Privacy Notice

1. Who we are

Commtac Consult Ltd ("Commtac Consult", "we", "us") operates the POPIA compliance assessment platform. For personal information collected through the platform about account holders and website visitors, Commtac Consult Ltd is the responsible party / data controller and decides how and why that information is processed.

Where you upload information about your own clients, employees or data subjects as assessment evidence, you remain the responsible party for that information and we process it as an operator/processor on your instructions.

2. Information we collect and why

• Account details (name, email address, password credentials, assigned role) — to create and secure your account, authenticate you and apply access permissions. Legal basis: performance of our contract with you.
• Client and assessment data (company name, contact person, data protection officer name, office locations, staff size, assessment answers, notes, uploaded evidence files) — to provide the assessment, scoring, reporting and certification features. Legal basis: performance of contract.
• Assistant conversations (questions you type or speak to the "Ask Me" assistant, and voice recordings submitted for transcription) — to generate answers and maintain your conversation history. Legal basis: performance of contract.
• Support and correspondence (messages you send us) — to respond to you. Legal basis: legitimate interests in supporting our users.
• Technical and usage data (IP address, device and browser information, log and authentication events, error diagnostics) — for security, fraud prevention, troubleshooting and improving the platform. Legal basis: legitimate interests in operating a secure, reliable service.

Payment card details are collected and processed by Paddle, our Merchant of Record. We never receive or store your full card details.

3. Who we share information with

• Service providers / subprocessors — cloud hosting and database providers, email delivery providers, AI model providers (for assistant responses) and speech/transcription providers, acting on our instructions.
• Merchant of Record — Paddle, for the sale of our products, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where required by law, regulation or legal process.

We do not sell your personal information.

4. International transfers

Our providers may process data outside your country. Where information leaves the UK/EEA or South Africa, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

5. Retention

We keep account, assessment and evidence data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting and dispute-resolution obligations. Assistant conversation history and technical logs are kept for a shorter operational period. When information is no longer needed, we delete or anonymise it. You may request deletion of your account and associated data at any time.

6. Your rights

Subject to applicable law (including POPIA and, where relevant, the UK/EU GDPR), you have the right to access your personal information, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent where processing is based on consent. You may also lodge a complaint with the Information Regulator (South Africa) or your local supervisory authority. Contact us at info@commtac.co — we aim to respond within one month.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, role-based access controls, row-level database access restrictions and access logging. No system can be guaranteed completely secure, but we work to protect your information and to notify you and the relevant authority of any qualifying breach.

8. Cookies

We use essential cookies and similar browser storage to keep you signed in and to maintain session security. These are required for the platform to function. If we introduce analytics or marketing cookies, we will ask for your consent first and provide a way to manage your preferences.

9. Contact

Commtac Consult Ltd — info@commtac.co.