How we handle your information.

Flowuity (Pty) Ltd is a private company registered in the Republic of South Africa, with its principal place of business at Bryanston, Johannesburg. References to "we", "us", or "our" in this notice are references to Flowuity (Pty) Ltd.

For all matters relating to personal information, our Information Officer can be reached at privacy@flowuity.com. Our Information Officer is registered with the Information Regulator of South Africa, as required by section 55 of POPIA.

We collect personal information that you provide to us directly when you book a meeting, complete a Discovery, Blueprint, Investor, Briefing, Partner, or Programme intake form, subscribe to our written publications, or otherwise correspond with us. This includes your name, business email address, telephone number, role, organisation, and any free-text answers you choose to provide.

We collect technical information automatically when you visit flowuity.com or interact with our progressive web application. This includes your IP address (truncated where possible), browser type and version, device type, operating system, referring URL, and the pages you visited. We use first-party analytics. We do not place advertising trackers.

We do not knowingly collect special categories of personal information (race, health, religion, biometric data, criminal records, or political affiliation). If you provide such information voluntarily in correspondence, we will treat it with the additional care that POPIA requires.

To respond to your enquiry and prepare a meeting that is useful to you. The intake forms exist precisely so the first conversation is a conversation, not a qualification call.

To deliver an engagement we have agreed with you — Discovery, Build, Operate, Cybersecurity advisory, Programme delivery, or any other contracted service.

To operate, secure, and improve our website and progressive web application — including detecting fraudulent or abusive use.

To meet our legal, accounting, regulatory, and tax obligations under South African law and any other jurisdiction in which we operate.

To send you written publications you have specifically subscribed to. We do not send unsolicited marketing.

Your consent — when you submit a form, subscribe to a publication, or otherwise voluntarily provide information.

The performance of a contract — when you have engaged us, or are negotiating to engage us, on a project.

Legitimate interest — to operate our business, secure our systems, and conduct ordinary commercial correspondence with prospective clients, investors, partners, and counterparties.

Legal obligation — where retention or disclosure is required by South African statute, regulator, or court order.

Our staff, on a need-to-know basis. Every member of the Flowuity practice is bound by confidentiality.

Specialist sub-processors that we use to operate our practice — calendar and email infrastructure, document storage, accounting, and version control. We require each sub-processor to meet a security standard at least equal to our own. A current list is available on request.

Professional advisors (lawyers, auditors, tax advisors) when necessary, and under standard professional obligations of confidentiality.

Regulators, law enforcement, or courts where we are legally compelled to disclose.

We do not sell your personal information. We do not share it with advertising networks. We do not provide it to data brokers under any circumstances.

Some of our sub-processors are located outside South Africa, including in the European Union, the United Kingdom, and the United States. Where personal information is transferred outside South Africa, we ensure that the recipient is bound by laws or contractual terms that provide protection substantially similar to POPIA, in line with section 72.

Enquiry and intake correspondence — up to twenty-four months from last contact, unless you ask us to delete it sooner, or unless we have begun an engagement with you.

Engagement and contractual records — for the duration of the engagement, plus seven years thereafter, in line with our tax and corporate-record obligations.

Subscribed publication addresses — until you unsubscribe.

Website analytics — aggregated and anonymised after twenty-six months.

You have the right to ask us what personal information we hold about you, and to receive a copy.

You have the right to ask us to correct any information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.

You have the right to object to our processing on reasonable grounds, and to ask us to stop processing for direct marketing.

You have the right to withdraw any consent you have given, at any time, without affecting the lawfulness of processing prior to the withdrawal.

You have the right to lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za if you believe we have not complied with POPIA.

To exercise any of these rights, write to privacy@flowuity.com. We will respond within thirty calendar days.

We protect personal information with technical and organisational measures that are reasonable in the context of our business — encryption in transit and at rest, role-based access, audit logging, principle of least privilege, regular review of sub-processors, and incident response procedures aligned with section 22 of POPIA.

In the event of a security compromise involving personal information, we will notify the Information Regulator and any affected data subjects in accordance with POPIA, as soon as reasonably possible after becoming aware of the compromise.

We use a small number of strictly necessary cookies to make our website and progressive web application work — for example, to remember whether you have dismissed a notice. We use first-party analytics cookies to understand how the site is used, in aggregate. We do not use third-party advertising cookies. Where consent is required by law for non-essential cookies, we will request it before placing them.

We will update this notice when our practice changes, or when the law changes. The "Last updated" date at the top of this page reflects the latest change. Material changes will be flagged on the home page for at least thirty days.