VayloSA Privacy Policy

Version: 1.0
Effective date: 13 October 2026

1. Who we are

VAYLOSA (PTY) LTD, trading as VayloSA, provides websites, applications, AI automation and business systems.

Company registration number: 2026/167892/07
Physical and contact address: 255 Mimosa Village, Fairview, Gqeberha, South Africa
Email: support@vaylosa.co.za
Telephone: 063 127 4075
Website: https://www.vaylosa.co.za

For privacy questions or requests, email support@vaylosa.co.za with the subject “Privacy request” for the attention of our Information Officer.

This policy explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (“POPIA”). It covers website enquiries and our own business administration. Where we process information on a client’s instructions, the project agreement and any applicable data-processing agreement also apply.

2. Information we collect

We collect information you provide directly, including:

Our website and service providers may also process technical information needed to deliver and protect the service, such as IP addresses, request times, browser information and email-delivery records.

Please provide only information relevant to your enquiry or project. Do not submit passwords, payment-card information, identity documents, children’s information or sensitive personal information through the general enquiry form. If such information is necessary for an agreed service, contact us first to arrange appropriate handling.

3. Why we use information

We use enquiry information to reply, make contact, understand your request and discuss the services you have asked about.

If you become a client, we may also use relevant information to prepare proposals, manage the relationship, create and deliver the agreed services, provide support, administer payments and meet legal obligations.

We may process limited technical information to maintain security, prevent abuse and investigate delivery or operational problems.

We do not use enquiry details for marketing. We do not sell personal information.

We process information only where a lawful basis applies, including your consent where required, steps requested before entering a contract, performance of a contract, compliance with a legal obligation, or a legitimate interest permitted by POPIA. Submitting an enquiry does not constitute consent to unrelated marketing or unrestricted use of your information.

4. Whether providing information is voluntary

You choose whether to contact us. An email address and a message are needed to respond to a website enquiry. Without sufficient information, we may be unable to reply, prepare a proposal or deliver a requested service.

Information required for a particular project will be explained when we agree its scope.

5. Artificial intelligence in our services

VayloSA uses AI-assisted tools in the creation and delivery of websites, applications, AI automation and business systems. Relevant business information supplied for a project may be processed by these tools to assist with activities such as planning, content creation, design, coding, testing, analysis, integrations and automation.

AI processing is limited to the agreed service and a lawful, necessary purpose. We aim to minimise the information supplied to AI tools and remove or mask personal identifiers where practicable.

We will not treat a client’s acceptance of service terms as permission to process another person’s information unlawfully. Where a project involves customer, employee or other third-party personal information, the parties must agree appropriate instructions and safeguards before processing it.

Our policy is not to permit client confidential information or personal information to be used for general-purpose AI model training. Before providing such information to an AI service, we must verify that its contractual terms and account settings support this restriction. Where appropriate safeguards are unavailable, we will use anonymised or synthetic information, select another provider, or agree an alternative approach.

Material AI-assisted deliverables are subject to human review appropriate to their purpose. We do not use enquiry information to make decisions based solely on automated processing that have legal or similarly significant effects on individuals.

6. Who receives information

Only VayloSA’s directors have authorised routine access to the enquiry mailbox.

External providers necessarily process information to operate the website, deliver emails, host systems or provide agreed AI functionality. This processing is separate from access to the mailbox by VayloSA personnel.

Our website contact form uses Resend to deliver enquiries to support@vaylosa.co.za. Resend processes the submitted email address, message and associated delivery information.

Our providers include:

Additional AI models, integrations or connected services may be used for an agreed project. Installed skills do not necessarily receive information themselves; where a skill or integration sends information to another provider, that provider is also relevant. Before supplying personal information or confidential client information to an additional provider, we will identify the provider and its purpose and agree the necessary safeguards and project-specific disclosures.

VayloSA operates from the South African address above. This does not mean all provider processing takes place in South Africa. Provider processing locations depend on the service, account region and approved configuration. We will confirm the relevant locations and transfer arrangements before transferring personal information and provide applicable details on request or in the project agreement.

We limit disclosures to what is needed for the relevant purpose and require appropriate confidentiality, security and processing arrangements where applicable.

We may also disclose information when legally required, to authorised professional advisers under confidentiality obligations, or where necessary to establish, exercise or defend legal rights.

7. Processing outside South Africa

Email, hosting and AI providers may process information outside South Africa.

Before transferring personal information internationally, we must ensure that an applicable ground under section 72 of POPIA is satisfied, including appropriate protection through applicable law or binding agreements, or another lawful ground.

Relevant provider locations and transfer arrangements will be disclosed in our provider information. Using our website is not blanket consent to any international transfer.

8. How long we keep information

We regularly review enquiry threads and manually delete enquiry emails after 90 consecutive days without further contact in the enquiry thread. Further correspondence restarts that inactivity period. Deletion is carried out during our manual reviews; it is not an automated process.

This rule applies to enquiry emails. It does not require us to delete records that must be retained for an active project, a legal obligation, accounting purposes, a complaint, a dispute or the establishment, exercise or defence of legal rights.

Project and business records are retained only for the period needed for their purpose or an applicable legal requirement. We then delete, de-identify or otherwise dispose of them appropriately.

Deleting an email from our mailbox does not necessarily remove delivery logs, backups or copies held by providers immediately. Those copies must be subject to applicable provider retention arrangements and safeguards. Retained backup copies should remain restricted and expire through the relevant backup lifecycle.

9. Security

We must maintain reasonable technical and organisational safeguards appropriate to the information and risks involved. These include restricting access, protecting credentials, reviewing service providers and handling information through suitable systems.

No internet service can guarantee absolute security. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate and make notifications to the Information Regulator and affected people where POPIA requires them.

10. Your rights

Subject to applicable law, you may:

Send requests to support@vaylosa.co.za. We may reasonably verify your identity before providing information or acting on a request. We will explain any lawful refusal, retention requirement or applicable fee.

Where we hold information solely on a client’s instructions, we may refer your request to that client and assist as required.

You may contact the South African Information Regulator through https://inforegulator.org.za.

11. Information processed for clients

For client systems, the client generally determines why personal information is processed and VayloSA processes it on documented instructions, unless the circumstances establish a different role.

The project agreement should specify the information involved, permitted processing, security measures, approved providers, assistance with rights requests and incidents, and return or deletion arrangements.

This website policy does not replace those agreements or the client’s own privacy notices.

12. Cookies and external websites

Any cookie or tracking disclosure must reflect the website’s actual configuration. Non-essential analytics or advertising tools will not be treated as necessary merely because they are convenient.

Where applicable, we will provide further information and obtain consent before using tools that require it.

External websites and services operate under their own policies. We remain responsible for our selection and use of providers to the extent required by law.

13. Changes to this policy

We may update this policy when our services, providers, processing practices or legal obligations change. The published version will show its effective date.

Where a change requires a new notice or consent, we will take the necessary steps before relying on it. Updates do not retrospectively authorise incompatible uses of information.