Master Service Terms, Privacy Policy and Cookie Notice

Where documents conflict, the following order applies: (1) the signed Order Form or Deployment Agreement; (2) special terms expressly incorporated in that signed document; (3) the applicable package or service schedule; (4) these Master Service Terms; (5) marketing copy on this website or in proposals.

Marketing copy describes capabilities and targets. It does not create contractual commitments and is the lowest-ranking document.

A business day is any day other than a Saturday, Sunday or South African public holiday. Written, in writing and written notice include email sent to the address designated in the signed agreement.

The Ready Date, the Client's dependencies and the services have the meanings given in the clauses on Deployment timing, Go-live commitment & setup fee and Scope & change control. Headings are for convenience and do not affect interpretation.

Our services are offered to businesses. Under the Consumer Protection Act 68 of 2008, a juristic person (a company, close corporation or similar business) whose annual turnover or asset value is below the threshold the Minister has set, currently R2 million, is treated as a consumer and is protected by the Act. A client above that threshold is generally not. We do not assume which side of the line a client is on, and we record the client's status in the signed agreement.

Nothing in these terms excludes or limits any right the Act or other law gives you. Where it applies, it applies over anything here that conflicts with it.

The monthly service has no fixed term. It runs month to month and you may cancel on 30 days' written notice, so the rules the Act sets for fixed-term agreements are not engaged by the service itself.

Statutory cooling-off, rescission or cancellation rights apply only where, and to the extent that, the Client qualifies for them under applicable South African law.

No additional contractual cooling-off period is created for a juristic-person Client unless expressly agreed in writing.

Where the law permits services to begin during such a period with the Client's consent, the Client may expressly authorise immediate deployment, and work performed and third-party costs incurred remain payable to the extent the law allows.

Monthly fees are billed in advance in South African Rand. Ecosystem Core: R3,000 per month plus a once-off R6,000 setup fee, No minimum term, 30 days written notice to cancel.

The setup fee and the monthly retainer are paid through Paystack. The setup fee is paid in two equal halves of R3,000, the first to start and the second when your system goes live, and the monthly retainer starts one month after go-live. Where we agree it with you in advance, a payment can also be made in person by card or phone tap through iStorePay. If Paystack has a technical fault, we may agree an EFT in writing as a fallback, and the payment counts only once it has cleared in our bank account and been matched to your agreement. Banking details come only from your signed agreement or an invoice from SYSTEM. A request from anyone else to pay into a bank account should be treated as suspicious and reported to us. Paying the setup fee alone does not activate an engagement. Activation follows a signed agreement plus confirmed payment of the required engagement amount.

No VAT is currently added to the advertised fees. VAT will be charged only if and when SYSTEM is legally registered or required to charge it, with the applicable amount shown on a valid invoice.

Advertising and third-party media budgets are separate from our fees and are not included in them.

Fees may be adjusted on reasonable advance written notice of at least one full billing month.

Invoices are payable on the date stated on the invoice. Overdue amounts may bear interest at the prescribed rate under the Prescribed Rate of Interest Act 55 of 1975, to the extent permitted by law.

If an invoice remains unpaid after the due date, we may suspend services on 48 hours' written notice sent to the Client's designated notice address. The notice period starts when the notice is sent. Suspension may cover hosted infrastructure, automation workflows, AI reception, paid-media management, reporting and support, as specified in the notice.

Services are restored once payment reflects as cleared in our account, together with any reasonable reinstatement administration charge notified in advance. Fees for the suspension period remain payable where the suspension results from the Client's non-payment.

Where we lawfully enforce payment, the Client is liable for reasonable, legally recoverable enforcement and collection costs actually incurred. Nothing in this clause limits our other lawful remedies.

A payment-processor reversal, chargeback or dispute does not by itself extinguish a valid debt for services already rendered or committed.

Where a payment is reversed, or where a dispute is raised in bad faith, we may suspend services and pursue the outstanding amount through ordinary lawful means. This does not limit the Client's legitimate rights against its card issuer or any other mandatory right.

