Privacy Policy — XEQT (Pty) Ltd

Effective date: 2026-07-30 · Last updated: 2026-08-15

Published at: xeqt.co.za/privacy

XEQT (Pty) Ltd ("XEQT", "we", "us") respects your privacy and processes personal information in accordance with the Protection of Personal Information Act, 2013 ("POPIA").

1. Who we are

XEQT (Pty) Ltd, a South African company providing AI-powered business operating systems built on monday.com, WhatsApp automation, and workflow integration services.

Information Officer: Erik Bester · [email protected] · +27 66 109 0940

Address: 45 Yellowwood, Herons Way, Knysna, 6571, South Africa

Registered with the Information Regulator (South Africa).

2. What we collect

• Contact details: name, phone number, email, company name — when you message us on WhatsApp, complete a form, or become a client.
• Conversation content: WhatsApp messages exchanged with us (including messages handled by our automated assistant).
• Support and ticket data: issues you report and their resolution history.
• Billing data: company registration/VAT details for invoicing.

We do not collect special personal information (health, race, biometric, etc.) and ask that you not send it to us.

3. Why we process it (lawful bases)

• To perform a contract (§11(1)(b)): delivering the systems and support you engaged us for.
• Legitimate interest (§11(1)(f)): operating and securing our systems, keeping business records, responding to enquiries.
• Your consent (§11(1)(a)): WhatsApp communication and any direct marketing — which you may withdraw at any time by replying STOP.
• Legal obligation (§11(1)(c)): tax and companies-act record keeping.

4. Automated processing

Our WhatsApp support assistant uses AI (OpenAI) to draft replies to your messages. It can read your ticket status, create support tickets, and log enquiries on your behalf — nothing else. A human reviews escalations, and you may request a human at any time. Automated replies are clearly within a business-support context and no decisions with legal or similarly significant effect are made solely by automated means.

5. Who we share it with (operators & sub-processors)

We use the following service providers, each bound by a data processing agreement providing protection substantially similar to POPIA (§72):

We do not sell personal information. We do not share your information with other clients.

6. Retention

• Contacts/leads: 3 years after last interaction.
• Support tickets: 5 years.
• Security/error logs: 12 months (phone numbers masked).
• AI conversation threads: 30 days (provider default).
• Billing records: as required by tax law (5–7 years).

After retention, records are deleted or de-identified.

7. Security

Encryption in transit (TLS) and at rest; access restricted to authorized personnel; MFA on all administrative accounts; per-client system isolation; credential management via environment variables; breach response plan in place. If a breach risks your information, we will notify you and the Information Regulator as required by §22.

8. Your rights

You may request access to, correction of, or deletion of your personal information; object to processing; withdraw consent; and lodge a complaint. One access request per year is free. Email [email protected] with subject "POPIA Request". We respond within 30 days.

To opt out of WhatsApp messages at any time: reply STOP.

9. Complaints

Information Regulator (South Africa): [email protected] · 010 023 5200 · JD House, 27 Stiemens Street, Braamfontein, Johannesburg.

10. Cookies and this website

This website does not use analytics, advertising, or tracking cookies, and no cookie-consent banner is required because no non-essential cookies are set. The only cookies served are strictly necessary security cookies set by Cloudflare (our hosting and network-security provider) to distinguish legitimate visitors from malicious traffic; these cannot be used to track you across sites. Prices displayed in your local currency are based only on your approximate country, as seen at the network edge by Cloudflare (our hosting provider): no precise location is used, nothing is stored, and no third party receives any information when this happens.

If we ever add analytics or advertising cookies, we will update this section and present an opt-in consent notice before any such cookie is set.

11. Website forms

When you complete the friction-check form on our homepage, we collect your name, WhatsApp number, email address, and your quiz answers, with your explicit consent, so that we can contact you about your results (§11(1)(a)). Submitting the form is entirely voluntary; you can simply email or WhatsApp us instead. You may withdraw consent at any time by replying STOP or emailing us.

12. Visitors and clients in the EU and UK (GDPR)

If you are in the European Union or the United Kingdom, the GDPR (or UK GDPR) applies to how we handle your personal data. In practice, our POPIA-based approach already meets the same standard:

• Lawful bases: we process your data only to perform a contract, on the basis of legitimate interest, with your consent (e.g. WhatsApp communication, which you can withdraw at any time by replying STOP), or to meet legal obligations.
• Your rights: you may request access, rectification, erasure, restriction, portability, or object to processing. Email [email protected] with subject "GDPR Request" and we will respond within 30 days.
• International transfers: we are based in South Africa, which the EU recognises as providing adequate protection for the purposes of POPIA-regulated processing, and all transfers to our service providers are covered by data processing agreements with safeguards substantially similar to GDPR requirements (standard contractual clauses where applicable).
• No automated decision-making: we make no decisions with legal or similarly significant effect solely by automated means (Art. 22).
• Complaints: you may lodge a complaint with your local supervisory authority in addition to the South African Information Regulator.

13. Changes

We may update this policy; the current version is always at xeqt.co.za/privacy.