Privacy Policy & POPIA

1. Information we collect

We collect only the personal information you choose to share with us — for example through our Discovery form, newsletter subscription, resource downloads or direct communication. This typically includes:

• Your name and the company or organisation you represent
• Contact details such as email address and phone number
• The business context and project information you provide
• Basic technical information necessary for the website to function

2. How we use your information

We use personal information solely to respond to your enquiry, deliver the services or resources you request, manage our engagement with you, and — where you have opted in — send occasional insights communications. We do not sell, rent or trade your personal information to third parties.

3. Lawful processing under POPIA

Our processing is lawful, minimal and purpose-specific. We process personal information on recognised legal grounds under POPIA — including your consent, the performance of a contract with you, our legitimate interests, and compliance with legal obligations — and only to the extent necessary for the purposes described in this policy.

4. Your rights

Subject to the Act, you have the right to:

• Be notified when your personal information is collected
• Request access to the personal information we hold about you
• Request that we correct or delete your personal information
• Object to the processing of your personal information
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator (South Africa)

5. Information Officer and requests

Under POPIA, the Information Officer of a private body is the head of that body (or a person duly designated by the head). Privacy and POPIA-related requests may be directed to our Information Officer by email at enquiries@udsystems.co.za. We respond to all requests within a reasonable time as required by the Act.

6. Security and retention

We apply reasonable technical and organisational measures to protect personal information against loss, unauthorised access and misuse, and access is limited to team members who need it to serve you.

We keep personal information for defined periods rather than indefinitely:

• Enquiries and Discovery form submissions: 12 months from our last contact with you. If the enquiry becomes an engagement, the records are kept for the duration of that engagement and any period required by law afterwards.
• Newsletter subscriptions: until you unsubscribe. Every email we send carries an unsubscribe link.
• Records of consent - what you agreed to, and when: for as long as we rely on that consent, and for a reasonable period afterwards so that we can show it was given.
• Digital Advisor conversations: not stored by us. See section 7.1.

After these periods the information is securely deleted or anonymised. You can ask us to delete it sooner using the contact details in section 5.

7. Sharing and cross-border processing

We do not sell or trade personal information. We use a small number of service providers (operators, in POPIA terms) to run this website. They process information on our behalf, for the purposes below and no others. All of them are based outside South Africa, which makes these transborder flows under section 72 of POPIA:

• Cloudflare (United States) - hosting for this website, the domain and DNS, and the edge functions that receive form submissions.
• Resend (United States) - delivery of the emails your enquiry generates, and the mailing list behind the Insights newsletter if you have subscribed.
• Groq (United States) - the language model behind the UDS Digital Advisor, with Anthropic (United States) as a fallback if Groq is unavailable. See section 7.1.
• Google (United States) - Google Analytics, and only if you allow analytics cookies in our cookie banner. Nothing is sent to Google unless and until you do, and you can withdraw that permission at any time from the Cookie preferences link in the footer. We also use Google Search Console, which reports how this site appears in search results and places nothing on the site.

Where information is processed outside South Africa we rely on those providers published data-protection commitments to keep it protected on terms comparable to POPIA. We do not pass your information to anyone else for their own marketing.

7.1 The UDS Digital Advisor

The Digital Advisor is an AI assistant. When you type a message into it, that message and the conversation so far are sent to a language-model provider outside South Africa (Groq, or Anthropic if Groq is unavailable) so that a reply can be generated. This happens only when you choose to use the Advisor. It is not running in the background and it does not read anything else you do on this site.

We do not store these conversations. We receive no copy of one unless you go on to send us an enquiry through the Discovery form. The replies are generated by the model rather than written by us in advance, and the Advisor can be wrong - anything that matters should be confirmed with our team.

Because the text leaves our control to be processed, please do not type confidential information, identity numbers, financial details or another persons personal information into the Advisor. If you would rather not use it, contact us by email, phone or WhatsApp and you will get the same answer from a person.

8. Complaints

If you believe your personal information has not been handled in accordance with POPIA, you may contact us first so we can resolve the matter, or lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

9. Changes to this policy

We may update this policy from time to time. The current version, with its effective date, is always the one published on this page.