POPIA

Privacy Policy

Last updated 13 October 2026

1. Who we are and when this policy applies

This policy explains how Celerity Flows (Pty) Ltd collects, uses and protects personal information, as required by the Protection of Personal Information Act 4 of 2013 (POPIA).

We play two roles, and this policy covers both:

• Responsible party. We decide how personal information is used for our own business: our website visitors, enquirers, pilot applicants, clients and suppliers.
• Operator. We process personal information on behalf of the service businesses that use our platform. When you message a plumber, locksmith or other business that uses Celerity Flows, that business is the responsible party for your information, and we process it on their instructions.

2. Personal information we collect

We collect only what we need to provide our services. Most of it comes directly from you; some is generated when you use our website or a client's WhatsApp channel.

We do not knowingly collect special personal information or information about children. If a customer volunteers such information in a message, it is processed only to deal with their request.

3. Why we use it and our lawful basis

You may object to processing based on legitimate interests at any time (s11(3)). We will stop unless the law allows us to continue.

4. Our role as operator for client businesses

When we handle conversations, leads, workflows or business records for a client, the client decides why and how that information is used. We act only on their documented instructions.

• Each client signs an operator agreement with us before go-live, as sections 20 and 21 of POPIA require.
• We use their customers' information only to respond to, qualify, route, book and report on enquiries for that client. We never sell it or use it to market our own services.
• Each client's data is kept separate from every other client's.
• We tell the client without undue delay if we believe their customers' information has been accessed without authorisation.
• When the contract ends, we return or delete the client's customer data within 30 days, unless the law requires us to keep it.

If you are a customer of one of our clients and want to use your POPIA rights, contact that business first. You can also contact us and we will pass your request on.

5. Service providers and cross-border transfers

Our conversation inbox and automation platform run on our own servers, so client conversations stay on infrastructure we control. We use carefully chosen service providers for the rest of our service. Each processes personal information only to provide its service to us. A current list of providers is available from our Information Officer on request.

Some providers process information outside South Africa. Under section 72 of POPIA, we transfer personal information across borders only where the recipient is bound by law, binding corporate rules or an agreement giving adequate protection, or where the transfer is needed to perform a contract with you or in your interest. We choose providers that contractually commit not to use our clients' data to train their models.

6. Automated replies and AI

Our assistant replies to enquiries automatically, but a person at the service business makes every decision that matters to you.

• The assistant answers only from information the business has approved, such as services, areas and hours.
• It sorts enquiries as normal, urgent or outside the service area. This decides how quickly a person is alerted, not whether you get help.
• It does not approve or refuse work, set final prices or make decisions with legal or similar effect on you (POPIA s71).
• You can ask to speak to a person at any point in the conversation.

7. Direct marketing

We send marketing about Celerity Flows only to people who have agreed to receive it, or to existing clients about similar services, as section 69 of POPIA allows. Every marketing message includes a simple opt-out, such as replying STOP on WhatsApp or unsubscribing by email. We never use our clients' customers' details to market our own services.

8. Security, retention and breaches

We protect personal information with reasonable technical and organisational measures (POPIA s19): limited access with individual logins and two-factor authentication, encryption in transit, separation of each client's data, and regular review of our providers.

If we believe personal information has been accessed without authorisation, we will notify the Information Regulator and affected people as soon as reasonably possible (POPIA s22). Where we act as operator, we notify the client immediately.

9. Your rights and how to complain

Contact our Information Officer, Zizipho Ndlovu, at zizipho@celerityflows.com to:

• Access the information we hold about you (s23; formal requests follow our PAIA Manual).
• Correct or delete information that is inaccurate, out of date or no longer needed (s24).
• Object to processing based on legitimate interests, or to direct marketing (s11(3)).
• Withdraw consent where we rely on it.

We respond within 30 days and may need to confirm your identity first. If you are not satisfied, you may complain to the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · POPIAComplaints@inforegulator.org.za · 010 023 5200 · inforegulator.org.za.

10. Cookies, analytics and changes

Essential cookies keep the site and forms working. Analytics cookies tell us which pages and campaigns bring visitors; we use them only with your consent where the law requires, and you can block them in your browser. We do not use advertising or retargeting cookies.

We may update this policy as our services or the law change. The date at the top shows the latest version, and we tell clients about material changes before they take effect.

Draft for review. This policy should be checked by a South African attorney before publication.