POPIA Notice

Last updated 28 September 2026

This notice covers the Protection of Personal Information Act 4 of 2013 ("POPIA"). It sits alongside our Privacy Policy, which covers UK and EU data protection law. Where the two overlap, whichever gives you the stronger protection applies.

1. Why POPIA applies to us

Redplumm International Limited is registered in England and Wales, and we maintain a remote office in Johannesburg, South Africa. Where personal information is processed in South Africa, or relates to people in South Africa, POPIA applies to that processing and we comply with it.

If you are a South African customer, or your staff or customers are in South Africa, this notice is the one that governs how we handle their personal information.

2. Responsible party and Information Officer

Where we process information on behalf of a customer, they are the responsible party and we act as an operator under section 1 of POPIA. In that role we process only on their documented instructions and under a written agreement, as section 20 requires.

3. What we process, and why

The categories are the same as those in our Privacy Policy, and we do not process a different set of information for South African data subjects:

• Customer account information — name, email address, company, password (stored hashed), sign-in records, subscription status.
• Information you put into our systems — whatever your forms collect, including photographs, signatures, locations and timestamps.
• Call information, if you use the AI Receptionist — audio, transcripts and summaries of calls your customers make to you.

We do not knowingly process special personal information as defined in section 26 of POPIA — religious beliefs, race, political persuasion, health, biometrics, criminal behaviour or trade union membership. If your intended use would involve any of these, tell us before you begin, because it changes what safeguards are required and may need the Regulator's authorisation.

We do not process the personal information of children under section 34 without the consent of a competent person. Our services are not designed for or directed at children.

4. Our lawful basis

Under section 11 we process personal information because it is necessary to carry out the contract we have with you, because it is necessary for our legitimate interests or those of our customers, and in some cases because the law requires it. Where we rely on consent, you may withdraw it at any time.

5. The eight conditions for lawful processing

POPIA sets out eight conditions. Here is how we meet each of them, in practice rather than in principle:

Under section 22, if personal information under our control is accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after becoming aware of it.

6. Sending information outside South Africa

Our servers and several of our suppliers are outside South Africa. Section 72 permits this where the recipient is subject to a law, binding agreement or code providing an adequate level of protection.

We rely on binding written agreements with each supplier imposing obligations substantially similar to POPIA's conditions, and on the UK and EU data protection regimes that our principal providers are already subject to. Our suppliers are listed in full in our Privacy Policy.

7. Your rights under POPIA

Under sections 23 to 25 you have the right to:

• Ask whether we hold personal information about you, and to be given a description of it
• Request a copy of that information
• Request correction, destruction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
• Object to processing on reasonable grounds
• Object to direct marketing, which we do not carry out by automated means
• Not be subject to a decision based solely on automated processing that significantly affects you

Ask at privacy@redplumm.com. We do not charge for this, and we will respond within a reasonable period and in any event within 30 days.

8. Access to information (PAIA)

We maintain a manual under section 51 of the Promotion of Access to Information Act 2 of 2000. Request a copy at privacy@redplumm.com and we will send it without charge.

9. Complaining to the Regulator

If you are unhappy with how we have handled your personal information, please tell us first so we have a chance to put it right. You also have the right to complain directly to the Information Regulator: