Privacy Notice

Ecopackaging (Pty) Ltd, registration number 2014/032538/07, VAT registration number 4530265216, trading as KRAGOS, of 750 Nieuwhout Street, Garsfontein, Pretoria, 0081, South Africa.

In this notice we, us and KRAGOS mean that company. You means the person whose personal information we process.

Information Officer: Francois Petrus Heunis. Write to ops@kragos.app and mark the message for the Information Officer. This is the sole contact address for privacy matters, including access requests, objections, complaints and breach reports.

Registration with the Information Regulator. Section 55 of the Protection of Personal Information Act 4 of 2013 (POPIA) requires the Information Officer to register with the Information Regulator before taking up duties. This registration is an outstanding action. We flag it here rather than assert that it is done. This notice will be updated with the registration date and reference on completion.

A manual under section 51 of the Promotion of Access to Information Act 2 of 2000 is available from ops@kragos.app on request.

This notice applies to:

It does not cover a third party website you reach from a link on ours. Those sites have their own notices.

It is written to POPIA, and where it names a right or a basis that comes from the General Data Protection Regulation (EU) 2016/679 (GDPR) it says so. Clause 12 and clause 16 give the GDPR position for visitors outside South Africa.

The distinction matters because it decides who owes you the duty, who you exercise your rights against, and who answers to the Regulator.

Where we are the operator, our undertakings are set out in clause 18 of the Terms of Service and in any signed operator agreement. We process only on the customer's instruction, we keep the data confidential, we secure it, and we notify the customer of a compromise so that the customer can meet its own section 22 duty.

The table below is the whole picture. Each row says what we collect, why, and on what lawful basis. Clause 12 gives the full basis table.

We do not knowingly collect special personal information under section 26 of POPIA through the public surfaces. A customer may load special personal information into its own tenant, in which case clause 18.8 of the Terms of Service applies and the customer must tell us first.

We collect personal information directly from you wherever we can, as section 12 of POPIA requires.

We also receive it from a customer or a prospect who gives us the details of a colleague, from a public source such as the Companies and Intellectual Property Commission or a public website, and from a corporate funder where an enterprise and supplier development programme refers a supplier to us.

Where we receive your information from someone else and you have not dealt with us before, we will tell you at first contact where we got it, unless one of the exceptions in section 18(4) of POPIA applies.

Section 8 of POPIA makes us responsible for giving effect to all eight conditions. We have appointed an Information Officer, we keep this notice current, and we hold our operators and sub-processors to written terms.

Where we are the operator, accountability for the eight conditions sits with our customer as responsible party. We support the customer in meeting it.

Lawfulness and minimality, sections 9 and 10. We process lawfully, in a way that does not intrude unreasonably on your privacy, and we collect only what is adequate, relevant and not excessive for the purpose in clause 5.

Justification, section 11. Every processing operation has a ground in section 11. Clause 12 sets them out per activity.

Consent, and withdrawing it, section 11(2). Where we rely on consent you may withdraw it at any time by writing to ops@kragos.app. Withdrawal does not affect the lawfulness of what we did before you withdrew, and it does not affect processing we do on another ground.

Objection, section 11(3). Where we rely on legitimate interests you may object to the processing on reasonable grounds, at any time, by writing to ops@kragos.app. We will stop unless the law requires us to continue. You do not have to give a reason to object to direct marketing, and we stop that on request without exception.

Collection directly from you, section 12. Clause 6 explains where information comes from and what we do when it does not come from you.

Specific purpose, section 13. We collect for the specific, explicitly defined and lawful purposes set out in clause 5, and we tell you the purpose at the point of collection.

Retention, section 14. We do not keep records that identify you for longer than is necessary for the purpose, unless the law requires us to keep them, a contract requires it, or you have consented. Clause 21 gives the period for each category.

When a period ends we delete the record or de-identify it so that it can no longer be linked to you. Where a record sits in an encrypted backup, deletion follows the backup cycle in clause 21.

Section 15 requires further processing to be compatible with the purpose of collection. We do not repurpose your information.

In particular, and to be explicit: information collected through the free compliance calendar is not sold, is not rented, is not shared with a third party for that third party's own marketing, and is not used to train any artificial intelligence model. It is used to produce your calendar, and, if you asked for it, to send you KRAGOS marketing under clause 15.

Section 16 requires us to take reasonably practicable steps to keep your information complete, accurate, not misleading and up to date.

You can ask us to correct anything that is wrong. Clause 16 gives the route. We would rather you told us than that we kept it wrong.

