Haibot Privacy Policy

Introduction

Haibot ("Haibot," "we," "us," or "our") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website www.haibot.co.za (the "Website"), subscribe to our newsletter, complete a maturity assessment or business evaluation submission, or otherwise interact with us.

This Policy is issued in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and other applicable South African law. By using our Website or providing us with your personal information, you acknowledge that you have read and understood this Policy.

Responsible party: Haibot (Pty) Ltd (registration number 2019/002792/07), a company registered in South Africa, with its registered address at 25 Superior Road, Midrand, Gauteng, South Africa, 1685 ("Haibot", the "Company").

Scope of this Policy

This Policy applies to personal information we collect and process: when you browse our Website; when you subscribe to our newsletter or marketing communications; when you complete a maturity assessment, business evaluation, questionnaire, or any similar submission on our Website; when you contact us, request information, or engage our services; and when we otherwise lawfully obtain your personal information in connection with our business.

This Policy does not apply to the practices of third parties that we do not own or control, including any third-party websites, services, or applications that you may access through links on our Website.

What Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

3.1 Newsletter and marketing communications — Name, email address, and (where provided) job title, company name, and any preferences you indicate when you subscribe to our newsletter or mailing list.

3.2 Maturity assessment and business evaluation submissions — When you complete a maturity assessment, self-evaluation tool, or similar business evaluation submission, we may collect: your name, email address, telephone number, job title, company name, industry, company size, and the business, operational, technological, or strategic information you voluntarily provide as part of the assessment (for example, answers to evaluation questions about your organisation's processes, systems, or maturity level). We use this information to generate your results, provide recommendations, and where relevant, follow up with you regarding our services.

3.3 General website and contact information — When you browse our Website or contact us, we may automatically or directly collect: your IP address, browser type and version, device information, pages visited, referring website, date and time of visits, and any information you submit through a contact form (such as your name, email address, phone number, and the content of your message).

3.4 Information from third parties — We may supplement the information above with information obtained from publicly available sources or business partners, strictly for the purposes described in this Policy.

We do not intentionally collect special personal information (as defined in POPIA, e.g. health, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, sexual life, biometric information, or criminal behaviour) through the Website. Please do not submit such information to us unless specifically and lawfully requested.

How and Why We Use Your Personal Information

We process your personal information for the following purposes, on the following legal grounds under POPIA:

• Sending our newsletter and marketing communications — using your name and email address — based on your consent (POPIA s11(1)(a); direct marketing under POPIA s69 and ECTA).
• Processing and responding to maturity assessment / business evaluation submissions — using your contact details and the business/operational information provided — based on your consent and/or necessary steps prior to entering into a contract (POPIA s11(1)(a)/(b)).
• Providing follow-up advice, proposals, or consultations relating to your assessment results — using your contact details and assessment results — based on your consent and our legitimate business interest in responding to your enquiry.
• Operating, maintaining, and improving our Website — using technical/usage data (IP address, browser, device, analytics) — based on our legitimate interest in running and securing our Website.
• Responding to general enquiries submitted via contact forms — using your name, email, phone number, and message content — necessary to take steps at your request; legitimate interest.
• Complying with legal, regulatory, tax, or accounting obligations — using relevant records — to comply with a legal obligation (POPIA s11(1)(c)).
• Protecting our legal rights, preventing fraud, and enforcing our terms — using relevant records — legitimate interest; legal obligation.

We will not use your personal information for any purpose materially different from, or incompatible with, the purpose for which it was originally collected, without obtaining your further consent where required.

How We Handle Your Information (POPIA Conditions for Lawful Processing)

In line with POPIA's eight conditions for lawful processing, Haibot commits to the following:

1. Accountability – We are responsible for ensuring the conditions in this section, and POPIA generally, are complied with in respect of all personal information we process.
2. Processing limitation – We only process personal information lawfully, in a reasonable manner that does not infringe your privacy, and only to the minimum extent necessary for the purposes described in this Policy. Where required, we obtain your consent before processing.
3. Purpose specification – We collect personal information for specific, explicitly defined, and lawful purposes related to our business activities, as set out in section 4 above.
4. Further processing limitation – Any further processing of your personal information will be compatible with the original purpose of collection, unless you consent otherwise or further processing is otherwise permitted by POPIA.
5. Information quality – We take reasonably practicable steps to ensure personal information we hold is complete, accurate, not misleading, and updated where necessary.
6. Openness – This Policy, along with any specific notices provided at the point of collection, sets out how and why we process your information.
7. Security safeguards – We implement appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, and unlawful access or processing (see section 9 below).
8. Data subject participation – You may request confirmation of, access to, and correction or deletion of your personal information, subject to POPIA (see section 10 below).

Newsletters and Direct Marketing

We will only send you newsletters or direct marketing communications by email or other electronic means if you have given your consent (opt-in), in accordance with section 69 of POPIA and the ECTA, or where you are an existing customer and we are marketing similar products or services to those you have already engaged us for. Every marketing communication we send will clearly identify Haibot as the sender, and provide you with a simple, free way to opt out of receiving further communications (for example, an "unsubscribe" link or a reply-to address).

You may withdraw your consent or unsubscribe at any time, free of charge, without affecting the lawfulness of processing carried out before your withdrawal. To unsubscribe, click the "unsubscribe" link in any newsletter email, or contact us using the details in section 14.

Sharing and Disclosure of Your Personal Information

We do not sell your personal information. We may share your personal information with:

7.1 Service providers and operators. We use Bitrix24 as our customer relationship management (CRM) platform to store and manage newsletter subscriptions, maturity assessment submissions, and general enquiries. Bitrix24 acts as an "operator" on our behalf as defined in POPIA and processes personal information only in accordance with our instructions and for the purposes described in this Policy, under a written agreement that requires it to maintain appropriate confidentiality and security measures.

7.2 Other professional advisors and service providers. We may share information with our auditors, legal advisors, IT service providers, hosting providers, and similar parties who provide services to us, strictly on a need-to-know basis and under confidentiality obligations.

7.3 Legal and regulatory disclosures. We may disclose personal information where required by law, in response to a valid request by a public authority, or to establish, exercise, or defend our legal rights.

7.4 Business transfers. If Haibot is involved in a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to appropriate confidentiality safeguards and in accordance with POPIA.

We require any third party we share personal information with to provide a level of protection at least equivalent to that required by POPIA.

Cross-Border Transfer of Personal Information

Some of the third-party service providers we use, including Bitrix24 and other cloud-based hosting, storage, or software tools, may store or process personal information on servers located outside South Africa (including, potentially, within the European Union, the United States, or other jurisdictions in which such providers operate). Where we transfer personal information across South Africa's borders, we do so in accordance with section 72 of POPIA. We take reasonable steps to ensure that: the recipient of the information is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to the conditions for lawful processing under POPIA and effectively upholds equivalent principles for the further processing of personal information; or you have consented to the transfer; or the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request; or the transfer is otherwise necessary or beneficial to you and it is not reasonably practicable to obtain your consent, and you would likely give consent if asked.

Where required, we enter into appropriate data processing and transfer agreements with our service providers to ensure your personal information continues to be protected wherever it is processed.

Security Safeguards

We take the security of your personal information seriously and have implemented reasonable technical and organisational measures designed to protect personal information against loss, unauthorised access, interference, modification, destruction, or disclosure, including (as applicable): restricting access to personal information to employees and service providers who need it to perform their duties; using secure, reputable third-party platforms (including Bitrix24) with appropriate security certifications and safeguards; using encryption, secure connections (such as HTTPS), and access controls where appropriate; and regularly reviewing our data handling and security practices. No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. In the event of a security compromise that has, or is reasonably likely to, result in unauthorised access to your personal information, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

Your Rights as a Data Subject

Subject to POPIA, you have the right to: access the personal information we hold about you, and request a description of the information, the purposes for which it is used, and the identity of any third parties to whom it has been disclosed; request correction, updating, or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully; object, on reasonable grounds, to the processing of your personal information, including for direct marketing purposes; withdraw your consent to processing at any time, where processing is based on consent (this will not affect the lawfulness of processing before withdrawal); request that we not process your personal information for purposes of direct marketing; submit a complaint to Haibot's Information Officer or, if unresolved, to the Information Regulator (see section 12 below) regarding the alleged interference with the protection of your personal information; and institute civil proceedings for damages in respect of any breach of POPIA's provisions. To exercise any of these rights, please contact us using the details in section 14. We may need to verify your identity before actioning any request, and we will respond within a reasonable timeframe in accordance with POPIA.

Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including for the purpose of satisfying any legal, accounting, regulatory, or reporting requirements. As a general guide: newsletter subscriber data is retained until you unsubscribe or withdraw consent, or for as long as your subscription remains active; maturity assessment / business evaluation submissions are retained for as long as reasonably necessary to provide you with results, follow-up services, and for a reasonable period thereafter for record-keeping and legitimate business purposes, unless you request earlier deletion; and general enquiry and contact form data is retained for as long as necessary to address your enquiry and for a reasonable period thereafter. Once personal information is no longer needed for these purposes, we will securely delete, destroy, or anonymise it, in accordance with POPIA's record-keeping conditions.

Information Officer and Complaints

Information Officer. Haibot's designated Information Officer is responsible for ensuring compliance with POPIA and for responding to your requests and queries regarding your personal information. Haibot's Information Officer has not yet been formally registered with the Information Regulator. Registration is a requirement under POPIA and Haibot is in the process of finalising and registering its Information Officer. In the interim, all POPIA-related queries, requests, and complaints should be directed to the contact details in section 14 below, and this section will be updated with the Information Officer's registered details once registration is complete. Complaints to the Information Regulator. If you are not satisfied with how we have handled your personal information, or with our response to a request or complaint, you have the right to lodge a complaint with the Information Regulator of South Africa: Information Regulator (South Africa)
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
General enquiries: enquiries@inforegulator.org.za | Tel: 010 023 5200 | Toll-free: 0800 017 160
POPIA complaints: POPIAComplaints@inforegulator.org.za
Website: www.inforegulator.org.za

Cookies and Similar Technologies

Our Website may use cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and understand where our visitors come from. Cookies are small text files stored on your device. You can control or disable cookies through your browser settings; however, doing so may affect the functionality of our Website. [If Haibot uses Google Analytics or other analytics/tracking tools, this section should be expanded to name the specific tool(s), the categories of data collected, and, if applicable, how consent is obtained via a cookie banner.]

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us at:
Email: connect@haibot.co.za
Physical/postal address: 25 Superior Road, Midrand, Gauteng, South Africa, 1685
Telephone: +27 10 142 6582

Children's Privacy

Our Website and services are not directed at children under the age of 18, and we do not knowingly collect personal information from children without the consent of a competent person (such as a parent or legal guardian), as required under POPIA. If we become aware that we have inadvertently collected personal information from a child without appropriate consent, we will take reasonable steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy on our Website with a revised "Last updated" date. We encourage you to review this Policy periodically. Where changes are material, we will take reasonable steps to notify you (for example, via email or a notice on our Website).

Governing Law

This Policy is governed by the laws of the Republic of South Africa, including POPIA and ECTA.

Effective date: 27 August 2026
Last updated: 27 August 2026