Privacy Policy & POPIA Compliance

1. Definitions & Scope

"Personal Information" means information relating to an identifiable, living natural person or existing juristic person, including but not limited to: race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language, birth, education, medical, financial, criminal or employment history, ID number, email, physical address, location, biometric information, personal opinions, views or preferences.

"Responsible Party" means IntelliAI Group (Pty) Ltd, CIPC 2026/429045/07, 8431 Ketting Road, Devland Ext 36, Johannesburg 1811, Gauteng, South Africa.

"Operator" means any person or entity who processes personal information on behalf of the Responsible Party under a written contract that complies with POPIA Section 20.

"Data Subject" means the person to whom personal information relates — including natural persons, juristic persons, and representatives of enterprise clients.

"Processing" means any operation or activity concerning personal information, including collection, recording, organisation, storage, updating, retrieval, consultation, use, dissemination, merging, linking, restriction, degradation, erasure, or destruction.

2. Information Officer & Deputy

3. Lawful Processing Grounds (POPIA §11)

IntelliAI Group processes personal information only where a lawful ground exists under POPIA Section 11. The table below maps each processing activity to its legal basis:

Processing Activity	Legal Basis (POPIA §11)	Data Categories
Account registration & authentication	Consent + Contractual necessity	Name, email, company, phone
Billing & payment processing	Contractual necessity + Legal obligation	Payment details, VAT ID, billing address
Service delivery & API access	Contractual necessity	Usage data, IP address, API keys
Security monitoring & fraud prevention	Legitimate interest + Legal obligation	IP address, device fingerprint, access logs
Compliance reporting (SARS, POPIA, SOC 2)	Legal obligation	Transaction records, audit logs
Marketing & intelligence briefings	Consent (opt-in)	Email, preferences, engagement metrics
Employment & contractor management	Consent + Legal obligation	CV, ID, qualifications, criminal checks

4. Data Subject Rights (POPIA §23–§26)

Every data subject has the following rights, which IntelliAI Group enforces through automated portal mechanisms and manual escalation channels:

• Right of Access (§23): Request confirmation of whether we hold your personal information, and receive a copy within 21 business days.
• Right to Correction (§24): Request correction, updating, or deletion of inaccurate personal information within 21 business days.
• Right to Deletion (§24(1)(c)): Request destruction or deletion of personal information where retention is no longer necessary for the lawful purpose.
• Right to Object (§11(3)): Object to processing for direct marketing purposes at any time, with immediate effect.
• Right to Complain: Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

5. Purpose Specification & Minimality

IntelliAI Group adheres strictly to POPIA Section 13 (Purpose Specification) and Section 14 (Information Minimality):

• Personal information is collected only for specific, explicitly defined, and lawful purposes related to the provision of sovereign AI infrastructure.
• Processing is adequate, relevant, and not excessive for the purpose — no superfluous data fields are collected.
• Further processing is compatible with the original purpose, or a new lawful ground is established and communicated to the data subject.
• Data retention is strictly time-bound — see Section 7 below.

6. Security Safeguards (POPIA §19)

IntelliAI Group implements appropriate technical and organisational measures to secure personal information against loss, unlawful access, interference, modification, unauthorised disclosure, or destruction:

• AES-256 encryption at rest for all databases, object storage, and backup archives.
• TLS 1.3 in transit for all API endpoints, web traffic, and inter-service communication.
• Zero-trust architecture — every request authenticated, every action logged, every identity verified.
• Role-based access control (RBAC) with principle of least privilege enforced across all 9 divisions.
• SOC 2 Type II certified controls — independent auditor attestation annually.
• Incident response plan — 4-hour breach notification to Information Regulator and affected data subjects as per POPIA §22.
• Quarterly penetration testing by certified third-party security firms.

7. Retention & Destruction Schedule

Data Category	Retention Period	Destruction Method
Account credentials & profile	Duration of contract + 5 years	Cryptographic erasure + physical media destruction
Payment & billing records	7 years (SARS & Tax Act requirement)	Secure archive deletion with audit trail
API usage & telemetry logs	90 days (active) + 1 year (compressed archive)	Automated purge via SEE cron
Marketing consent records	Duration of consent + 2 years	Soft delete with 30-day grace period
Security & access logs	1 year	Automated anonymisation after 1 year
Employee & contractor records	Duration of employment + 10 years	Physical shredding + digital wipe

8. Cross-Border Data Flows (POPIA §72)

IntelliAI Group's primary data residency is South Africa — all production workloads run on sovereign HPC clusters in Johannesburg with Cape Town DR. Cross-border transfers occur only under the following conditions:

• EU clients: Transfers to EU-based sub-processors are governed by Standard Contractual Clauses (SCCs) approved by the EU Commission, with POPIA §72(1)(a) adequacy assessment.
• Cloud infrastructure: Google Cloud Platform (Singapore region) is used exclusively for non-personal, anonymised training data. No identifiable personal information leaves South African jurisdiction without explicit data subject consent.
• Third-party operators: All operators (Paystack, Supabase, Google Cloud) are bound by written agreements compliant with POPIA Section 20, including confidentiality, security, and audit provisions.

9. Cookies & Tracking Technologies

We use only two categories of cookies:

• Essential cookies: Required for platform security, authentication, and session management. Cannot be disabled. Stored for session duration + 30 days.
• Functional cookies: Enhance user experience (theme preference, dashboard layout). Stored for 90 days. Disabled if "Essential Only" selected.

We do not use third-party advertising cookies, tracking pixels, or behavioural profiling. Our cookie consent bar (visible on first visit) allows granular selection and stores preference in localStorage under key ii_cc.

10. Children's Privacy

IntelliAI Group services are intended for enterprise B2B clients, government entities, and professional operators aged 18 and above. We do not knowingly collect personal information from children under 18. If we discover such collection, we delete the data immediately and notify the Information Regulator within 24 hours.

11. Policy Updates & Version Control

This Privacy Policy is reviewed quarterly and updated as required by changes in law, technology, or business operations. Material changes are communicated via email to all registered users and posted on this page with a 30-day advance notice period. The current version is effective from 01 August 2026.

12. Contact & Escalation

For all privacy-related inquiries, data subject requests, or Information Regulator correspondence:

• Email: privacy@intelliaigroup.co.za
• Phone: +27 66 148 3731 (CEO Office)
• Physical: 8431 Ketting Road, Devland Ext 36, Johannesburg 1811, South Africa
• Information Regulator: www.inforegulator.org.za · JD House, 27 Stiemens Street, Braamfontein, Johannesburg