Privacy Policy

Last updated: 5 September 2026

This policy explains how 720DegreeIT ("we", "us") collects, uses and protects personal information when you use the AI Business Platform (the "Platform"), and how we handle personal information on behalf of the businesses that use it.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Two roles, two sets of obligations

Our role depends on whose information is involved:

Whose information	Our role under POPIA	Who decides how it is used
Business clients who subscribe to the Platform	Responsible party	Us
Customers, members and patients of those businesses	Operator	The business (our client)

Where we act as an operator, we process personal information only on the documented instructions of our client, under a written operator agreement as required by section 21 of POPIA. If you are a customer of a business that uses our Platform and you want your information corrected or deleted, contact that business directly. They control it; we hold it for them.

2. What we collect

From business clients

Business name, registration number, VAT number and trading address
Contact name, email address and telephone number
Login credentials for the client portal
Billing details and payment history
WhatsApp Business Account, Facebook Page and Instagram professional account identifiers and access credentials, held encrypted
Payment provider credentials, held encrypted

On behalf of our clients

Names, mobile numbers and email addresses of their customers
WhatsApp, Facebook Messenger and Instagram message content exchanged between a customer and the business, and the public name or username the customer uses on that service (Facebook and Instagram do not give us phone numbers)
Booking, attendance and enrolment records
Contract and electronic signature records, including the message identifier, timestamp and IP address that evidence acceptance
Debit order mandate details and bank account information, held encrypted
South African identity numbers where a client requires them for contracts or verification, held encrypted
Where the client is a health practice, health information supplied by the patient. This is special personal information under section 26 of POPIA and is processed only where section 32 permits it

Children's information

Several of our clients serve children, including swim schools and dance studios. Section 34 of POPIA prohibits processing a child's personal information without the consent of a competent person. The Platform is built so that the account holder is always the parent or guardian, consent is recorded before any child's information is processed, and the bot does not hold conversations with children.

3. Why we process it

Purpose	Lawful basis under POPIA
Providing the Platform to our clients	Performance of a contract
Answering customer enquiries over WhatsApp	Legitimate interest of the client; consent
Managing bookings and appointments	Performance of a contract
Generating and storing signed agreements	Performance of a contract; legal obligation
Processing debit order mandates and collections	Performance of a contract; consent
Sending appointment reminders and account notices	Legitimate interest; performance of a contract
Sending promotional messages	Consent, which may be withdrawn at any time
Securing the Platform and investigating misuse	Legitimate interest; legal obligation

4. Who we share it with

We do not sell personal information. We share it only with the service providers needed to operate the Platform:

Provider	What they receive	Where
Meta Platforms (WhatsApp Business Platform, Messenger Platform and Instagram messaging)	Message content, phone numbers and delivery status	International
Payment providers such as Netcash or Stitch	Mandate and collection details, on the client's own merchant account	South Africa
Hosting provider	All Platform data at rest	South Africa
AI language model provider	Message content, for the purpose of generating a reply	International
Object storage provider	Media and documents sent through the Platform	International

WhatsApp, Messenger and Instagram messages pass through Meta's infrastructure. This is inherent to using those services and applies to every business on the platform. If you are communicating with a health practice or a law firm, consider whether WhatsApp is the right channel for sensitive detail, and use the practice's or firm's direct channels where it is not.

5. Cross-border transfers

Platform data is hosted in South Africa. Some of the providers listed above process information outside the country. Where that happens, we rely on section 72 of POPIA and require, by contract, that the recipient affords protection substantially similar to POPIA.

6. How long we keep it

Message history — for the term of the client's subscription, then deleted within 90 days of termination unless the client requests an export
Signed contracts and mandates — five years after the agreement ends, to meet statutory record-keeping and dispute requirements
Financial and collection records — five years, as required by the Companies Act and the Tax Administration Act
Audit logs — five years
Marketing consent records — for as long as consent is relied upon, plus three years

Where a deletion request conflicts with a statutory retention period, we anonymise the personal information and retain only the financial record.

7. How we protect it

Access tokens, payment credentials, identity numbers and bank account numbers are encrypted at rest using AES-256-GCM, with keys held outside the database
Database-level row-level security enforces separation between clients, so one business cannot access another's records even if application code contains a fault
All traffic is encrypted in transit using TLS
Databases are not reachable from the public internet
Every change to a contract, mandate or collection batch is written to an append-only audit log

8. Your rights

Under sections 23, 24 and 25 of POPIA you may:

Ask what personal information we hold about you
Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully
Object to processing based on legitimate interest
Withdraw consent for direct marketing at any time, including by replying STOP to any WhatsApp, Messenger or Instagram message
Lodge a complaint with the Information Regulator

Requests to us are answered within 30 days. If you are a customer of a business using the Platform, send your request to that business; we will assist them in responding.

9. Contact

Information Officer
Ferdinand Diedericks
720DegreeIT
10 DEVIZES ROAD, GERMISTON, GAUTENG, 1401, South Africa
Email: info@720degreeit.co.za

Information Regulator (South Africa)
inforegulator.org.za

10. Changes

We will post any change to this policy on this page and update the date at the top. Where a change materially affects how we handle personal information, we will notify clients directly.