Privacy Policy

Introduction

OMNATIX respects your privacy. We collect only what we need, we tell you why we need it, and we do not sell your personal information to anyone. Ever.

This Privacy Policy explains how we handle personal information when you visit our website, enquire about our services, become a client, attend our training, or otherwise deal with us. It applies to our website at omnatix.co.za and to every page and profile on it.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), and we apply the eight conditions for lawful processing that POPIA sets out: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and data subject participation.

This Privacy Policy forms part of our Terms and Conditions.

Who we are

For the purposes of POPIA, the responsible party for the personal information described in this policy is:

Trading name

OMNATIX

Registered legal entity

[REGISTERED COMPANY NAME] (Pty) Ltd

Company registration number

[COMPANY REGISTRATION NUMBER]

Physical and registered address

13 Heuwelsig Office Park, Centurion, Gauteng, South Africa

Email address

info@omnatix.co.za

Telephone

+27 81 347 1724

Country of domicile

Republic of South Africa

Information Officer

Our Information Officer is responsible for our compliance with POPIA and with the Promotion of Access to Information Act 2 of 2000 ("PAIA"), and is the person to contact about anything in this policy.

What personal information we collect

We collect different information depending on how you interact with us. We do not collect more than we need for the purpose.

When you enquire or contact us

• Your name and surname.
• Your email address.
• Your telephone or mobile number, if you give it.
• Your company or organisation name and your role, if you give them.
• The content of your message, and anything else you choose to tell us.

When you become a client

• Billing contact name, email address, telephone number, and billing address.
• Company registration number and VAT number, where you are a business.
• Purchase order numbers and other accounting references.
• Records of our correspondence, meetings, proposals, invoices, and payments.
• Technical contact details and, where you provide them, the access credentials we need to do the work.

When you book or attend training

• Attendee names, email addresses, and job roles.
• Dietary or accessibility requirements you tell us about, where the session is in person. We treat these as special personal information and use them only to make the arrangements.
• Attendance records and, where a certificate is issued, the details that appear on it.

When you visit our website

• Your IP address, approximate location derived from it, browser type and version, device type, operating system, and screen size.
• The pages you visited, the time and date of the visit, how long you spent, and the site or search that referred you.
• Information stored in cookies and similar technologies, as described in section 8.

When you use an interactive demo on our site

• Text you type into a demo, so that the demo can respond to it.
• Where you use the live voice demonstration, your speech is converted to text by your own browser using the browser's built in speech recognition. That conversion happens on your device or through your browser vendor, under your browser vendor's own privacy policy. We do not record, store, or transmit your voice audio to our servers.
• Demo input is used to produce the demo response and is not stored by us after the demo closes.

What we do not collect

• We do not collect or store your full card number, card expiry date, or card security code. See section 7.
• We do not collect special personal information such as race, health, religious belief, political persuasion, biometric data, or criminal record, except where you volunteer an accessibility or dietary requirement for a training session, or where the law requires it.
• We do not buy personal information from data brokers or list sellers.

How we collect personal information

• Directly from you. When you fill in a form, email us, call us, message us, sign a proposal, or attend a meeting or training session. This is how we get most of what we hold.
• Automatically. Through cookies and server logs when you browse the website, as described in section 8.
• From your organisation. Where a colleague of yours gives us your work contact details so that we can do the work, for example as a technical or billing contact.
• From public sources. Occasionally from a public business directory, a company's own website, or a professional network, where we are researching a prospective client organisation.
• From service providers. Our payment provider confirms to us that a payment succeeded or failed, together with the limited transaction details described in section 7.

Where we collect your information from someone other than you, and POPIA requires it, we will tell you that we hold it and where we got it.

Why we process personal information

POPIA requires us to have a lawful basis for every purpose. The table below sets out ours.

We will not use your personal information for a new purpose that is incompatible with the purpose we collected it for, unless you consent or the law allows it.

Payment information

• Online card and instant electronic funds transfer payments are processed by Payfast, a licensed South African payment service provider, or by another reputable gateway we identify to you at the time of payment.
• Payment pages use industry standard Transport Layer Security encryption.
• Card data handling by the provider is subject to the Payment Card Industry Data Security Standard, and to the provider's own privacy policy, which you should read on its website.
• What we do receive and keep is limited to: the transaction reference, the date and amount, the currency, whether the payment succeeded or failed, the payment method type, and, for card payments, the last four digits and the card brand. We need these to reconcile your account, to issue receipts, to handle refunds, and to keep the accounting records the law requires.
• Where you pay by direct electronic funds transfer, we see the payment reference and the account name that appears on our bank statement.
• We do not store banking details for recurring debit unless you have set that up with us in writing and separately.