Typically live within a few business days of your signed agreement and the first R3,000 of the setup fee cleared. That is an expectation, not a promise. The binding commitment is in the Go-live commitment clause below.

The Client must provide the completed brief and approvals, logos, brand assets and content, relevant access and credentials, accurate business, pricing and instruction data, and every other dependency reasonably necessary to build and launch. Client-caused delays may extend the timeline and result in rescheduling within the deployment queue.

The Ready Date is the date on which the last of the following has happened: the agreement is signed, the first R3,000 of the setup fee has cleared, and the Client has provided every dependency listed in the Deployment timing clause.

We aim to have a first draft ready within 48 hours of the Ready Date. That is a target only and creates no right to a refund or credit. What we commit to is that the first version of the Client's system is ready for the Client's review within ten (10) business days of the Ready Date. Delay caused by the Client, by a third-party platform or provider outside our control, or by force majeure extends that period by the length of the delay.

If we miss that commitment for a reason within our control, the Client may cancel by written notice within five (5) business days after the period ends. On such cancellation we refund the setup fee paid and any monthly fee paid for a period in which the system was not ready for review, in full, within seven (7) business days.

Once the first version has been delivered for review, or if the Client cancels for any other reason after work has started, the setup fee is not refundable. This clause does not limit any right the Client has under the Consumer Protection Act or other law, and the monthly service remains cancellable on 30 days' written notice.

Scope is what the signed Order Form or Deployment Agreement, incorporated special terms and the package schedule say it is. Anything outside that is a Change Request.

For a Change Request we may quote additional fees, adjust delivery dates, or decline the change. Silence, informal conversation or a message thread does not extend scope.

Two rounds of revisions are included on the initial deployment unless the signed agreement says otherwise.

A custom build is a bespoke website, app, client portal or AI workflow outside the Ecosystem Core package. It starts with a paid discovery. The discovery fee is R1,500, payable before the discovery starts, and it is credited against the build if you go ahead. The Client receives the written scope and a quote at the end of the discovery.

No build work starts until the Client and SYSTEM have signed a written scope and a price for the build. The signed scope sets the deliverables, the payment schedule and the review stages, and it ranks above these Master Service Terms where the two differ. Unless the signed scope says otherwise, the build price is paid in three parts: 30% on signing, 30% when the first version is ready for review, and 40% before handover.

If SYSTEM ends a discovery before delivering the written scope, the discovery fee is refunded in full. Once the written scope has been delivered, the discovery fee is not refundable, and it is credited against the build if the Client signs.

Prices shown on this website for custom builds, including any starting price, are indicative. Only the price in a signed scope binds either party.

The Intellectual property, Scope & change control and Acceptance of deliverables clauses apply to custom builds. The Client owns the bespoke final deliverables on full payment of the price in the signed scope. Background IP is not transferred.

The Client provides access, information, approvals, content, credentials, feedback and decisions within the reasonable periods we request, and nominates a single decision-maker.

Client delay extends deadlines and pauses service levels, does not excuse payment of amounts due, and may result in rescheduling.

After a deliverable is submitted, the Client has a reasonable period of five (5) business days to submit consolidated revision requests.

Publication, launch, active use or express approval of a deliverable constitutes acceptance, subject to any defect the Client has already documented in writing and which remains unresolved.

On full payment, the Client owns the genuinely bespoke final deliverables created specifically for it: client-specific copy, commissioned graphics and video, branding assets, and anything else expressly identified as client-owned in the signed agreement.

SYSTEM Infrastructure retains all Background IP, meaning all pre-existing and reusable material including code, libraries, frameworks, templates, prompts, AI instructions, automation logic, workflows, integration architecture, methodologies, database and CRM structures, infrastructure, APIs, know-how, processes, generic components, reusable improvements, internal tooling and system architecture. Nothing in any agreement transfers Background IP.

