Privacy policy

1. About this notice

“Vula Connect”, “we” and “us” refer to the business operating this website. To confirm: full legal name, legal form, registration number (if applicable), physical and postal address, and business telephone number. General enquiries: info@vulaconnect.com.

This notice covers visitors to our website, people enquiring about our services, client and supplier contacts, and information used to administer engagements. Personal information includes information about identifiable individuals and, where applicable, existing legal entities. Vula Connect determines the purposes and means of processing for its own business activities.

Where we handle client-controlled identity, access or support records on a client’s instructions, our role and duties must be set out in an operator agreement. The client’s privacy notice also applies. This website notice does not replace that agreement or an employee privacy notice.

2. Information and purposes

The reviewed website code contains no enquiry form, account registration, payment checkout or analytics script. Email links open your email application; they do not send a message automatically. Please do not email passwords, access tokens, identity documents or sensitive client records with an initial enquiry.

To confirm: the full business data inventory, whether special personal information or children’s information is processed, and any client-system access. Additional processing needs an appropriate notice and lawful basis before it begins.

3. How information is collected and justified

We receive information you provide directly or through an authorised organisational representative. Hosting providers may collect technical request information when serving the website. Any other collection sources must be disclosed when relevant.

Processing must have a lawful basis under POPIA: for example, steps requested before a contract or performance of a contract; compliance with a legal obligation; a legitimate interest of the business, you or another person that is not overridden by your rights; or specific, informed consent where required. These grounds are not interchangeable permission for every use. The purpose and applicable ground must be recorded for each activity.

Providing enquiry information is voluntary, but without relevant contact or service details we may be unable to respond or prepare a proposal. If information is legally required, we will explain the requirement and consequences at collection. Browsing the website is not blanket consent to marketing or unrelated processing.

4. Sharing and service providers

Information may be disclosed to authorised personnel and providers only as needed for the relevant purpose, such as website hosting, business email, agreed service delivery, accounting or professional advice. Cloudflare is the intended website hosting provider. Email providers and other operators, the information they receive, and their contractual safeguards are to confirm.

Operators must process information under appropriate written terms and security obligations. Disclosure to authorities must have a lawful basis. Any proposed new use or recipient outside the disclosed purpose requires a compatibility and legal assessment and, where necessary, a further notice or consent. A hyperlink to another organisation does not authorise us to give it your enquiry details.

5. Processing outside South Africa

Hosting, email and support providers may process information in other countries. To confirm: actual providers, locations, onward transfers and safeguards. Before a transfer, Vula Connect must establish that it meets section 72 of POPIA, such as adequate protection through applicable law or binding terms, or another permitted ground. This draft does not assert that all information stays in South Africa.

6. Retention and security

Information should be retained only for as long as its purpose, a lawful obligation, an agreement or another permitted basis requires. Relevant considerations include completion of the enquiry or engagement, statutory accounting requirements, unresolved disputes and lawful preservation duties. When retention is no longer justified, information should be securely deleted, destroyed or de-identified, subject to applicable requirements.

To confirm: approved periods for enquiries, client and financial records, logs, rights requests and backups; deletion methods; and access restrictions. Security measures must be appropriate to identified risks and regularly reviewed. Access control, secure transmission, operator oversight and incident handling must be verified before making specific claims about implemented controls. No technology eliminates every risk.

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, notification to the Regulator and affected data subjects must follow section 22 of POPIA, including its timing requirements and lawful exceptions.

7. Marketing, cookies and automated decisions

Unsolicited electronic direct marketing must comply with section 69 of POPIA, including valid consent or the permitted existing-customer circumstances. Every marketing message must identify its sender and provide a practical, free means to object. A service enquiry is not a marketing subscription. Administrative replies concerning your request are distinct from promotional messages.

See our cookie policy for the source-code findings and outstanding hosting checks. No automated decision-making or profiling feature was identified in the reviewed website code. Any automated processing in client services must be assessed and disclosed separately, including section 71 where applicable.

8. Your rights and requests

Subject to POPIA’s conditions, you may request confirmation of processing, access to your information, correction of inaccurate or misleading information, or deletion of information that is excessive, unlawfully obtained or no longer authorised to be retained. You may object on the grounds allowed by law, object to direct marketing, or withdraw consent for future processing based on that consent. Withdrawal does not undo lawful earlier processing or override another lawful retention requirement.

Send a request to info@vulaconnect.com, indicating the information or activity concerned and the outcome you seek. We may need proportionate identity or authority verification; ask for a secure method before sending sensitive evidence. We will explain any lawful restriction or applicable fee. See the PAIA manual for formal access requests.

To confirm: the registered Information Officer’s name and direct contact details, deputy details if applicable, and the internal request-handling process.

9. Complaints and updates

You can raise a concern with us or complain directly to the Information Regulator (South Africa). POPIA complaints: POPIAComplaints@inforegulator.org.za. Telephone: 010 023 5200 or 0800 017 160. The Regulator provides complaint procedures and forms on its website.

Changes to our activities may require an updated notice. The approved version will show its effective date, with material changes brought to affected people’s attention where appropriate. This draft must be approved against actual business practices before publication.