Cookies and website analytics

A cookie is a small text file that a website stores in your browser. We keep our use of them minimal.

What we use

• Strictly necessary storage. Used to keep the site working, for example remembering that you have dismissed a notice, or holding state while you use an interactive demo. These are set in your own browser and are not shared with us.
• Preference storage. Used to remember choices you make, such as a display preference. These stay on your device.
• Analytics. Where we run analytics, we configure it to report aggregated and pseudonymised usage so that we can see which pages are useful and where people get stuck. We do not use it to identify you personally.

Third party content

• We load web fonts from Google Fonts. Your browser contacts Google's servers to fetch them, and Google may log your IP address as part of serving that request, under Google's own privacy policy.
• Our pages may embed or link to third party platforms. Those platforms set their own cookies under their own policies, and section 19 applies.

How to control cookies

You can block or delete cookies through your browser settings, and you can browse in a private or incognito window. Every major browser explains how in its help pages. Blocking strictly necessary storage may stop parts of the site, particularly the interactive demos, from working properly.

We do not use cookies for cross site behavioural advertising, and we do not sell the data our website collects.

Who we share personal information with

We do not sell, rent, or trade personal information. We share it only in the circumstances below, and only to the extent needed.

• Service providers and operators. Organisations that help us run the business, including our hosting provider, email provider, payment service provider, accounting software provider, and cloud platform providers. They may process personal information only on our instructions and must protect it.
• Subcontractors. Specialists we bring onto an engagement. They are bound by confidentiality obligations equivalent to our own.
• Professional advisers. Our accountants, auditors, insurers, and lawyers, where they need it to advise us.
• Regulators and law enforcement. Where we are legally required to disclose, or where disclosure is necessary to establish, exercise, or defend a legal claim.
• A successor in title. If the business or part of it is sold or restructured, in which case the acquirer must continue to protect the information in line with this policy.
• With your consent. Where you have asked or agreed that we share it.

Where a service provider acts as an operator under POPIA, we put a written agreement in place requiring them to process personal information only on our instruction, to keep it confidential, and to apply appropriate security safeguards.

Cross border transfers

Some of the service providers we use store data outside South Africa, for example in a European Union or United States data centre. Section 72 of POPIA allows a transfer outside the Republic in defined circumstances.

• We transfer personal information across a border only where the recipient is subject to a law, a binding corporate rule, or a binding agreement that provides an adequate level of protection, or where the transfer is necessary to perform our contract with you, or where you have consented.
• Where we can choose, we prefer providers that offer a South African or regional data residency option.
• We will tell you, on request, which country a particular category of your information is stored in.

How we secure personal information

Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information through appropriate, reasonable technical and organisational measures. The measures we apply include the following.

• Encryption of data in transit using Transport Layer Security across our website and our business systems.
• Access control on the principle of least privilege, so that team members can reach only what their role requires.
• Multi factor authentication on business email, cloud platforms, and administrative accounts.
• Strong, unique credentials held in a password manager, and never shared over an unsecured channel.
• Regular patching and updating of the systems we operate.
• Backups of business records, with restoration tested periodically.
• Confidentiality obligations in every employment and subcontractor arrangement.
• A practice of collecting the minimum information needed, and deleting it when the purpose has been served.

No system can be guaranteed completely secure. We keep our measures under review and update them as risks and technology change. If you believe your interaction with us is no longer secure, please tell us immediately.

How long we keep personal information

We keep personal information only for as long as we need it for the purpose we collected it for, or for as long as the law requires.

When a retention period ends, we securely delete or permanently de-identify the information. Where deletion is not immediately possible, for example in a backup, we isolate it and delete it on the normal backup cycle.

Personal information we process for our clients

When we build a website, an AI system, an intranet, or a dashboard for a client, we may process personal information that belongs to that client's own customers, staff, or contacts.

• In that situation the client is the responsible party under POPIA and we act as an operator.
• We process that information only on the client's documented instructions, and only for the purposes of the engagement.
• We apply the security safeguards described in section 11, and we keep it confidential.
• We do not use it for our own purposes, we do not sell it, and we do not use it to train any model of our own.
• We notify the client without undue delay if we become aware of a compromise, so that they can meet their own obligations under section 22 of POPIA.
• On termination we return or delete it on the client's written instruction, subject to any legal retention obligation.

If you are the customer of one of our clients and you have a query about your information, please contact that organisation directly, since they decide how it is used. We will support them in responding to you.

