This Privacy Policy explains how ANVEXIQ TECHNOLOGIES (PTY) LTD (“ANVEXIQ”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you use https://anvexiq.co.za, contact us, request support or use a service that refers to this policy.
We process personal information in accordance with the Protection of Personal Information Act, 2013 (“POPIA”) and other applicable law. This policy describes our current practices. It does not create a certification or an audit opinion, and it does not replace the privacy terms of a third-party service you choose to use.
1. Responsible party and Information Officer
The responsible party for the processing described in this policy is ANVEXIQ TECHNOLOGIES (PTY) LTD, registration number 2026/898699/07, registered in South Africa.
- Business address: 27 La Silvanetta, Van Belkum Street, Trichardt, Mpumalanga, 2302, South Africa
- Information Officer: Angel Jacobs
- Privacy email: info@anvexiq.co.za
- Telephone: +27 82 529 2885
- VAT: Not VAT registered
Privacy requests, questions and complaints may be sent to the Information Officer using the email address above. Please include enough information for us to identify you and the request, but do not send passwords, one-time codes, full card numbers or unnecessary sensitive information.
2. Scope of this policy
This policy covers personal information processed through the corporate website and its enquiry, support and AI-assistance features. It also covers personal information we process when responding to a business enquiry, providing support or supplying a service.
It does not cover a separate third-party website, payment page or product that publishes its own privacy notice. Where a service has additional privacy terms, those terms apply alongside this policy.
3. Personal information we collect
Website enquiries and GoSimpla interest
When you submit an enquiry or register interest in GoSimpla, we may collect your name, email address, optional telephone number, optional company name, selected service or enquiry category, optional budget range, the content of your message, the page from which you submitted it, your consent record, the privacy-notice version, timestamps and a unique reference.
The website also uses security measures to detect duplicate or abusive submissions. These may involve a one-way fingerprint of the submitted payload and rate-limit keys derived from network information. We do not store raw IP addresses in the enquiry record. Cloudflare Turnstile may process browser and network signals when the forms are enabled; the resulting token is verified by our server.
Support requests
When you submit a support request, we collect your name, email address, optional telephone number and company, selected support category and product, subject, description, optional customer reference, customer-reported urgency, timestamps and a ticket reference. Customer-visible replies, status changes and operational records form part of the support record. Internal staff notes are visible only to authorised staff and are not shown in the customer tracking view.
Support access is protected by a high-entropy token held in an HttpOnly, Secure, SameSite=Strict browser cookie. Only a hash of the token is stored in the central support database. The cookie expires after 30 days and is not placed in a URL, analytics tool or third-party script. A ticket reference or email address alone is not sufficient to access a ticket.
AI assistant
If you use the AI assistant, the messages you type are sent through the website Worker to our AI provider so that a response can be generated. The assistant is automated, can make mistakes and does not create a support ticket without your explicit confirmation. The website does not store your chat transcript; it stores a session hash and token-usage counters without message content or customer identity. A proposed ticket is stored in your browser’s session storage until you review it; a ticket is created only when you confirm it.
Do not send passwords, one-time codes, full payment-card numbers, private keys, identity numbers or unnecessary sensitive personal information to the assistant.
Payments and commercial records
The public website does not currently operate a checkout or collect payment-card details. If you purchase a service or subscription, we may collect billing contact details, company details, invoice and payment references, transaction status and the information needed to administer the agreement. Where payment is processed by PayFast or another payment provider, the provider collects and processes payment information under its own terms; we receive the transaction information needed to confirm and administer the payment, not full card details.
Technical and security information
Our hosting and security providers may process technical information such as request URLs, browser and device information, timestamps and network information in order to deliver the website, protect it against abuse and investigate security incidents. We configure our application not to log enquiry descriptions, email addresses or raw IP addresses. Provider-level logs may be processed by Cloudflare under its terms.
4. Why we process personal information and our lawful grounds
The purpose and lawful ground depend on the context. We process personal information to:
- respond to an enquiry, demonstration request or GoSimpla interest submission, including taking steps you request before a possible agreement (contract or pre-contractual steps, and/or consent where required);
- assess and administer a support request, maintain the customer-visible conversation and keep operational records (contract or pre-contractual steps, and/or our legitimate interest in supporting customers);
- prevent spam, duplicate submissions, fraud and security incidents, and protect the website and our users (our legitimate interest in security, subject to your rights);
- provide, administer and invoice services, subscriptions and projects (performance of a contract and legal obligations);
- maintain accounting, tax, transaction and business records (legal obligations);
- send marketing communications where you have opted in or where the law otherwise permits (consent or another lawful ground); and
- comply with law, respond to lawful requests and establish, exercise or defend legal rights (legal obligations and legitimate interests).
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before the withdrawal. Where we rely on a legitimate interest, we consider the nature of the information and your reasonable expectations, and you may object as described below.
5. Cookies, analytics and similar technologies
The website does not use advertising trackers or third-party analytics scripts. Fonts and core assets are served with the website. The support portal sets the strictly necessary support-access cookie described above. The AI assistant uses browser session storage to keep a session identifier and a pending ticket proposal; this is not a tracking cookie and is cleared when the browser session ends.
Cloudflare Turnstile may set or read technical information needed to distinguish people from automated submissions when a protected form is enabled. Turnstile is a security service, not an advertising service. If we introduce analytics or non-essential cookies in future, we will update this policy and provide any consent mechanism required by law before using them.
