Privacy,in plainEnglish.

We are Auxo Digital (Pty) Ltd, a software and AI company based in Johannesburg, South Africa. We run this website (https://www.auxodigital.africa), build software for our clients, and operate our own products. For everything described in this notice, we are the responsible party under POPIA and the controller under the GDPR. In short: the buck stops with us.

When we build or run software for a client, the client usually decides what personal information goes into it. In that case the client is the responsible party, we act as its operator under a written agreement, and the client's own privacy notice applies to that information.

POPIA requires us to appoint an Information Officer, and we have. He is registered with the Information Regulator and is also your single point of contact for any GDPR data-subject request: one person, one address, no runaround.

Giving us personal information is voluntary, but if you hold back information we need, we may not be able to provide our services or products to you. Some information (such as tax and accounting records) we must keep by law.

Each of our products has a short privacy add-on. It adds the product's specifics (what it collects, why, which operators it uses, and how to delete your data) to this notice, which still covers who we are, your rights and how to complain.

A cookie is a small text file a website stores in your browser. When you first visit our website, you will be provided with a choice on how you'd like for us to manage your cookies; you may use this opportunity to select your preferences.

• Analytics cookies: Google Analytics 4 and PostHog (and Microsoft Clarity, if we switch it on). These load only after you click “Accept analytics”. If you click “Reject”, or make no choice, they are never loaded and set no cookies.
• Marketing cookies: the LinkedIn Insight Tag, which helps us show our ads to people who visited the site. If we switch it on, the banner gets a separate tick-box for it, and the tag loads only if you tick it.
• Always on: Cloudflare Turnstile on our forms (to stop bots), and Vercel Analytics, which uses no cookies.

You can change your mind at any time. Withdrawing consent removes our analytics cookies from your browser and reloads the page.

• No analytics or marketing cookies until you say yes, and none at all if you say no.
• We never sell or rent personal information. To anyone.
• Apart from SARS and others where the law requires it, and LinkedIn only if you accept marketing cookies, we do not share personal information with third parties who use it for their own purposes.
• No automated decision-making that has a legal or similarly significant effect on you.
• Our website and services are not directed at children, and we do not knowingly collect children’s information.
• The narration on some pages is a set of static sound files: playing it sends no personal data anywhere. (The chat assistant’s spoken replies are different; see “The AI chat” above.)

Under section 11 of POPIA, we process personal information with your consent (for example, analytics cookies, or WhatsApp messages you opt in to), where it is necessary to conclude or perform a contract with you (answering your enquiry, preparing a proposal, rendering services), where the law requires it (tax and accounting records), and where it serves our legitimate interests (keeping our systems secure and running) without overriding yours.

For people in the EU, EEA and UK, the matching GDPR bases are Article 6(1)(a) consent; Article 6(1)(b) contract, including steps taken at your request before entering into one; Article 6(1)(c) legal obligation; and Article 6(1)(f) legitimate interests, namely security, fault diagnosis and abuse prevention.

We share personal information only with our operators (processors under the GDPR): service providers who handle it on our instructions and nothing more. Each has a written contract with us, usually its data processing agreement. Apart from them, we share information with SARS, our external accountants and auditors where tax and accounting rules require it, with others only if the law compels us to, and, if you accept marketing cookies, with LinkedIn through its Insight Tag.

Our product databases sit in South Africa, but several operators process information outside South Africa (mainly in the United States and the European Union). Section 72 of POPIA applies to these transfers, even to an operator. We transfer personal information outside South Africa only where the recipient is bound by a law, binding corporate rules or a binding agreement that gives it a level of protection substantially similar to POPIA, including rules on passing it on to other countries, or where another ground in section 72 applies. For GDPR purposes (Chapter V), we rely on the same agreements, which include the European Commission's Standard Contractual Clauses where required.

Contact-form submissions are kept for as long as we need them to deal with your enquiry and any business relationship that follows from it, and deleted when you ask us to. Server logs are short-lived and rotate on Vercel's standard retention schedule. Your preferences sit in your own browser until you clear them (see section 12).

Client and supplier records, such as contracts, invoices and accounting records, are kept for as long as the law requires: under tax and companies law, that is generally five to seven years. Product data is kept as described in each product's add-on.

Whether POPIA or the GDPR applies to you, your rights come down to the same set:

To exercise any of them, email our Information Officer at jabu@auxo.digital and tell us what you would like done. We may need to verify that you are who you say you are: that protects you, not us. We respond without undue delay, and within one month at the outside, free of charge in almost every case. To request access to other records we hold, see our PAIA manual.

The site remembers a few choices (your experience mode, your sound preference, whether you have already seen the entry gate, and your cookie choice) using localStorage and sessionStorage. These are notes your browser keeps to itself: they are not cookies, they are not sent to Auxo, and they contain nothing that identifies you.

To clear them, use your browser's settings to remove site data for auxodigital.africa (usually under Privacy, then “Cookies and site data”). The site will simply forget your choices, ask about cookies again, and greet you like a first-time visitor.

Section 19 of POPIA requires us to take appropriate, reasonable technical and organisational measures to protect personal information. We do both:

No system on earth is perfectly secure, but we treat your information the way we would want ours treated, and if a breach ever put you at risk we would notify you and the Information Regulator as POPIA (section 22) and the GDPR require.

Talk to us first: email jabu@auxo.digital and we will do our best to put it right. You also have the right to lodge a complaint directly with a regulator:

If you are in the EU or EEA, you can complain to the supervisory authority in your own country. The European Data Protection Board keeps the full list at edpb.europa.eu. In the UK, that authority is the Information Commissioner's Office at ico.org.uk.

Our PAIA manual, prepared under the Promotion of Access to Information Act, 2000, lists the records we hold, explains how to request access to them, and gives more detail on how we process personal information. It also links the request forms.

If we change how we handle personal information, we will update this page and the effective date below. No silent edits, no surprise clauses. Meaningful changes to what we collect will be flagged clearly on this page.

Effective date: 15 October 2026