How we handle your personal information

1. Who we are

Pattern Interrupt Consulting (Pty) Ltd (registration number 2024/596441/07) is the responsible party for the personal information described in this notice. We provide POPIA compliance, AI governance and training services to businesses.

This notice explains what we collect, why, and what you can do about it, as section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) requires. It covers this website, enquiries, bookings and client work. Keep Me Safe Online (keepmesafeonline.org) is a separate programme with its own privacy notice.

2. What we collect

When you contact us or book a call

• Your name, email address, phone number, job title and organisation.
• Anything you choose to tell us about your business or your question.
• Your booking details if you use Calendly, and the video call details if the meeting takes place on Zoom.
• Recordings, transcripts and notes of our video calls, made with Fathom and Zoom's meeting summary feature. We tell you at the start of each call, and if you would rather not be recorded, we switch recording off.
• Invoice and payment details for a scope call, such as your name or organisation, billing details and your proof of payment.
• The details you send in our speaking enquiry form, such as your event, date, audience and budget.

When you become a client

• Contact and billing details for you and your organisation.
• Information you give us to carry out the work, which may include personal information about your staff, customers or suppliers. We receive this information from the client, not from the people it is about. Section 4 explains our role for that information.

When you visit this website

• Our hosting provider's servers record technical information such as your IP address, browser type and the pages you request. This is standard for any website and is used for security and to keep the site running.
• We count visits with Cloudflare Web Analytics. When a page loads, a small script sends Cloudflare the page you visited, the website that referred you, your browser and operating system, and your country. Cloudflare states that it does not use cookies or other storage on your device and does not fingerprint visitors. We see only totals, never individual visitors.

Giving us your information is voluntary. If you don't give us contact details, we can't reply to your enquiry or arrange a meeting.

Children and special personal information

This website and our services are aimed at businesses, and we do not knowingly collect children's personal information through it. Client work may involve children's personal information or special personal information, such as health information. We then process it only as the client's operator, on the client's lawful basis, and we ask clients to send only what the work needs.

3. Why we use it

We don't sell personal information, and we don't use it to make automated decisions about you.

4. Our role and who we share information with

Our role

For enquiries, bookings, client administration and our own business records, we are the responsible party: we decide why and how that information is processed.

When a client gives us personal information about its staff, customers or suppliers so that we can do the work, our role depends on the engagement. Where we process it only for the client's purposes and under its mandate, we act as the client's operator under sections 20 and 21 of POPIA, and the client remains the responsible party. The engagement letter records our role and the terms that apply.

Service providers

We use these providers for the functions shown, under their terms of service and data processing terms. We share only what each one needs for that function.

• Data Keepers: website and email hosting.
• Google: document storage and backups (Google Drive), meeting invitations (Gmail) and our speaking enquiry form (Google Forms).
• Cloudflare: website visit statistics, without cookies (Cloudflare Web Analytics).
• Calendly: meeting bookings.
• Zoom: video meetings booked through Calendly, and meeting summaries.
• Fathom: recording and transcribing video calls.
• Our accountant: accounting and tax records.

AI tools

We use AI tools to help with drafting and research. We limit the client personal information we enter into them to what the work needs, use them under terms that protect that information, and check all output ourselves. We do not allow our content to be used to train these tools where the provider gives us that choice.

We may also disclose information where the law requires it, for example to a regulator, a court or the South African Revenue Service.

5. Information sent outside South Africa

Google, Cloudflare, Calendly, Zoom, Fathom and our AI tool providers process information outside South Africa, mainly in the United States. For these transfers we rely on section 72(1)(a) of POPIA: each provider is bound by data protection terms that we treat as a binding agreement giving protection substantially similar to POPIA's conditions, including on onward transfers. We check these terms when we take on a provider and when they change.

If you would rather not use these services, email us and we will arrange a call another way.

6. How long we keep it

We keep personal information only for as long as reasonably necessary for the purpose we collected it for, unless keeping it longer is required or authorised by law, reasonably required for a lawful purpose related to our activities, required by a contract, or otherwise permitted by section 14 of POPIA. Retention periods differ by type of record:

• Enquiries and speaking requests that don't lead to work: deleted 12 months after our last contact.
• Call recordings, transcripts and meeting notes: deleted 90 days after the call, unless the work goes ahead, in which case they form part of the engagement records.
• Engagement records (engagement letters, correspondence and working papers): kept for five years after the engagement ends, so that we can deal with questions or claims about the work.
• Company and accounting records, including payment records: kept for seven years, as section 24 of the Companies Act 71 of 2008 requires. This also covers the record-keeping periods under tax law.
• Website visit statistics: Cloudflare keeps detailed visit data for seven days and then only aggregated figures. We see totals for up to six months.
• Server logs and backups: kept by our hosting provider for security and recovery on a rolling basis, and overwritten when no longer needed for those purposes.

When we may no longer keep information, we securely delete, destroy or de-identify it in a way that prevents it from being reconstructed (s 14(4) and (5)).

7. How we protect it

As section 19 of POPIA requires, we take reasonable technical and organisational measures to protect personal information. These include encrypted connections to this website, password-protected accounts with multi-factor authentication where available, written agreements with our operators, and limiting access to the people who need it.

If we have reasonable grounds to believe your personal information has been accessed or acquired without authorisation, we will notify the Information Regulator and you as soon as reasonably possible after discovering it, as section 22 requires. We may delay notifying you only if the police or the Regulator decide that notification would impede a criminal investigation (s 22(3)).

8. Cookies and tracking

This website sets no cookies and does not use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which works without cookies. If you follow a link to Calendly, LinkedIn or Google, those sites apply their own cookie and privacy policies. See our cookie policy.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request a copy (s 23);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or to destroy or delete information we are no longer authorised to keep (s 24);
• object to processing based on our legitimate interests (s 11(3)), and object to direct marketing at any time (s 69);
• withdraw consent where we rely on it (s 11(2)(b)).

Email the Information Officer at rene@piconsulting.tech. We may need to confirm your identity first. We respond within a reasonable time, normally within 30 days. The POPIA Regulations, 2018 prescribe Form 1 for objections and Form 2 for requests to correct or delete information. Both are on the Regulator's website, and we will send them to you on request. Requests for records can also be made under our PAIA manual.

10. Complaints

You may contact us so that we can try to resolve your concern. You may also complain directly to the Information Regulator (s 74):

11. Changes to this notice

We will update this notice when our practices change. The effective date at the top shows when it last changed.