POPIA Compliance Statement

1. Who we are

LinxAI is a trading name of DTK REFRSH (PTY) LTD, registration number 2025/003280/07, a private company registered in the Republic of South Africa (“LinxAI”, “we”, “us”).

Contact: privacy@linxai.co.za

Registered address: Plot 102, Waterval, Krugersdorp West, Gauteng, 1739, South Africa

This statement sets out how we comply with the Protection of Personal Information Act, 4 of 2013 (POPIA). Our full Privacy Policy covers the same processing in more detail, including the lawful basis for each category of information.

2. Our capacity under POPIA

LinxAI processes personal information in two capacities. Which one applies determines who decides what happens to the information.

Responsible party. For our own website visitors, enquiries, leads, and clients, we determine the purpose and means of processing.

Operator. For the end customers of businesses that use LinxAI to run WhatsApp messaging, voice agents, or automation, we process on the client’s documented instruction. The client business is the responsible party. It determines the purpose, the retention period, and when information is deleted. We do not use that information for our own purposes.

WhatsApp Business Accounts. Each client owns its WhatsApp Business Account and its registered phone number. Where a client grants us access, we administer that account on their behalf: configuring phone numbers, message templates, display names, and account settings, and sending and receiving messages on their instruction. The client grants that access and can withdraw it at any time.

If you are an end customer of a business that uses LinxAI, that business is the responsible party for your information. We forward your request to them and act on their instruction. You may also contact them directly.

3. Information we process

As responsible party

• Name, email address, company, and phone number, submitted through our contact form or call booking.
• Correspondence records, including email to and from hello@linxai.co.za.
• Billing and account records.
• Website usage data. Google Analytics collects page-view and event data. Microsoft Clarity records session heatmaps and click patterns. Both load only where you consent.
• Cookies.

As operator, on behalf of clients

• WhatsApp phone numbers and message content.
• Voice call audio, recordings, and transcripts.
• Lead and enquiry details submitted through client forms, ads, or chat.
• CRM records created in the course of providing the service.
• WhatsApp Business Account settings and administration records, created while managing the client’s account on their behalf.

4. Purpose of processing

As responsible party, we process personal information to respond to enquiries, deliver our services, invoice clients, meet our tax and accounting obligations, and measure and improve the website.

As operator, we process personal information only to provide the messaging, voice, and automation service the client has engaged us for.

We do not sell or rent personal information.

The lawful basis for each category is set out in section 4 of our Privacy Policy.

5. Operators and cross-border transfers

The following operators process personal information on our behalf:

• Meta Platforms — WhatsApp Business Platform, delivering and receiving messages.
• Vercel, Cloudflare, domains.co.za — application hosting, DNS, and domain services.
• Supabase — application database and authentication.
• OpenAI, Anthropic, ElevenLabs — generating message replies, speech, and call transcription.
• n8n — moving data between connected systems.
• Resend — transactional and notification email.
• PayFast — processing client payments.
• Google, Microsoft — Google Analytics, Tag Manager, and Ads; Microsoft Clarity.
• Telephony providers — carrying inbound and outbound voice calls. The provider depends on the client deployment and is named in the client agreement.

Some of these operators process personal information outside South Africa. Where that happens we rely on section 72 of POPIA. Transfers are made on the basis that the recipient is subject to binding contractual terms giving effect to principles for the lawful processing of personal information that are substantially similar to POPIA, or that you have consented to the transfer, or that the transfer is necessary to perform a contract with you.

6. Retention

• Enquiries that do not become clients — 24 months from last contact.
• Client account and correspondence records — the term of the agreement and 3 years after it ends.
• Billing, invoicing, and tax records — 5 years, as required by South African tax and companies legislation.
• Analytics data — retained by the provider. Google Analytics retains event data for 14 months. Microsoft Clarity retains recordings for 90 days.
• Cookie consent record — 365 days.
• Information held as operator — retained for the period the client instructs, and deleted on the client’s instruction or at the end of the client agreement. We do not set this period.

7. Your rights under POPIA

You have the right to:

• Ask whether we hold your personal information and request a copy.
• Request correction of information that is inaccurate.
• Request deletion or destruction of your information, subject to retention we are required by law to apply.
• Object to processing based on legitimate interest, and withdraw consent where processing relies on it.
• Object to processing for direct marketing.
• Lodge a complaint with the Information Regulator.

8. How to exercise your rights

Email privacy@linxai.co.za with the subject line POPIA Request. We respond within 30 days.

For deletion requests, see Data Deletion, which sets out what to include and the timelines we work to.

Where we hold the information as operator, we forward the request to the responsible party and act on their instruction.

9. Information Officer

10. Complaints

You may lodge a complaint with the Information Regulator (South Africa).