Automated Growth Systems Privacy Policy

Automated Growth Systems (“AGS”, “we”, “us” or “our”) provides customer communication, customer relationship management, booking, marketing and business automation solutions.

AGS is the trading name of:

• Legal entity or proprietor: AUTOMATED GROWTH SYSTEMS
• Registration number, if applicable: 2015/339591/07
• Physical or business address: 11 Tazra Park, Somerset Business Park, Somerset West
• Website: www.growthsystems.co.za
• Information Officer: J C Oosthuizen
• Privacy contact email: marketing@growthsystems.co.za
• Contact telephone: 0600868385

This policy explains how we collect, use, share, protect and retain personal information, and how you can exercise your rights.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African laws.

Personal information includes information about identifiable individuals and, where applicable, identifiable existing businesses and other juristic persons.

This policy applies to personal information processed in connection with:

• Our websites, forms, demonstrations and marketing.
• Enquiries, proposals, customer accounts and support.
• Telephone calls, email, messaging and AI-assisted conversations.
• AGS services, including appointments, rentals, events and customer communication.
• Our dealings with suppliers, business contacts and authorised account users.

A more specific privacy notice may apply to a particular service, campaign or collection activity. We will make that notice available where relevant.

This policy does not replace a client business’s own privacy notice or our contractual data-processing obligations.

For our own enquiries, customer relationships, billing and business administration, AGS generally acts as the responsible party: the organisation deciding why and how personal information is processed.

When a client uses AGS to manage its customers, bookings, attendees or communications, the client will generally be the responsible party and AGS will act as an operator, processing information under the client’s lawful instructions.

The role depends on the actual activity, rather than the label used in an agreement.

Where we act as an operator, we process information within the agreed mandate, maintain confidentiality and assist the client with applicable privacy obligations. We do not treat a client’s customer list as permission to market AGS services to those customers.

If your enquiry concerns information held for one of our clients, contact that business first where possible. If you contact us, we will help identify the appropriate responsible party and assist within our authority.

Depending on your interaction with us, we may process:

• Contact and business information: Names, business names, job titles, telephone numbers, email addresses and business addresses.
• Enquiry and account information: Service interests, requirements, proposals, contracts, account users, support requests and correspondence.
• Booking and transaction information: Appointment details, rental periods, event registrations, ticket information, invoices, payment references and payment status.
• Communication information: Messages, call details, conversation transcripts, summaries, enquiries and follow-up records. Audio recordings are addressed in section 8.
• Technical information: IP addresses, browser and device information, access logs and website activity, where collected by the systems in use.
• Preferences and permissions: Communication preferences, consent records, objections and unsubscribe requests.

We seek to collect information relevant to the stated purpose. Please do not submit passwords, payment-card security codes, identity documents or sensitive information through ordinary chat or enquiry forms unless a specific, secure process has been provided.

We may obtain personal information:

• Directly from you through forms, calls, messages, meetings or service use.
• From your employer or an authorised representative.
• From a client whose systems we implement or support.
• Through integrations you or the responsible client authorise.
• From payment, communication and other service providers involved in the transaction.
• From referrals or public sources where collection and further use are lawful.

Where information is collected indirectly, we will provide the required collection information unless a lawful exception applies.

Information being publicly accessible does not automatically permit unrestricted use or direct marketing.

We use personal information to:

• Answer enquiries and arrange demonstrations.
• Prepare proposals and enter into or perform agreements.
• Configure, provide, maintain and support agreed services.
• Manage authorised accounts, bookings, registrations and communications.
• Administer billing and verify payment status.
• Investigate faults, protect systems and prevent misuse.
• Handle complaints, disputes and legal obligations.
• Conduct lawful marketing and manage communication preferences.
• Assess and improve service quality using information appropriate to that purpose.

Depending on the activity, our lawful justification may include your consent, contractual necessity, a legal obligation, or a legitimate interest recognised by POPIA.

We do not rely on legitimate interests to bypass specific consent requirements, including those applicable to unsolicited electronic direct marketing.

Where a law requires particular information, we will identify that requirement in the relevant collection process or notice.

Reading this policy or using our website does not, by itself, constitute consent to every form of processing.

Some information is necessary to respond to an enquiry, provide a requested service, process a booking or meet a legal obligation. We will identify required information in the relevant process.

Other information is optional.

If necessary information is not provided, we may be unable to complete the requested activity. Declining optional marketing does not, by itself, prevent you from receiving an otherwise available service.

AGS may use AI-assisted telephone and messaging services to answer approved questions, capture enquiries, support permitted actions and route matters to a person.

