1. Scope and responsibilities
Process Layer (Pty) Ltd, trading as ProcessLayer, is a South African software business. This policy covers our website, enquiries, software development and integration services, and any hosted software products we offer. Product-specific notices may provide additional details about a particular service.
We decide how to use information for our own enquiries, business relationships, accounts and administration. For that information, we are the responsible party under South Africa's Protection of Personal Information Act (POPIA), or the controller under other applicable privacy laws.
When we handle personal information in a customer's systems or content on their instructions, the customer generally remains the responsible party or controller and we act as their operator or processor. The customer agreement and any data processing agreement govern that work. This policy does not replace them or give us additional rights over customer data.
2. Information we collect
- Enquiries and support: your name, email address, optional company name, enquiry topic, message and subsequent correspondence.
- Website requests: IP address, browser and device details, requested pages and technical or security logs processed by our hosting provider. The contact form also receives a country code and a security-verification token to help handle enquiries and screen spam.
- Website analytics: page views, referring websites, country, browser and device type, and page-loading and performance measurements used to understand website usage and improve it.
- Customer relationships: business contact details, proposals, contracts, invoices and payment or subscription status, where relevant.
- Services and products you use: account and organisation details, permissions, configuration, usage and diagnostic records, and content you or your authorised users supply. Depending on the service, content may include source code, files, business records, prompts and generated output.
We receive information directly from you, from your organisation or its authorised users, from systems you connect, and from the providers involved in delivering the service. The information processed depends on the features and permissions you enable.
You choose whether to contact us. A name, email address and message are needed to handle a website enquiry; company details are optional. If information needed for a contract or product is not supplied, we may be unable to provide that service.
3. Why we use it
Where we determine the purpose of processing, we rely on the grounds available under the applicable law:
- Enquiries and contracts: to respond, prepare proposals, deliver agreed work and administer accounts. This supports steps you request before a contract or performance of that contract. For business contacts acting for an organisation, we also rely on our legitimate interest in managing that relationship.
- Reliability, improvement and protection: to understand website usage, improve performance, diagnose faults, prevent abuse and protect our services and users. These are legitimate interests, balanced against your rights.
- Legal obligations: to maintain required business records, respond to lawful requests and meet applicable accounting, tax and other duties.
- Consent: where a particular use requires your permission, including optional marketing or non-essential tracking if introduced. You may withdraw that permission without affecting earlier lawful processing.
Submitting an enquiry does not subscribe you to marketing. We do not sell personal information or customer content. When acting as a processor, we follow the customer's lawful instructions rather than treating this policy as consent to use their data for our own purposes.
4. AI and automation
AI may be used in development work or in product features. Where that work requires an external AI provider, relevant prompts, code, files or other context may be sent to that provider. The permitted providers, information and uses must be covered by the customer agreement or the notice for that feature.
We do not use customer content to train our own general-purpose AI models. Customer-specific training or fine-tuning requires separate written agreement. An external provider's retention and training practices depend on the provider and service configuration; any permitted use for the provider's own model training must be separately disclosed and authorised, not inferred from use of our website.
AI-generated information can be wrong, including information about people. You can ask us to correct personal information we control. We do not use this website to make solely automated decisions with legal or similarly significant effects on you. Any product or customer deployment involving such decisions needs its own disclosures, lawful basis and safeguards.
5. Sharing and international transfers
Information may be accessed by authorised team members and contractors, and by providers needed to deliver the relevant service. The website uses Cloudflare for hosting, analytics, spam protection and email delivery, and contact enquiries are received in a Google Gmail inbox. Customer projects or products may also use hosting, AI, support, payment and connected-platform providers.
We limit access to the purpose of the work and require appropriate confidentiality and data protection commitments where providers process information for us. Your organisation's administrators may manage accounts and content within its workspace. Platforms you connect may also process information under their own terms and privacy notices.
We may disclose information when legally required, to protect legal rights, or to professional advisers or a prospective successor in a business transaction, subject to appropriate confidentiality and applicable law.
Providers may process information outside South Africa or your home country. Where required, transfers must be supported by an applicable adequacy decision, binding contractual safeguards or another lawful transfer mechanism. For EU or UK data, this may include approved standard contractual clauses and additional safeguards. Contact us for details relevant to your service or to request information about those safeguards.
6. Retention and deletion
We keep information only while there is a valid purpose for doing so. Retention depends on the type of record:
- Enquiries and support correspondence are kept while needed to resolve the matter, manage the relationship and address related claims.
- Contracts, invoices and business records are kept for applicable accounting, tax and legal recordkeeping periods.
- Customer content is kept for the service and any return or deletion period agreed with the customer. Product-specific retention settings apply where offered.
- Technical and security records are kept for troubleshooting, incident investigation and protection against abuse, with longer retention only where justified by an incident or legal obligation.
When information is no longer needed, we delete or irreversibly anonymise it. Deletion from active systems may precede removal from backups; retained copies remain protected until the applicable backup cycle removes them. A legal hold may delay deletion.
Removing an integration or uninstalling a product does not necessarily delete all associated records. Contact us for deletion or export requests. Copies held in your own systems or by independently controlled platforms must be managed with those administrators or providers.
7. Analytics, cookies and security
We use Cloudflare Web Analytics to see aggregate website usage and performance. Its script measures page visits and loading behaviour. Cloudflare states that this service does not use cookies or local storage to collect usage metrics, fingerprint visitors, or track individuals across websites. We do not send contact-form contents to the analytics service.
Our contact form uses Cloudflare Turnstile in invisible mode to protect against spam and automated abuse. It checks browser and device signals in the background, including your IP address, and provides a verification token that our server validates before sending your message. Cloudflare processes this information as described in its Turnstile Privacy Addendum.
We do not add advertising trackers or analytics cookies to this website. Our hosting provider may use essential security technologies. A hosted product may need cookies or similar storage for sign-in and preferences; its notice will explain those uses. Where consent is required for optional tracking, we will request it before enabling that tracking.
We use reasonable technical and organisational measures appropriate to the information and service. The website uses HTTPS, and contact-form email credentials stay on the server. Controls for customer environments are agreed for the project or product. No system can guarantee absolute security. We will notify affected customers, individuals or regulators of a personal information breach where required by law or our agreement.
8. Your rights
Depending on the law and circumstances, you may request access to, correction of or deletion of your personal information, restriction of processing, or a portable copy. You may also withdraw consent where processing depends on it.
You may object to processing based on legitimate interests and to the use of your information for direct marketing.
Use our contact form and identify your request as a privacy matter, or contact the ProcessLayer representative handling your contract. We may need proportionate information to verify your identity and will respond within the period required by applicable law. If we cannot fulfil a request, we will explain the reason and any available complaint route.
For information we process for your employer or another customer, contact that organisation first. We will assist it with requests as required by our agreement and the law.
You can complain directly to the Information Regulator of South Africa, or to the relevant authority where you live or work. You do not have to contact us first.
9. Sensitive information and children
Our website and business products are not directed at children. Do not send passwords, payment-card details, health records or other sensitive information through the general contact form. Projects involving sensitive information or children's data require an agreed scope, a lawful basis and appropriate safeguards.
10. Changes and contact
We may update this policy as our services or legal requirements change. The date above identifies the current version. For material changes affecting existing customers, we will provide appropriate notice and obtain consent where required. A policy update does not itself authorise a new, incompatible use of previously collected information.
For privacy questions or requests, contact Process Layer (Pty) Ltd.