AgenticSA Privacy & POPIA Notice

The purpose of this Notice is to explain:

• what personal information we collect;
• why we collect it;
• how we use it;
• when information may be shared with service providers;
• how AI technology may process information;
• how international processing may occur;
• how we protect information;
• how long information may be retained;
• your choices and rights relating to your personal information; and
• how to contact us regarding privacy concerns.

Depending on how you interact with AgenticSA, we may collect information including:

Identity and Contact Information

This may include:

• first and last name;
• business name;
• job title;
• email address;
• telephone or mobile number;
• WhatsApp number;
• physical or business address; and
• other contact information you voluntarily provide.

Business Information

When registering for or configuring an AI Agent, we may collect information about:

• your business;
• industry;
• services and offers;
• business processes;
• frequently asked questions;
• operating hours;
• customer journey;
• sales processes;
• appointment processes;
• communication preferences;
• business policies; and
• information required to configure and train your AI Agent.

Account and Subscription Information

We may process:

• account identifiers;
• subscription plan;
• trial status;
• billing status;
• transaction information;
• service usage;
• activation and cancellation information; and
• communications relating to your account.

Payment transactions may be processed through third-party payment providers such as PayFast.

We do not necessarily receive or store complete payment-card details ourselves. Payment information may be collected and processed directly by the relevant payment service provider according to its own security and privacy practices.

Communications

We may collect and retain information from communications conducted through:

• email;
• SMS;
• WhatsApp;
• website chat;
• AI chatbot conversations;
• telephone calls;
• AI Voice interactions;
• support requests;
• forms;
• surveys; and
• other communications with AgenticSA or Creative Media Agency.

Where calls are recorded or AI-generated communications are used, appropriate disclosures, notices or consent mechanisms should be implemented where required.

Technical and Usage Information

Our website and technology platforms may automatically collect information including:

• IP address;
• browser type;
• device information;
• website activity;
• pages visited;
• referring source;
• approximate location derived from technical information;
• cookies and similar technologies;
• system activity;
• login information; and
• platform usage information.

We may process personal information for purposes including:

• responding to enquiries;
• providing requested information;
• creating and managing accounts;
• providing free trials;
• configuring AI Agents;
• training AI Agents on customer-provided business information;
• providing AgenticSA services;
• processing subscriptions and payments;
• providing customer support;
• managing appointments;
• communicating service information;
• providing transactional notifications;
• maintaining customer relationships;
• improving our services;
• maintaining security;
• detecting misuse or fraud;
• maintaining business records;
• complying with legal obligations;
• sending marketing communications where permitted;
• administering consent and communication preferences; and
• operating, analysing and improving our websites and services.

We aim to collect and process personal information only where reasonably necessary for legitimate and lawful business purposes.

AgenticSA provides AI-powered business communication and automation functionality.

Depending on the service selected, this may include:

• SMS and WhatsApp AI Agents;
• Email AI Agents;
• AI Voice Agents; and
• combined AI Front Desk functionality.

AI systems may process information supplied by a customer, prospect, website visitor or other individual in order to understand an enquiry, generate a response, perform a configured action, route information, schedule appointments, update business systems or assist with another configured workflow.

Important AI Disclosure

When you interact with an AgenticSA-powered AI Agent, you may be interacting with artificial intelligence rather than a human.

AI-generated responses may occasionally be inaccurate, incomplete or inappropriate for a particular situation.

AI output should not be relied upon as a substitute for qualified professional advice or human judgement where such judgement is reasonably required.

This distinction is important.

When a business uses AgenticSA to communicate with its own customers, prospects, employees or other contacts, that business generally determines why the information is collected and how the Agent should use it.

In those circumstances:

Customers using AgenticSA are responsible for determining whether they have an appropriate lawful basis, consent, notice or other authority required to process their contacts' personal information and communicate with those contacts.

This includes responsibility for complying with applicable requirements relating to:

• direct marketing;
• email;
• SMS;
• WhatsApp;
• telephone communications;
• automated communications;
• AI Voice calls;
• call recording;
• consent;
• opt-outs;
• data retention; and
• sensitive or regulated information.

Our Data Processing Addendum provides additional terms relating to processing performed on behalf of AgenticSA customers.

Customers configuring AgenticSA must not deliberately mislead individuals into believing that an AI Agent is a human where disclosure is required or appropriate.

AI Voice and chatbot interactions should contain appropriate disclosure that the individual is interacting with an AI-powered system.

Customers should maintain appropriate human oversight over their AI Agents.

Where a conversation requires professional judgement, sensitive decision-making, complex dispute resolution, emergency assistance or another matter unsuitable for automated handling, the AI Agent should be configured to escalate the interaction appropriately.

AgenticSA is designed primarily to support business communications, customer engagement and workflow automation.

AI-generated output should not be used as unreviewed professional:

• legal advice;
• financial advice;
• tax advice;
• medical advice; or
• other regulated professional advice.

Businesses operating in regulated industries or processing sensitive personal information should assess their particular legal, professional, security and regulatory obligations before configuring AI workflows involving such information.

