 of 2013.

Personnel means ResponsAgility employees, directors or authorised sub-contractors.

Responsible Party means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing Personal Information.

Services has the same meaning as per our Terms of Use via any of our channels/technologies.

Sites means our website, and or App and/or social media sites and/or other communication channels;

Special Personal Information means information that may be sensitive information, such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and biometric information or criminal convictions and offences.

THIRD-PARTIES:

Internal Third-Parties: Partners, affiliates, employees, shareholders, directors and/ or agents of ResponsAgility (if applicable), acting as joint responsible parties or operators and who may also provide IT and system administration services and undertake leadership reporting.

External Third-Parties:

Service providers acting as operators who provide IT and system administration services

Professional advisers acting as operators (i.e. correspondents and counsel/advocates) or joint Responsible Parties, including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.

The South African Revenue Services, regulators and other authorities acting as operators or joint Responsible Parties who require reporting of processing activities in certain circumstances

Courts of law or any other authorities where we have an obligation under law to share your Personal Information

In the event that we sell or buy any business or assets, in which case we may disclose your Personal Information to the prospective seller or buyer of such business or assets.

-END OF POLICY-