Information supplied during these interactions may be processed by the communication and AI providers needed to deliver the service. Authorised personnel may review relevant records for support, quality assurance, troubleshooting and security.

We will identify an AI interaction appropriately and provide relevant privacy information at the point of collection.

AGS conversation settings:

• Audio recording: Calls handled through AGS telephone and AI voice services may be recorded where recording is enabled for the relevant service. Recordings may be used to review enquiries, verify instructions, investigate complaints, troubleshoot technical problems and improve call handling. Where recording takes place, callers will receive an appropriate notice. Access is restricted to authorised personnel and service providers who require it for these purposes.
• Transcription and summaries: AI voice interactions may generate written transcripts, conversation summaries, call details and records of actions taken, depending on the service and configuration. Written messages and information captured during conversations may also be stored in the relevant conversation history or customer record. These records support customer service, follow-up, booking administration, quality review and troubleshooting. Transcripts and AI-generated summaries may contain errors and should be checked before being relied on for important decisions. Deleting an audio recording does not necessarily delete its transcript, summary or associated customer records.
• Retention: We retain recordings, transcripts and summaries only for as long as reasonably necessary for the enquiry, service, support, quality-assurance or other lawful purpose for which they were collected. Retention also takes account of contractual obligations, legal recordkeeping requirements and disputes. Audio recordings may be subject to a configured automatic-deletion period. Transcripts, summaries, exported copies and related customer records are managed separately and may have different retention requirements. When continued retention is no longer justified, information will be deleted, destroyed or appropriately de-identified, subject to applicable legal requirements and backup-management processes. You may contact AGS for the retention arrangements applicable to a particular interaction or to request deletion.
• Provider use for model training or improvement: AGS uses contracted technology and AI providers to process conversation information and deliver the requested services. Processing is governed by the applicable agreements and instructions. Depending on those arrangements, processing may include service maintenance, troubleshooting and improvement, including the use of appropriately de-identified or aggregated information. This is distinct from using identifiable conversations to train general-purpose AI models. We do not treat your use of an AGS assistant as unrestricted permission for unrelated model training. You may contact AGS for information about the providers, processing arrangements and any available choices applicable to your service. Requests for an alternative communication method will be considered where reasonably practicable.

Where audio is recorded, we will provide an appropriate recording notice and apply a lawful basis. Request a human follow-up or available alternative if you do not wish to use an AI channel.

AI responses can be incomplete or incorrect. Important matters should be confirmed with an authorised person.

We will not subject you to a decision based solely on automated profiling that has legal consequences or substantially affects you, except where POPIA permits it and the required safeguards apply. Where relevant, you may request information and make representations about such a decision.

We distinguish service communications from promotional messages.

Booking confirmations, requested information and account notices may be necessary to deliver a service. They do not automatically authorise unrelated marketing.

We send electronic direct marketing only where permitted by POPIA, including:

• Where valid consent has been obtained; or
• Where the existing-customer exception applies to our own similar products or services, with the required opportunity to object when details are collected and in subsequent marketing communications.

Where lawful, we may approach someone once to request consent in the prescribed manner, provided consent has not previously been withheld.

Marketing communications will identify the sender and provide a practical way to stop further marketing. You may use the unsubscribe option, communicate your preference during a call or contact our privacy email.

We may retain limited suppression information so that we can respect your objection. Withdrawing marketing consent does not prevent necessary service communications or processing supported by another lawful ground.

Our website may use technologies necessary for security, session management, forms and other requested functions.

Any optional analytics, advertising, personalisation or embedded third-party technologies must be described in the relevant cookie notice and operated with the required lawful justification and choices.

Website technology notice: Details of the cookies and similar technologies used on this website, including their providers, purposes and durations, are available in our Cookie & Tracking Notice.

You can review or change your optional cookie choices at any time by selecting Manage cookie preferences in the website footer.

Browser settings may also allow you to block or delete cookies, although this can affect website functions.

Third-party content, such as embedded videos, may involve processing by the relevant provider. We will explain applicable choices where that content is presented.

We may share relevant information with:

• Authorised AGS personnel and contractors.
• Hosting, customer-management, communication, AI and technical support providers.
• Payment providers and financial institutions involved in transactions.
• Professional advisers, auditors and insurers where appropriate.
• The client business, organiser or authorised staff involved in your booking or enquiry.
• Regulators, courts or public authorities where disclosure is legally required or justified.

Sharing must be relevant to the purpose and supported by an appropriate lawful basis.