Where Background IP is embedded in a paid-up deliverable, the Client receives a non-exclusive, non-transferable licence to use it as reasonably required for the intended business use of that deliverable.

Hosted and subscription systems, including the AI reception stack and automation platforms, are licensed for the duration of the engagement and are not transferred.

The Client grants us a limited, non-exclusive licence to use logos, photographs, video, trademarks, business and product information, lawfully held customer data, advertising assets and other supplied material solely to deliver the services.

The Client warrants that it has the authority and rights to supply that material and to give the instructions it gives.

The Client indemnifies us against third-party claims, and reasonable directly related legal costs, to the extent caused by unlawful or infringing Client material or Client instructions. We remain responsible for our own unlawful conduct.

The Client uses the service only for lawful business purposes and does not use it to send unsolicited marketing, to message people who have opted out, or to publish unlawful, deceptive, defamatory or infringing content.

The Client is responsible for having a lawful basis, and where the law requires it consent, to contact its own customers and to record their conversations through the service, including direct-marketing consent under section 69 of the Protection of Personal Information Act 4 of 2013 and the Electronic Communications and Transactions Act 25 of 2002.

The service must be used in line with the policies of the platforms it runs on, including WhatsApp and Meta, Google and the telecommunications providers. Those platforms may restrict, suspend or change access without notice, and that is a risk outside our control.

We may refuse, remove or pause content or messages that appear to breach this clause, and will tell the Client when we do.

For our own website, sales, billing, support and administration, we act as Responsible Party. Where we process the Client's lead or customer data solely on the Client's instructions, the Client is generally the Responsible Party and we act as an Operator under the Protection of Personal Information Act 4 of 2013.

The Client warrants that any database supplied for outreach or reactivation was lawfully collected, that a lawful basis exists for the intended processing and direct marketing, that consents or other lawful grounds are in place, that suppression and opt-out records are accurate and provided to us, and that it will not instruct unlawful processing.

We may refuse or suspend processing that appears unlawful, and will tell the Client why.

Further detail is in the Privacy Policy below.

This clause is the written contract that the Protection of Personal Information Act requires between a Responsible Party and its Operator. It applies whenever we process personal information for the Client as an Operator, for example the Client's enquiries, leads, customer messages and call records handled by the systems we run for it.

We process that information only for the Client's documented instructions and for the purpose of providing the services. We do not use it for our own purposes, do not sell it, and treat it as confidential. People who work on it for us are bound to confidentiality.

We keep it secure with the technical and organisational measures described in the Privacy Policy. We may use sub-operators, which are the providers listed in the Privacy Policy and Trust page, only on terms that give protection no weaker than this clause, and we remain responsible to the Client for them. We tell the Client of a new sub-operator before it starts processing the Client's information, and the Client may object in writing within ten (10) business days.

If we have reasonable grounds to believe the information has been accessed or acquired without authority, we tell the Client immediately, as section 21 of the Protection of Personal Information Act requires of an operator, so the Client can meet its own duty to notify the Information Regulator and the people affected.

We help the Client answer access, correction, objection and deletion requests from the people concerned, within the time the Act allows. Where personal information is sent outside South Africa, the Privacy Policy explains the safeguards.

When the engagement ends, and once the account is settled, we return the Client's information in a common format on request and then delete it from the systems we control within sixty (60) days, except where the law requires us to keep it. On reasonable written request, and no more than once a year, we give the Client the information needed to confirm that we are meeting this clause.

SYSTEM Infrastructure is run by its founder, and we say so plainly. These steps limit what that means for you.

First, the core assets stay in your name where practical, as the Account & asset ownership clause sets out, so you keep control of your domain, Google Business Profile, advertising accounts and customer records whatever happens to us.

Second, we keep the configuration of each deployment written down in a handover file for the Client, so another competent provider could take the system over. The Client may ask for that file at any time and we deliver it within five (5) business days.

