Privacy Policy

INSOBI PTY LTD ("Insobi", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, store, and disclose personal information when you visit our website, contact us, use our services, or interact with web applications that we operate. It is intended to explain our practices under the South African Protection of Personal Information Act 4 of 2013 ("POPIA") and, where applicable, other data protection laws.

This policy should be read together with any service agreement, project terms, privacy notice, or data-processing agreement that applies to a particular service. If we process personal information on behalf of a business client, that client will generally determine why and how the information is processed, and its own privacy notice may also apply.

Depending on how you interact with us, we may collect:

• Identity and contact details, such as your name, business name, email address, and telephone number.
• Business and project information, such as requirements, correspondence, documents, and feedback you provide.
• Account and service information, such as usernames, settings, support requests, and activity needed to provide a service.
• Technical and usage information, such as IP address, browser type, device information, pages visited, and log data.
• Payment and transaction details. Payments may be handled by a payment provider; we do not intend to store full payment-card details unless expressly stated.
• Any other information you choose to provide to us or that is required to provide an agreed service.

Please do not send us special personal information or information about children unless it is necessary, you are authorised to provide it, and we have agreed how it will be handled.

We collect information directly from you, from your use of our website or services, and, where lawful and appropriate, from our business clients, service providers, or publicly available sources. Some technical information may be collected automatically through server logs, cookies, and similar technologies.

We may use personal information to:

• Respond to enquiries, prepare proposals, and communicate with you.
• Provide, maintain, secure, and support our software development and related services.
• Set up and administer accounts, projects, contracts, and payments.
• Diagnose problems, prevent fraud or misuse, and improve our website and services.
• Meet legal, regulatory, accounting, and record-keeping obligations or establish and defend legal claims.
• Send service-related notices and, where permitted, marketing communications.

We process information only where a lawful justification applies under POPIA, such as your consent, the performance of a contract or steps you request before entering one, compliance with a legal obligation, protection of a legitimate interest, or our or another party’s legitimate interests where permitted by law. Where processing is based on consent, you may withdraw it, subject to legal and contractual limits. Withdrawal does not affect processing already carried out lawfully.

We may share personal information with:

• Our employees and contractors who need it to perform their duties and are subject to confidentiality obligations.
• Service providers that support our operations, such as hosting, cloud storage, analytics, communications, security, and payment providers.
• Business clients, where we process information on their behalf to deliver an agreed project or service.
• Authorities, regulators, courts, or other parties when required or permitted by law, or when reasonably necessary to protect rights, safety, or security.
• A successor or relevant party in connection with a business restructuring, merger, or transfer, subject to applicable privacy requirements.

We do not sell personal information. Where another organisation processes information on our behalf, we take reasonable steps to require appropriate confidentiality and security safeguards. If we act as an operator for a client, we will process the information under that client’s instructions and the applicable written agreement, and notify the client of a security compromise as required by law and our agreement.

Our website or applications may use essential cookies and similar technologies to operate, protect, and remember settings. If we use analytics or advertising technologies, we will provide appropriate information and choices where required by law. You can manage cookies through your browser settings; disabling some cookies may affect functionality. Add the actual cookie and analytics tools used by the website here before publication.

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing services, resolving disputes, maintaining appropriate business records, and meeting legal obligations. Retention periods depend on the type of information and the reason it was collected. When information is no longer required, we will take reasonable steps to delete it, destroy it, or de-identify it, unless the law requires or permits further retention. Project-specific retention and deletion arrangements may be set out in your service agreement.

We use reasonable technical and organisational safeguards designed to protect personal information against loss, unauthorised access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will follow applicable legal requirements, including notifying the Information Regulator and affected data subjects as soon as reasonably possible, subject to lawful directions or restrictions.

Some of our service providers or systems may be located outside South Africa, so personal information may be transferred to or accessed from another country. Where POPIA applies, we will take reasonable steps to ensure that a transfer complies with section 72, for example because the recipient is subject to an adequate level of protection, the transfer is necessary for a contract, you have consented, or another permitted ground applies. Contact us for information about relevant service providers and safeguards, subject to security and confidentiality limits.

Our business services and website are not intended to solicit personal information directly from children. We will not knowingly process a child’s personal information except where permitted by POPIA, including where the required consent from a competent person has been obtained or another legal exception applies. If you believe a child has provided personal information to us improperly, contact us so we can assess and address the matter.

Subject to applicable law and verification of your identity, you may have the right to request access to, correction of, or deletion of your personal information; object to certain processing; withdraw consent where processing is based on consent; and lodge a complaint with the Information Regulator. You may also opt out of direct marketing communications at any time using the unsubscribe method provided or by contacting us. Some rights are subject to legal exceptions and may not apply in every situation.

To make a request, contact our Information Officer using the details below. We may ask for information needed to verify your identity and understand the request. You may also complain to the South African Information Regulator via its website.

We may send business or service updates where permitted by law. Electronic direct marketing will be conducted in accordance with POPIA, including its consent and existing-customer rules where applicable. Each marketing message will include a way to opt out. We will honour opt-out requests as required by law.

We may update this policy from time to time. The revised version will be posted on our website with a new “Last updated” date. Material changes will be brought to your attention where required by law.

For privacy questions or requests, contact INSOBI PTY LTD at admin@insobi.com.

Information Officer: [insert the registered Information Officer’s name or role]
Postal or physical address: [insert business address]
Telephone: [insert telephone number]

Confirm and complete these contact details, the cookies and analytics actually used, and any service-specific retention periods before publishing this policy.