Where a provider acts as our operator, we require an appropriate written arrangement addressing confidentiality, security and processing responsibilities. Some third parties act as independent responsible parties under their own privacy notices.

You may request information about third parties or categories of third parties that have accessed your personal information, subject to applicable law.

AGS uses technology providers whose infrastructure or authorised support personnel may be located outside South Africa.

Applicable countries or regions

Depending on the services enabled, personal information may be stored or processed in the United States of America, including for cloud hosting, communication and AI functionality. Authorised technical or support personnel in India may also process information where required to provide support.

These are locations identified in our platform provider’s published processing information. The locations applicable to a particular service depend on its providers, integrations and support arrangements. We will provide further information about relevant processing locations on request and update this notice when material changes require it.

Protection and transfer arrangements

Before transferring personal information outside South Africa, AGS must establish a permitted basis under section 72 of POPIA.

Our intended basis for routine overseas processing is a binding agreement with the recipient that provides an adequate level of protection under section 72(1)(a). This requires safeguards substantially similar to POPIA’s lawful-processing conditions, including appropriate restrictions on onward transfers.

Relevant contractual and technical safeguards include processing under documented instructions, confidentiality obligations, restricted personnel access, security measures, controls over subprocesses, and assistance with privacy requests and security incidents.

Where another basis under section 72 is applicable, such as specific informed consent or a qualifying contractual necessity, we will assess and document that basis for the particular transfer.

We do not assume that overseas laws provide identical protection to South African law. You may contact our Information Officer for information about the safeguards applicable to your personal information.

We apply reasonable technical and organisational measures appropriate to the information and processing risks. These include managing authorised access, confidentiality and relevant provider responsibilities, and reviewing identified risks.

No system can guarantee absolute security.

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate and meet applicable notification obligations.

Where AGS is the responsible party, this includes notifying the Information Regulator and affected people as soon as reasonably possible, subject to lawful exceptions or permitted delays.

Where AGS acts as an operator, we will notify the responsible party immediately when the applicable grounds exist and assist it with the response.

Report suspected privacy or security incidents to marketing@growthsystems.co.za.

We retain personal information only for as long as permitted or required for its purpose, including applicable legal, contractual, recordkeeping and dispute requirements.

Our retention approach considers:

• Whether the enquiry, account or service remains active.
• Applicable statutory retention obligations.
• Support, security and legitimate evidentiary needs.
• Client instructions where we act as an operator.
• Consent records and suppression information.
• Backup and recovery arrangements.

When retention is no longer authorised, we will securely destroy, delete or de-identify information as appropriate. Restrictions may apply to records retained for legal proceedings or other lawful purposes. Backup copies will be managed through the applicable retention and recovery process.

Subject to applicable requirements and exceptions, you may:

• Ask whether we hold your personal information.
• Request access to the information and relevant third-party access details.
• Request correction or deletion of information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained.
• Request deletion or destruction of information we are no longer authorised to retain.
• Object to processing where POPIA permits.
• Withdraw consent, without affecting the lawfulness of processing before withdrawal.
• Object to direct marketing.
• Exercise applicable rights concerning automated decisions.
• Complain to the Information Regulator.

Send requests to marketing@growthsystems.co.za. We may require proportionate proof of identity or authority before disclosing or changing information.

Confirmation of whether we hold your personal information is free. Any lawful access fee will be explained before it is charged.

Access to information and privacy requests

You may contact our Information Officer using the contact details provided in this policy to request access to your personal information, request correction or deletion, or raise a privacy concern.

We will respond within the applicable legal timeframes and explain any relevant refusals or limitations.

Requests for access to other records are subject to the requirements of the Promotion of Access to Information Act 2 of 2000 (“PAIA”). This privacy policy does not replace PAIA procedures or limit your statutory rights.

Our general business marketing is directed at adults.

We do not request children’s information or special personal information unless it is necessary for a defined service and an applicable lawful authorisation has been established.

Services involving children or information such as health, biometric or criminal-history information require a specific assessment and appropriate safeguards. Consent from a legally competent person or another statutory authorisation may be required.

Please notify us if you believe such information has been submitted without appropriate authority.

Contact our Information Officer using the details in section 1 so that we can investigate your concern.

You may also approach the Information Regulator directly. You do not have to obtain AGS’s permission to complain.

We may update this policy to reflect changes in our services, processing activities or legal requirements.

The current version and revision date will be published on our website. Where required, we will provide a further notice or obtain consent before introducing a new use.

Publishing a revised policy does not, by itself, authorise processing that requires a separate lawful basis or consent.