Third, if we are unreachable by phone, WhatsApp and email for more than five (5) consecutive business days without notice to the Client, the Client may cancel immediately by written notice, and we refund the prepaid monthly fee for the period in which the service was not provided.

This clause does not promise round-the-clock cover. Support hours are in the Support, availability & maintenance clause.

AI systems can produce incorrect or incomplete output. Quote drafts, summaries and suggested replies are advisory only, and the Client holds final commercial approval of pricing and commitments.

We cannot bind the Client to any quote, price or commitment unless the Client has expressly agreed in writing that a defined automated flow may do so.

The Client is responsible for the accuracy of the pricing, scripts, policies and qualification rules it supplies. We are not responsible for output that is directly caused by inaccurate Client-supplied data.

The Client keeps appropriate human oversight over material decisions that are supported by automated processing.

Advertising spend is separate from our management fee and is preferably charged directly to the Client's own platform account or payment method. Where we pay it on the Client's behalf it is recharged at cost.

We do not guarantee impressions, leads, conversions, revenue, cost per click, search ranking or return on ad spend. Platforms may reject, limit or suspend accounts and creative for their own reasons.

The Client warrants that its product and service claims are true and lawful. We may refuse instructions we consider misleading, unlawful or prohibited by a platform.

We bid on competitor keywords only where that is lawful and permitted by the relevant platform policy.

We do not impersonate another business, use unauthorised logos, suggest false affiliation, copy protected creative or run misleading claims. Client instructions about competitors are reviewed before implementation and may be declined.

We do not buy, generate or fake reviews, impersonate reviewers, suppress negative reviews or gate review requests on expected sentiment.

Review requests are sent to customers on consistent terms and in line with platform rules and applicable law.

Delivery depends on third parties including Google, Meta and WhatsApp, hosting and cloud providers, AI providers, email infrastructure, payment processors, CRM and automation platforms, domain registrars, analytics services and other APIs.

To the extent permitted by law, we are not responsible for third-party outages, policy, API or algorithm changes, account suspensions not caused by our breach, advertising rejections, ranking volatility, discontinued products or changed functionality.

Where a provider becomes unavailable or unsuitable, we may substitute a reasonably equivalent provider.

Support is provided by the founder on business days between 08:00 and 17:00 South African time. New business enquiries are answered within two (2) business hours. Out-of-hours support for active clients exists only where agreed in the signed agreement.

We aim to keep hosted systems available and to restore a failure promptly, but we do not guarantee uninterrupted or error-free operation. Third-party platforms, networks, power and messaging providers can fail or change without notice.

We may perform maintenance and updates. Where a change is likely to interrupt the service we give reasonable notice where practical.

We warrant that services are performed with reasonable care and skill by suitably capable people.

We do not warrant uninterrupted third-party services, guaranteed search rankings, lead volumes or revenue, error-free AI output, or perpetual compatibility with external platforms.

To the maximum extent permitted by law, our total aggregate liability for all claims is capped at the fees actually paid by the Client in the three (3) months preceding the claim.

To the extent permitted by law, we are not liable for indirect or consequential loss, including lost profits, lost opportunities, lost leads, reputational harm or anticipated savings.

Nothing in these terms excludes or limits liability for fraud, wilful misconduct, or any other liability that cannot lawfully be excluded or limited.

The Client indemnifies us against third-party claims, losses and reasonable directly related legal costs to the extent they arise from: unlawful Client instructions; infringing content or material supplied by the Client; false or misleading Client advertising claims; databases obtained unlawfully; the Client's misuse of the services; the Client's own products and services; and regulatory violations caused by the Client.

This indemnity does not extend to our own unlawful conduct, for which we remain responsible.

Each party keeps the other's non-public information confidential during the engagement and for 24 months afterwards, and uses it only for the engagement.

This does not apply to information that is or becomes public without breach, was independently developed or lawfully known, or must be disclosed by law, regulator or court order. Each party may share it with professional advisers under equivalent duties of confidence.