6. Payments and PayFast
Where a payment is processed through PayFast, PayFast acts as a payment processor and may collect personal and payment information under its own privacy policy and terms. We use the information returned by the payment provider to confirm payment, issue receipts, administer the service and resolve billing queries.
We do not ask you to send card details by email or through the website’s enquiry forms. If you are asked for payment details through an unexpected message, do not respond; contact us using the details in this policy.
7. Hosting, infrastructure and service providers
We use service providers to operate the website and deliver services. These currently include:
- Cloudflare for website hosting, security, D1 database services and Turnstile. The production website database is currently hosted in Cloudflare’s Western Europe (WEUR) region.
- Resend for operator notification emails relating to website enquiries and support operations.
- GroqCloud for AI-generated responses when the AI assistant is configured and used.
- PayFast for payment processing where an online payment is offered.
- Our internal ANVEXIQ Command Centre, an access-controlled system hosted on Cloudflare, for support ticket records and authorised staff follow-up.
These providers process information on our instructions or under their own terms, depending on the service. We do not sell personal information. We may disclose information to professional advisers, auditors, insurers or authorities where necessary for a legitimate purpose, to comply with law or to protect rights and safety. We require recipients to protect information consistently with applicable law.
8. AI processing
When the AI assistant is available, your message and the conversation context are sent to GroqCloud’s API so that a response can be generated. The API key is held as a server-side secret. The assistant is an automated system, not a human. ANVEXIQ does not use customer conversations to train its own models. The AI provider’s processing, retention and model-use practices are governed by its terms; we select and configure providers with data protection in mind, but we do not claim that a provider never processes information outside South Africa.
The assistant is not used to make decisions that produce legal or similarly significant effects about you. A human support ticket is created only after you review and confirm the proposed information. AI output may be inaccurate and should be checked before you rely on it.
9. Cross-border processing
Some service providers process information outside South Africa. Cloudflare’s infrastructure and the production D1 database may be located outside South Africa, including in Western Europe; GroqCloud and Resend may also process information in other countries. Section 72 of POPIA requires us to consider the protection available when personal information is transferred across borders.
We take reasonable contractual, organisational and technical steps to protect information transferred to service providers, and we review provider terms and data-location information as part of our operations. We do not claim that every recipient is subject to South African law or that a formal adequacy assessment has been completed for every provider. If you require more information about a specific transfer, contact the Information Officer.
10. How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected, or for a longer period required or permitted by law.
- General project enquiries: 90 days from submission, unless a longer period is required for a live opportunity, a legal obligation, a dispute or your request.
- GoSimpla pilot and early-access registrations: 180 days from submission, subject to the same exceptions.
- Support records: for as long as needed to resolve and maintain the support relationship, meet legal or contractual obligations, and manage disputes. Internal notes follow the same retention period as the ticket.
- Payment, invoice and accounting records: for the period required by applicable tax and accounting law.
- Security and operational logs: for the period reasonably needed to investigate and prevent abuse, or as required by a provider’s terms and applicable law.
When a retention period ends, we delete or de-identify the information, or securely archive it where a legal hold or legitimate record-keeping need applies. Backups may retain information for a limited period before being overwritten. A legal hold may prevent deletion until the hold is lifted.
11. Security
We use reasonable technical and organisational measures appropriate to the information and the risk. These include access controls for authorised staff, server-side handling of credentials, validation and rate limiting of public forms, HttpOnly support cookies, separation of customer-visible and internal support notes, and encrypted transport between browsers and the website.
No method of transmission or storage is completely secure. We cannot guarantee that a security incident will never occur, but we investigate suspected incidents and take reasonable steps to contain, assess and remediate them. Where a security compromise is likely to result in a risk to your rights, we will notify the Information Regulator and affected data subjects where required by POPIA.
12. Your rights
Subject to applicable law, you may:
- request access to the personal information we hold about you;
- request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- object to processing based on a legitimate interest or to direct marketing;
- request restriction of processing where the law provides for it;
- withdraw consent where processing relies on consent; and
- complain to the Information Regulator.
Requests should be sent to info@anvexiq.co.za with enough information to identify you and the information concerned. We may need to verify your identity before acting, to protect your information. We will respond within the period required by law. A request to delete information may be limited by a legal obligation, a legal hold, a dispute or the need to complete a transaction.
The public website does not currently provide a self-service customer data export. You may request access to your information using the contact route above; where a service provides an export function, the service will explain how to use it.
13. Direct marketing
We may send you information about ANVEXIQ services or GoSimpla development where you have opted in, where you are an existing customer and the law permits, or where another lawful ground applies. You can opt out of marketing at any time using the unsubscribe route in the message or by emailing the Information Officer. Opting out of marketing does not stop transactional or support communications.
14. Children
The website and services are intended for businesses and adults. They are not directed at children. If you are under 18, please do not submit personal information without the involvement of a parent or guardian. If we learn that we have collected a child’s personal information without the required consent, we will take reasonable steps to delete it.
15. Changes to this policy
We may update this policy when our services, providers, legal obligations or processing practices change. The current version will be published on this page with its effective date and last-updated date. Material changes will be communicated where required by law. The policy version is also recorded with form submissions so that the notice you accepted can be identified later.
16. Complaints and contact
Please contact us first if you have a privacy concern so that we can try to resolve it. Privacy requests and complaints may be sent to the Information Officer at info@anvexiq.co.za or by telephone on +27 82 529 2885.
You may also complain to South Africa’s Information Regulator at https://inforegulator.org.za/. Its published guidance explains the complaint process and your rights under POPIA.
Please also read our Terms & Conditions, Refund Policy and Cancellation Policy.