Privacy? Absolutely.

Synrgy Hub (Pty) Ltd is the responsible party for the personal information we collect and process.

For the purposes of the Protection of Personal Information Act, 2013 (“POPIA”), Synrgy Hub (Pty) Ltd acts as the “Responsible Party”.

There’s one exception worth knowing. When we deliver services for a client and their data passes through our hands, that client is the responsible party and we act as their operator, processing the information only on their instructions. Our Terms and Conditions set out how that works. Everywhere else, including enquiries, marketing, website visits and our own client relationships, we are the responsible party.

POPIA also requires someone specific to be accountable for how we handle your personal information. That’s our Information Officer, and at Synrgy the role sits with the head of the company. You can reach them on the details below, marked for the Information Officer.

If you ever have questions about your data, your rights, or how we handle information, you can contact us directly:

We’re not hiding behind a ticketing wall. Just email us.

Information You Share With Us

When you:

• Fill in a form
• Send us an email
• Request a quote
• Sign up for a service
• Work with us on a project

You may provide:

• Your name
• Company details
• Email address
• Phone number
• Physical or billing address
• Payment information
• Project or business information
• Any information included in your communication

If you choose to share it, we treat it carefully.

Information Collected Automatically

When you visit our website, certain technical information may be collected automatically, such as:

• IP address
• Device and browser type
• Pages visited
• Time spent on the site
• Referring source

This helps us:

• Improve performance
• Monitor security
• Understand user behaviour
• Optimise the experience

This information is typically aggregated and does not directly identify you. Where it can be linked to an identifiable individual, it will be treated as personal information in accordance with POPIA.

We only process personal information for clear, lawful purposes related to running and growing Synrgy. These include:

• Delivering services
• Managing contracts and agreements
• Sending invoices and processing payments
• Communicating about projects
• Improving our website and services
• Sending updates or marketing (only where you’ve consented). You may opt out of marketing communications at any time.
• Protecting our systems and preventing fraud
• Complying with legal or regulatory obligations

No data hoarding. No unnecessary collection. And again, we do not sell your personal information. Not our business model. Not our vibe.

Under POPIA, we process personal information where:

• You have given consent
• Processing is necessary for a contract
• We are legally required to do so
• It protects your legitimate interests
• It supports our legitimate business interests, provided your rights are respected

If we ever want to process your information for a new purpose, we’ll either ensure it’s legally compatible or obtain your consent first.

To deliver our services, we sometimes work with trusted third parties, such as:

• Cloud hosting providers
• Payment processors
• Email platforms
• Analytics providers
• Infrastructure and IT partners
• Security and credential management tools
• AI and automation tools

When we share information with these partners:

• It’s limited to what’s necessary
• They are contractually required to protect it
• They must comply with applicable data protection laws

We only work with providers who take privacy seriously.

Want to know who they are? Ask us. We’ll share the current list of providers who process personal information on our behalf.

We use AI-assisted tools and automation in how we work: drafting, summarising, research, code and admin. The thinking, the judgement and the final call stay with our team, and we stay responsible for whatever we hand over.

Sometimes your personal information passes through those tools, because it’s part of the work. That might be:

• An email or enquiry we’re summarising or replying to
• Notes, briefs and project documents
• Files you’ve shared with us for a project
• Systems, code or configuration we look after for you

How we keep that sensible:

• We use paid business accounts, never free consumer tools, so proper data protection terms apply
• Those terms confirm your information isn’t used to train or improve their models
• Where a provider offers a setting that shares data for model training or product improvement, we switch it off
• Access is limited to what the task actually needs
• Special personal information, passwords and access credentials don’t go anywhere near them
• A person reviews the output before it reaches you, unless we’ve told you up front that a service is AI-generated without human review

We don’t make decisions about you that carry legal or similarly significant consequences based only on automated processing. There’s always a human in the loop.

Most AI providers run their infrastructure outside South Africa, which makes this a cross-border transfer too. The Cross-Border Transfers section below covers how we handle that.

We may share personal information:

• With service providers helping us deliver services
• With partners involved in your project
• When required by law, regulation or court order
• To protect our rights or prevent fraud
• In the event of a business restructuring, merger or acquisition

We may also use anonymised, aggregated information for reporting or analytics.

Other than that, we don’t share your personal information without your consent.

Some of our service providers store or process data outside South Africa. That includes our AI and automation providers, along with our cloud hosting, security, email and analytics platforms.

Where a provider lets us choose where our data lives, we choose South Africa. Where South Africa isn’t offered, we choose the European Union, because its data protection standards line up closely with POPIA’s. Where a provider can lock data to a region rather than just place it there, we take the lock. Where there’s no regional choice at all, processing is typically in the United States.

Wherever it goes, we make sure:

• Adequate data protection safeguards are in place; or
• The transfer complies with POPIA requirements

By using our services, you acknowledge that such transfers may occur where necessary.

Where your information needs to move across borders, we don’t just send it and hope for the best. We make sure the right legal and contractual protections are in place first, so your data stays properly safeguarded wherever it’s stored.

We keep personal information only for as long as necessary to:

• Deliver services
• Comply with legal obligations
• Resolve disputes
• Enforce agreements

When it’s no longer required, we securely delete or anonymise it. No digital clutter.

You’re not powerless here. You have rights. You may:

• Request access to the personal information we hold about you
• Ask us to correct inaccurate information
• Request deletion where legally permissible
• Object to certain processing
• Withdraw consent where processing is based on consent
• Ask us for the list of providers who process personal information on our behalf
• Lodge a complaint with the Information Regulator: https://www.justice.gov.za/inforeg/

To exercise any of these rights, simply email hello@synrgy.co.za with the subject line “Privacy Request”.

We may ask for reasonable identity verification before processing your request. That’s for your protection.

We take reasonable steps to keep your information accurate and up to date.

If something looks wrong, outdated, or incomplete, let us know and we’ll fix it. Simple as that.

We implement appropriate technical and organisational measures to protect personal information against:

• Unauthorised access
• Loss or destruction
• Unlawful processing
• Disclosure

This includes:

• Secure hosting environments
• Access controls
• Encryption where appropriate
• Ongoing monitoring and risk assessment

No system is 100% immune to risk. But we design ours carefully.

If a data breach occurs that affects your personal information, we will:

• Contain it
• Investigate the cause
• Fix whatever let it happen

We’ll tell the Information Regulator within 72 hours of becoming aware of a breach. We’ll tell you as soon as we’ve established that your information is affected, and we aim to do that within 7 days. If piecing together the full picture takes longer, we’ll tell you what we know rather than wait until we know everything.

Transparency matters.

If we update this Privacy Policy, we’ll adjust the “Last Updated” date below and communicate any material changes clearly on our website.

Your continued use of our website or services after updates means you accept the revised policy.

This Privacy Policy is governed by the laws of the Republic of South Africa.