We name a Client, use its brand or publish a case study only where the signed agreement permits it or the Client gives separate written approval.

Aggregated, anonymised metrics may be used only where they cannot reasonably identify the Client and where publication is lawful.

Where practical, the Client owns and remains the account holder of its core assets: domains, advertising accounts, analytics properties, Google Business Profile, social profiles, CRM records, tracked phone numbers and email accounts.

We own or license our proprietary infrastructure and the licensed systems that run the automation and AI layers.

On termination we will, as applicable, transfer or release accounts the Client owns, disable hosted systems we own or license, and retain records only as lawfully required.

The monthly service runs month to month with no minimum term and continues until ended by either party. The Client may cancel on 30 days' written notice. We may end the service on 30 days' written notice, in which case fees for any period after the end date are not charged and any prepaid monthly fee for that period is refunded.

Either party may end the agreement immediately by written notice if the other commits a material breach and, where the breach can be remedied, fails to remedy it within ten (10) business days of written notice describing it; or if the other is placed in liquidation or business rescue, or is unable to pay its debts as they fall due.

We may suspend or end the service immediately where the Client's use breaches the Acceptable use clause or the law, or where continuing would expose us to legal liability or to a suspension of our own accounts with third-party platforms.

Termination does not affect rights that have already accrued, and the Offboarding clause applies on termination.

All outstanding invoices become due on termination. Client-owned assets and data exports are handed over once the account is settled.

No Background IP transfers on offboarding. Third-party licences and hosted automation may end on termination.

Reasonable export or migration assistance beyond a standard export may be quoted and charged. Retention and deletion of personal information follow the Privacy Policy and applicable law.

Neither party is in breach for delay or failure caused by events beyond its reasonable control, including severe infrastructure failure, widespread power or network disruption, cloud or platform outage, cyberattack not caused by a failure to use reasonable security, government restrictions, industrial action, natural disaster and telecommunications failure.

Payment obligations already due are not suspended by this clause.

These terms are governed by the law of the Republic of South Africa.

To the extent permitted by law, the parties consent to the jurisdiction of a competent Magistrates' Court. This does not deprive either party of the right to approach any other court of competent jurisdiction.

The parties first attempt good-faith resolution between principals within fourteen (14) days of written notice, and may then refer the dispute to mediation. Urgent interdictory relief and straightforward uncontested debt collection may be pursued without first following negotiation or mediation.

Formal notices are sent to the email address designated in the signed agreement, to the physical address recorded in that agreement, or to another electronic address the parties agree in writing.

An emailed notice is treated as received on the business day it is sent, unless a delivery failure is received. WhatsApp is used for day-to-day operations and is not the only or required method for formal notice.

These terms, together with the signed agreement and schedules, are the entire agreement between the parties and replace earlier discussions.

Amendments and waivers are valid only in writing and signed by both parties. A failure to enforce a right is not a waiver of it.

If a provision is unenforceable, it is severed or read down to the minimum extent necessary and the rest stays in force.

The Client may not assign the agreement without our written consent. We may use subcontractors and operators, and remain responsible for their performance of the services.

Clauses on intellectual property, confidentiality, payment, indemnities, liability, data protection and dispute resolution survive termination.

The parties are independent contractors. Nothing creates a partnership, joint venture, agency or employment relationship. Each signatory warrants that they are authorised to bind their party. The agreement may be signed in counterparts and by electronic signature, which the parties accept as valid.

Before deployment we record: full legal entity name; registration number where the Client is a registered entity; entity type; business or registered address; the authorised representative's name, title and capacity; business email and phone; the Client's own VAT number where the Client is VAT-registered and provides it; and confirmation that the representative is authorised to bind the Client. A VAT number recorded in these details is the Client's, not ours.

A genuine sole proprietor is not required to provide a company registration number.

SYSTEM Infrastructure (Pty) Ltd, registration number 2026/372557/07, B-BBEE Level 1 Contributor (ICT). Director: Boikanyo Zulu.