We may share or make personal information available to third-party service providers where reasonably necessary to operate AgenticSA.

These may include providers supporting:

• cloud hosting;
• CRM systems;
• telecommunications;
• email;
• SMS;
• WhatsApp communications;
• artificial intelligence;
• voice technology;
• payment processing;
• analytics;
• security;
• customer support;
• automation; and
• other technical infrastructure.

These providers may process information on our behalf or as part of providing their services.

Where appropriate, contractual and security measures are used to help govern such processing.

AgenticSA uses cloud-based technology and third-party service providers.

As a result, personal information may be processed, transmitted or stored outside South Africa.

We do not represent that all AgenticSA data is exclusively stored within South Africa.

Where personal information is transferred internationally, we take reasonable steps appropriate to our role to use service providers and contractual arrangements intended to support lawful and secure processing.

Customers should consider international processing when assessing their own regulatory and data-protection obligations.

We take reasonable technical and organisational measures intended to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

AgenticSA uses underlying technology infrastructure that includes security measures such as encryption, access controls, authentication and logging capabilities.

However, no electronic system, cloud platform or transmission method can be guaranteed to be completely secure.

Customers are also responsible for protecting:

• their account credentials;
• authorised-user access;
• devices;
• passwords;
• integration credentials;
• API keys; and
• other systems connected to AgenticSA.

Where permitted by applicable law, we may communicate with prospects and customers regarding:

• AgenticSA;
• Creative Media Agency;
• CMART™;
• related services;
• product updates;
• educational content;
• business automation;
• AI solutions; and
• relevant offers.

Recipients may opt out of eligible marketing communications using the unsubscribe or opt-out mechanism provided or by contacting us.

Opting out of marketing does not necessarily prevent us from sending essential transactional, account, security, billing or service communications where permitted.

AgenticSA customers are responsible for ensuring that contacts entered into automated communication workflows may lawfully receive those communications.

This applies to:

• SMS;
• WhatsApp;
• email;
• automated telephone calls;
• AI Voice calls; and
• other automated outreach.

Customers must honour applicable opt-outs, consent withdrawals and communication preferences.

AgenticSA technology must not be used to circumvent applicable direct-marketing, anti-spam, privacy or telecommunications requirements.

AgenticSA may provide inbound and outbound AI Voice functionality.

Where applicable, individuals should be informed that they are interacting with an AI-powered voice system.

Customers using outbound AI calling are responsible for ensuring that they have the appropriate authority or consent required before contacting an individual.

Where call recording is enabled, customers are responsible for ensuring that appropriate notices, disclosures and consent mechanisms are implemented where required.

Our website may use cookies and similar technologies to:

• operate the website;
• remember preferences;
• understand website usage;
• measure marketing performance;
• improve services; and
• support advertising or remarketing where implemented.

Further information may be provided in our Cookie Policy.

Where consent is required for particular cookies or tracking technologies, appropriate consent controls should be provided.

We retain personal information only for as long as reasonably necessary for:

• providing services;
• maintaining customer accounts;
• fulfilling contractual obligations;
• maintaining required business and financial records;
• resolving disputes;
• enforcing agreements;
• complying with legal obligations; and
• legitimate business purposes.

Retention periods may differ depending on the nature of the information and the reason it was collected.

Information may be deleted, anonymised or securely retained when it is no longer actively required, subject to applicable legal and operational requirements.

Subject to applicable law, individuals may have rights relating to their personal information, including the right to:

• request information about personal information held about them;
• request access to personal information;
• request correction of inaccurate or outdated information;
• request deletion or destruction where legally appropriate;
• object to certain processing;
• withdraw consent where processing depends on consent;
• object to eligible direct marketing; and
• lodge a complaint with the appropriate regulatory authority.

Certain rights may be subject to legal exceptions, identity verification or record-retention obligations.

Privacy-related requests may be submitted to:

We may request reasonable information to verify the identity and authority of the person making the request before disclosing or modifying personal information.

Individuals may also have the right to lodge a complaint with South Africa's Information Regulator regarding the processing of personal information.

Current contact information for the Information Regulator should be obtained directly from the Information Regulator's official channels.

AgenticSA services are intended primarily for businesses and authorised adult users.

Our services are not intentionally designed to collect personal information directly from children without appropriate authorisation.

Customers whose services involve children or minors are responsible for establishing appropriate safeguards, consent mechanisms and legal authority before configuring AgenticSA to process such information.

AgenticSA may integrate with third-party platforms, websites, applications and communication services.

Those third parties may have their own privacy policies, security practices and terms.

We encourage customers to review the terms and privacy practices of third-party services they choose to connect to AgenticSA.

We may update this Privacy & POPIA Notice from time to time to reflect:

• changes to our services;
• technology changes;
• regulatory developments;
• changes to service providers; or
• improvements to our privacy practices.

The updated version will display a revised "Last Updated" date.

Material changes may also be communicated through reasonable additional means where appropriate.

Questions regarding this Privacy & POPIA Notice or our handling of personal information may be directed to: