Privacy
Policy.

Who We Are

Anexis AI Group (Pty) Ltd (registration number to be confirmed) is a private company incorporated under the laws of the Republic of South Africa. We operate as the holding entity for the Anexis AI Group, comprising seven sector-specific AI product sub-brands and the Anexis Advisory consulting division.

For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), Anexis AI Group (Pty) Ltd is the Responsible Party. For the purposes of the EU General Data Protection Regulation 2016/679 (“GDPR”), where applicable, we act as the Data Controller.

References in this Policy to “Anexis AI Group”, “we”, “us”, or “our” include all subsidiary companies and product brands operating under the Anexis AI Group (Pty) Ltd group structure.

Information We Collect

We collect personal information only where it is necessary, relevant, and adequate for the purposes described in this Policy. We do not collect excessive or irrelevant personal information.

2.1 Information You Provide Directly

• Contact and enquiry data: Your name, surname, email address, telephone number, job title, and company name when you complete our contact forms, request a demonstration, or book an Advisory Sprint.
• Account and onboarding data: Where you create an account on any Anexis AI platform, we collect login credentials (hashed), profile information, and onboarding questionnaire responses.
• Commercial correspondence: Communications you send us by email, post, or through our platforms, including attachments and metadata.
• Payment information: For paid services, we collect billing name, email, and payment method details. We do not store full card numbers — these are processed by our PCI-DSS compliant payment processor.
• Survey and feedback data: Where you participate in user research, satisfaction surveys, or product feedback sessions.

2.2 Information We Collect Automatically

• Usage data: Pages visited, features accessed, time and duration of sessions, click paths, and search queries within our platforms.
• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Log data: Server logs recording your interactions with our systems, including error logs and API call records.
• Cookie data: Information collected via cookies and similar tracking technologies — see Section 10 and our separate Cookie Policy for details.

2.3 Information From Third Parties

• Business partners and referrals: Where a third party refers you to us or where we receive your professional details through a legitimate business channel (such as a LinkedIn connection or conference attendance list).
• Publicly available sources: Professional information available on public business directories or your company’s website, used for legitimate business development purposes.
• Client data processed on your behalf: Where you are a client using our SaaS platforms, we may process personal information of your customers, employees, or beneficiaries on your behalf as a Operator/Processor under your instruction. Such processing is governed by your Data Processing Agreement with us, not this Policy.

How We Use Your Information

We do not use your personal information to make automated decisions that have legal or similarly significant effects on you without human review, unless we have obtained your explicit consent or are required to do so by law.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Lawful Basis for Processing

In terms of Section 11 of POPIA and Article 6 of the GDPR, we process personal information only where at least one of the following lawful grounds applies:

• Consent (POPIA s.11(1)(a) / GDPR Art.6(1)(a)): You have given specific, informed, freely given, and unambiguous consent. You may withdraw consent at any time by contacting our Information Officer.
• Contract (POPIA s.11(1)(b) / GDPR Art.6(1)(b)): Processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legal obligation (POPIA s.11(1)(c) / GDPR Art.6(1)(c)): Processing is required to comply with a legal obligation, including SARS reporting, FICA compliance, and other South African statutory requirements.
• Legitimate interest (POPIA s.11(1)(f) / GDPR Art.6(1)(f)): Processing is necessary for our legitimate business interests or those of a third party, provided these interests are not overridden by your fundamental rights and freedoms. We conduct a balancing test before relying on this ground.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are:

At the end of each retention period, personal information is securely deleted or anonymised in accordance with our Data Destruction Policy.

Sharing Your Information

We do not share your personal information with third parties except in the following circumstances:

• Service providers (Operators): We engage carefully vetted third-party service providers who process personal information on our behalf under written data processing agreements. These include cloud hosting providers, payment processors, email delivery services, and customer support platforms. All operators are bound by confidentiality obligations and may only process data on our documented instructions.
• Professional advisors: Our legal counsel, auditors, and financial advisors, bound by professional confidentiality obligations.
• Group companies: Where necessary, personal information may be shared between Anexis AI Group (Pty) Ltd and its subsidiary companies within the Anexis AI Group, subject to the same privacy standards as set out in this Policy.
• Business transfers: In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal information may be transferred to the acquiring entity. We will notify you of any such transfer in advance.
• Legal requirements: Where we are required to disclose information by law, court order, or competent regulatory authority, including the Information Regulator of South Africa, SARS, and law enforcement agencies.

Cross-Border Transfers

In terms of Section 72 of POPIA, we may transfer personal information to third parties in countries outside South Africa only where that country provides an adequate level of protection, or where appropriate safeguards are in place. These safeguards include:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• Binding Corporate Rules where we transfer within the Anexis group internationally
• Your explicit consent to the specific transfer
• Adequacy decisions by the South African Information Regulator, as and when published

Our primary cloud infrastructure is hosted on Microsoft Azure (South Africa North region), ensuring primary data residency within the Republic of South Africa. Secondary backup and disaster recovery infrastructure may involve transfers to other African or EU regions, subject to the safeguards above.

Clients requiring specific data residency commitments should contact us at legal@anexisaigroup.com to discuss custom deployment options.

Security Measures

We implement appropriate technical and organisational security measures to protect your personal information against accidental loss, destruction, alteration, unauthorised access, or disclosure, in accordance with Section 19 of POPIA. Our security measures include:

• Encryption of personal information in transit (TLS 1.3) and at rest (AES-256)
• Role-based access controls with least-privilege principles and multi-factor authentication
• Regular penetration testing and vulnerability assessments by independent third parties
• Continuous security monitoring using our own Axiom Shield AI governance platform
• Physical access controls to all data processing facilities
• Employee privacy and security training conducted annually
• Incident response plan with breach notification procedures meeting POPIA Section 22 requirements

In the event of a security breach that poses a risk of harm to you, we will notify the Information Regulator of South Africa and, where required, affected data subjects within the timeframes prescribed by POPIA and applicable law.

Your Rights

POPIA and, where applicable, the GDPR grant you significant rights in relation to your personal information. You have the right to:

• Access (POPIA s.23 / GDPR Art.15): Request confirmation of whether we hold your personal information and receive a copy of that information.
• Correction (POPIA s.24 / GDPR Art.16): Request that we correct inaccurate, outdated, incomplete, or misleading personal information.
• Deletion/Erasure (POPIA s.24 / GDPR Art.17): Request deletion of your personal information where we no longer have a lawful basis to retain it, subject to applicable legal retention obligations.
• Restriction of processing (GDPR Art.18): Request that we restrict processing of your personal information in certain circumstances.
• Data portability (GDPR Art.20): Receive your personal information in a structured, commonly used, and machine-readable format where processing is based on consent or contract.
• Object to processing (POPIA s.11(3) / GDPR Art.21): Object to processing based on legitimate interests, including direct marketing. Where you object to direct marketing, we will cease processing immediately.
• Withdraw consent (POPIA s.11(1)(a) / GDPR Art.7(3)): Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Lodge a complaint (POPIA s.74): Lodge a complaint with the Information Regulator of South Africa if you believe we have infringed your rights — see Section 14.

To exercise any of the above rights, submit a written request to our Information Officer at legal@anexisaigroup.com. We will respond within 30 days of receipt of a valid request. In complex cases, we may extend this period by a further 30 days, with notice to you.

We will not charge a fee for processing your rights request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee.

Cookies

Our website and platforms use cookies and similar tracking technologies. For full details of the cookies we use, your choices, and how to manage them, please read our separate Cookie Policy.

In summary, we use: strictly necessary cookies (for platform functionality); performance cookies (anonymous analytics); and preference cookies (to remember your settings). We do not use third-party advertising or tracking cookies that follow you across unrelated websites.

Children’s Privacy

Our services are directed at business organisations and professionals. We do not knowingly collect personal information from children under the age of 18 years. If we become aware that we have inadvertently collected personal information from a minor, we will delete it immediately and notify the relevant guardian.

The processing of children’s personal information — where it occurs through client deployments of our EdTech platform (Thuto AI) in educational settings — is governed by the client’s own Data Processing Agreement with Anexis AI Group, and the client takes responsibility as the Responsible Party for compliance with POPIA Chapter 2 regarding children’s information.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable legal requirements. We will notify you of material changes by:

• Posting the updated Policy on our website with a revised “Last Updated” date
• Sending a notification email to registered account holders
• Displaying an in-platform banner for existing platform users

Your continued use of our website or services after the effective date of any changes constitutes your acceptance of the updated Policy. If you do not accept the changes, you must discontinue use of our services and contact us to exercise your rights regarding your personal information.

How to Contact Us

We aim to respond to all privacy-related correspondence within 5 business days of receipt.

Complaints

If you believe that we have processed your personal information in contravention of POPIA, you have the right to submit a complaint directly to the Information Regulator of South Africa:

We would, however, appreciate the opportunity to address your concerns before you approach the Information Regulator. Please contact our Information Officer in the first instance at legal@anexisaigroup.com.

EU residents who wish to lodge a complaint may contact their local Data Protection Authority. A list of EU DPAs is available at edpb.europa.eu.