Business location: eMalahleni (Witbank), Mpumalanga, South Africa. Email: boikanyo@systemsa.co.za. Phone: +27 64 874 1250. Website: https://www.systemsa.co.za.

Information Officer: Boikanyo Zulu. POPIA and privacy enquiries: boikanyo@systemsa.co.za.

Services and prices are described on the pricing page. No VAT is currently added to the advertised fees. VAT will be charged only if and when SYSTEM is legally registered or required to charge it, with the applicable amount shown on a valid invoice. Payment for the setup fee and the monthly retainer is through Paystack, or in person through iStorePay where agreed in advance, with a written EFT fallback only if Paystack has a technical fault. Cancellation, refund and statutory-rights provisions are in the clauses above. Privacy and cookie practices are set out below.

We are the Responsible Party for personal information we process for our own website, sales, billing, support and administration.

Where we process a client's lead or customer data solely on that client's instructions, the client is generally the Responsible Party and we act as an Operator.

Information Officer: Boikanyo Zulu. POPIA and privacy enquiries: boikanyo@systemsa.co.za.

From website forms: name, business name, industry, email address, phone number, package interest and any message you send.

Automatically: a one-way hash of your IP address and your browser user-agent string, for security and abuse prevention, plus the campaign parameters (UTM) in the link you arrived on.

From clients during an engagement: business information, account access details and the lead or customer records processed by the systems we operate for them.

We do not sell or broker personal information.

Selected operators and service or infrastructure providers may process personal information as reasonably necessary to host, secure, communicate, analyse and support the services, under contractual and technical safeguards and only for those purposes.

Current categories: website hosting (Vercel), managed database and serverless functions (Supabase), transactional email delivery, internal CRM mirror (Notion), payment processing (Paystack), call booking (Cal.com, loaded only on the booking page), messaging (Meta / WhatsApp Business Platform), AI voice and inference providers, analytics (Google Analytics 4) and advertising measurement (Meta) where you have consented.

We may disclose information where the law requires it, or to establish, exercise or defend legal claims.

On the contact form, you can give your phone number and choose what you need first. If you tap the "Message me on WhatsApp" button and then do not finish the form, we keep the number, your choice, the page it came from and the wording version shown on the button, so we can follow up about that request.

Nothing is kept for this purpose unless you tap that button. Any first message is sent by an AI assistant that says so, and you can reply STOP at any time. A number that has opted out is not stored again. These records follow the same retention period as other lead records.

The live voice demo starts only when you press the button and your browser grants microphone access. While it runs, your voice is sent to our voice provider (Vapi) and to AI model providers so the assistant can answer, and the call ends automatically after three minutes.

The demo is for trying the product. Do not give personal, financial or confidential information during it. Our provider may keep call recordings or transcripts under its own settings and terms, and we may review them to check that the demo works.

Clients who supply contact databases for outreach or reactivation warrant that the data was lawfully collected, that a lawful basis exists for the intended processing and direct marketing, that consents or other lawful grounds are documented, and that suppression and opt-out lists are accurate and shared with us.

We may refuse or suspend processing that appears unlawful.

Some of the providers that host, secure, message and support the service operate servers outside South Africa. Where personal information is transferred outside South Africa, we do so only to providers bound by law, binding corporate rules or an agreement that gives a level of protection substantially similar to the Protection of Personal Information Act, or where another ground in section 72 of that Act applies.

We apply reasonable and appropriate technical and organisational safeguards to the information we hold, including transport encryption, access control on administrative interfaces, least-privilege service credentials and audit logging.

No system can be guaranteed to be perfectly secure, and we make no claim of absolute security.

If we have reasonable grounds to believe that personal information in our care has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the affected party as soon as reasonably possible after discovering the compromise, as section 22 of the Protection of Personal Information Act requires, and tell the Client immediately where we process the information as its Operator (section 21).

You may request access to, correction of, objection to, or deletion of your personal information. We handle requests promptly and within any applicable statutory period.

We may lawfully retain information where it is needed for legal, tax and accounting obligations, dispute or claim handling, fraud prevention and record-keeping. Where a request cannot be met in full for one of those reasons, we say so and explain why.

Marketing and lead records are retained for no longer than necessary for the purpose they were collected for, and normally not more than 24 months after the last interaction unless the law or an active engagement requires longer.

Contact boikanyo@systemsa.co.za first so we can resolve the issue. You may also lodge a complaint with the Information Regulator of South Africa.

We store your consent choice and basic session state. These are necessary for the site to function and to honour your decision, and are not used for advertising.

The Google Analytics script is not downloaded until you accept. Before then, Consent Mode v2 keeps analytics_storage, ad_storage and ad_user_data denied, so no analytics or advertising cookies are set and nothing is sent to Google.

If you accept, Google Analytics 4 loads and measures traffic, including which pages and sections are viewed and which buttons are clicked. Google Analytics 4 does not log or store IP addresses. If you decline, the script never loads and no analytics events are recorded.

The Meta Pixel is not loaded at all unless you accept. It is injected only after advertising consent is granted, and consent is revoked on the pixel if you later decline.

You can change or withdraw your choice at any time using the Cookie Settings link in the footer. Declining keeps all non-essential tracking disabled.

We do not use session-replay tools.

SYSTEM Infrastructure (Pty) Ltd, registration number 2026/372557/07. Head of the private body and Information Officer: Boikanyo Zulu, director.

Business location: eMalahleni (Witbank), Mpumalanga, South Africa. Email: boikanyo@systemsa.co.za. Phone: +27 64 874 1250. Website: https://www.systemsa.co.za. Our postal and street address for requests is supplied on written request to the email address above.

The Information Regulator publishes a guide on how to use PAIA, in all official languages, at inforegulator.org.za. It explains the rights of a requester and how to approach the Regulator or a court.

The following are published on this website and need no PAIA request: our service pages, prices and terms, the Master Service Terms, Privacy Policy and Cookie Notice, company facts, and the B-BBEE certificate.

Company records: registration and secretarial records and director information.

Financial and tax records: invoices, payment confirmations from our payment processor, accounting and tax records.

Client records: enquiries, proposals, signed agreements, correspondence, onboarding material, and reports we prepare for clients.

Marketing and website records: enquiry form submissions, consent and opt-out records, and website analytics where you have consented.

Operational and security records: system, access and audit logs, and records of the third-party platforms we use.

We are a small company run by one director. We hold few human resources records.

We keep records that other legislation requires, including the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Electronic Communications and Transactions Act 25 of 2002 and the Protection of Personal Information Act 4 of 2013.

The purposes for which we process personal information, the categories of people it concerns, the providers who receive it, cross-border transfers and our security measures are set out in the Privacy Policy on this page. Where we process information for a client as an Operator, the client decides what it holds and requests for that information go to the client.

Complete the prescribed request form (Form 2 under the PAIA Regulations, available from the Information Regulator) and email it to boikanyo@systemsa.co.za. Identify the record as precisely as you can, say which right you are trying to protect and why you need the record for it, and give an address for our reply. If you ask on behalf of someone else, attach proof of your authority.

A requester must pay the prescribed request fee and, where they apply, the prescribed search and reproduction fees set out in the PAIA Regulations. We tell you the amount before we act on your request.

We decide within 30 days of receiving a complete request and tell you in writing. We may extend that once by up to 30 days where the law allows, and we tell you if we do.

PAIA lists the grounds on which access must or may be refused, including protecting the privacy of another person, the confidential or commercial information of a third party or of us, legal privilege, and the safety of a person or property. Where a record is partly exempt we release the part that is not.

You may lodge a complaint with the Information Regulator or apply to a court of competent jurisdiction. Contact us first so we can try to resolve the matter.

This manual is available on our website and by email on request. We update it when our records or contact details change.