AI systems and your data

• We do not use your personal information, your enquiry, or your project content to train a publicly available AI model.
• Where we build an AI system grounded on a client's own data, that data is used only for that client's system, in that client's environment.
• Where an engagement uses a third party AI model provider, we tell the client which provider, and the provider's own data handling terms apply to the content sent to it. Wherever the provider offers it, we select the option that excludes the client's content from the provider's model training.
• The live voice demonstration on our website uses your browser's own built in speech recognition. The audio is handled by your browser or its vendor, not by us, and we do not receive or store it.

Your rights under POPIA

As a data subject you have the following rights. Exercising them is free, except that we may charge the prescribed fee for a copy of records where PAIA allows it.

The right to be told

To know whether we hold personal information about you, and to be notified where your information has been accessed by an unauthorised person.

The right of access

To ask for a copy of the personal information we hold about you, and to be told what it is used for and who it has been shared with. This is given effect through section 23 of POPIA and through PAIA.

The right to correction

To ask us to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, under section 24 of POPIA.

The right to deletion

To ask us to delete or destroy information we are no longer authorised to keep.

The right to object

To object, on reasonable grounds, to our processing of your information where we rely on legitimate interest, and to object at any time to direct marketing.

The right to withdraw consent

To withdraw consent at any time where our processing is based on it. Withdrawal does not affect processing that already took place lawfully.

The right not to be subject to automated decision making

Not to be subject to a decision based solely on automated processing that has a legal effect on you or affects you substantially, as set out in section 71 of POPIA. We do not make decisions about you in that way.

The right to complain

To lodge a complaint with the Information Regulator, and to take civil proceedings about an alleged breach. See section 22.

How to exercise your rights

1. Email our Information Officer at info@omnatix.co.za with the subject line "POPIA request".
2. Tell us which right you want to exercise, and give us enough detail to find your information, for example the email address or company name you dealt with us under.
3. We may ask you to verify your identity before we act, so that we do not disclose your information to the wrong person.
4. We acknowledge every request within 2 business days.
5. We respond substantively within 30 calendar days. If the request is complex and we need longer, we will tell you within that period, explain why, and give you a revised date.
6. Access and correction requests may be made on the prescribed form under the POPIA regulations. We will send you the form on request, and we will not refuse a request simply because it was not made on the form.

If we cannot give effect to a request, we will tell you why in writing, and we will tell you how to take the matter further.

Security compromises

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to act. We will:

• Notify the Information Regulator as soon as reasonably possible after discovering the compromise.
• Notify you as soon as reasonably possible, unless the identity of affected data subjects cannot be established, or a law enforcement or regulatory body has asked us to delay so that an investigation is not prejudiced.
• Tell you what happened, what information was involved, what the likely consequences are, what we have done about it, and what you can do to protect yourself.
• Take immediate steps to contain the compromise, restore the integrity of our systems, and prevent a recurrence.

Children's information

Our services are directed at businesses and organisations, not at children. We do not knowingly collect personal information from a child under the age of 18 without the consent of a competent person, as POPIA requires. If you believe we have collected a child's information without that consent, contact our Information Officer and we will delete it promptly.

Third party links and platforms

Our website links to other websites, including client sites we have built, professional network profiles, and platform documentation. We are not responsible for the privacy practices or the content of those sites. This policy applies only to our own website. Please read the privacy policy of any site you visit through a link from ours.

Marketing communications

• We send marketing by email only where you have asked for it, or where you are an existing client and the message relates to services similar to those we have already provided to you.
• Section 69 of POPIA restricts unsolicited electronic direct marketing. We comply with it.
• Every marketing email carries a working unsubscribe link. One click is enough, and we do not ask you to give a reason.
• You may also object at any time by emailing info@omnatix.co.za.
• We action an unsubscribe or objection within 5 business days, and we keep a minimal suppression record so that we do not add you back by mistake.
• Opting out of marketing does not stop service messages about work in progress, invoices, or security notices, which we must be able to send you.

Changes to this policy

• We may update this policy to reflect a change in our practices, our service providers, or the law.
• The current version is always published at omnatix.co.za/privacy.html, with the effective date and version number at the top.
• Where a change materially affects how we use your personal information, we will bring it to your attention directly, by email or by a notice on the website, before it takes effect.
• Please check this page from time to time so that you stay informed.

Complaints

If you are unhappy with how we have handled your personal information, please raise it with our Information Officer first. We will acknowledge within 2 business days and aim to resolve it within 10 business days.

You also have the right to complain to the Information Regulator at any time.

Please confirm the Regulator's current contact details on its website before submitting, since they are updated from time to time.

Contact us

For any question about this Privacy Policy, about the personal information we hold, or to exercise any of your rights, please contact us.