Section 11(1) of POPIA lists six grounds. We rely on four of them. The two we do not rely on are section 11(1)(d), protection of a legitimate interest of the data subject, and section 11(1)(e), performance of a public law duty by a public body, which does not apply to us.

Where we rely on legitimate interests we have weighed our interest against your rights and freedoms, and we will give you the outcome of that assessment on request.

For visitors and customers outside South Africa, the parallel GDPR bases are:

We do not rely on Article 9 of the GDPR, and we do not seek special category data through the public surfaces.

Where a customer is established in the European Union or the United Kingdom and we act as processor for it, Articles 28 and 32 of the GDPR apply to us in that capacity and we will conclude the required processor terms. Clause 23 records the representative position.

Documentation, section 17. We maintain documentation of our processing operations, and a manual under section 51 of the Promotion of Access to Information Act 2 of 2000, available from ops@kragos.app.

Notification, section 18. This notice is the notification. It is published on kragos.ai, is linked from the footer of every page, and is given to you before or at the time of collection.

What we actually do, section 19. We describe this honestly. We do not claim a certification we do not hold.

What we do not claim. We hold no ISO 27001 certification and no SOC 2 report. We do not claim that our systems cannot be breached. No system can be guaranteed secure, and we do not warrant that ours is.

Operators, sections 20 and 21. Each sub-processor in clause 19 is engaged under written terms that require it to process only on our instruction, to keep the information confidential, and to secure it.

Breach notification, section 22. Where there are reasonable grounds to believe that personal information for which we are the responsible party has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering it, unless the identity of the data subjects cannot be established. Notification will be in writing and will describe, as far as we know it, the possible consequences, the measures we intend to take or have taken, what you can do to protect yourself, and, where the Regulator tells us the identity of the unauthorised person, that identity. We may delay only where a public body responsible for detection of offences tells us that notification will impede a criminal investigation.

Where we are the operator and the compromise affects a customer's tenant, we notify the customer immediately under section 21(2), so that the customer can meet its own section 22 duty. For an EU or UK customer, we will assist within the 72 hour window in Article 33 of the GDPR.

Section 69 of POPIA prohibits direct marketing by electronic communication unless you have consented, or unless you are an existing customer and the conditions in section 69(3) are met.

Consent, section 69(1)(a). Where you are not an existing customer we send you electronic marketing only if you have opted in. The opt-in box is never pre-ticked and is never bundled with acceptance of anything else. We ask you once. If you do not respond we do not ask again, as section 69(2) requires.

Existing customers, section 69(3). Where you are an existing customer we may market our own similar products to you, using the contact details you gave us in the course of a sale, and we give you the opportunity to object at the time of collection and in every message.

The free compliance calendar. This is worth being explicit about. Giving us your email address so that we can send you the calendar is not consent to marketing. Marketing consent is a separate, unticked box on the same form, described in plain words. If you do not tick it we send you the calendar and nothing else. If you tick it we may send you information about KRAGOS products, and you can stop it at any time under clause 15.5.

Opting out. Every marketing message carries an unsubscribe link that works without you having to sign in or explain yourself. You can also write to ops@kragos.app. We action an opt-out within 5 business days and keep a suppression record so that we do not contact you again by mistake. That suppression record is kept for exactly that purpose.

We do not sell, rent or otherwise make your contact details available to a third party for that third party's marketing.

WhatsApp messages sent through the Pulse rail on a customer's behalf are the customer's marketing, not ours. The customer is the responsible party for them, and the opt-out runs to that customer. We maintain the technical opt-out list on the customer's instruction.

Section 5 of POPIA gives you the rights below. Where the GDPR applies to you, it gives you two more, marked in the table.

How to make a request. Write to ops@kragos.app and mark it for the Information Officer. Tell us what you want and give us enough to identify you and to find the record. A POPIA access request under section 23 must be made on Form 2 of the POPIA regulations; we will send you the form if you ask, and we will not refuse a request merely because it did not arrive on the form.

What it costs. Correction, deletion, objection and opt-out are free. A request for access to a record may attract the prescribed fee under section 23(3) of POPIA and the PAIA fee regulations. We will tell you the fee before we do the work, and we will not charge for a simple confirmation of whether we hold information about you.

How long we take. We acknowledge within 5 business days. We respond to a POPIA access request within 30 days of receiving it, extendable once by a further 30 days where the request is complex, in which case we tell you before the first 30 days is up and say why. Where the GDPR applies we respond within one month, extendable by two further months under Article 12(3), with the same notification.

If we say no. We will tell you in writing which ground we rely on, and we will tell you how to complain. We may refuse where the law requires or permits refusal, including where a record is subject to legal privilege, where disclosure would reveal another person's personal information, or where a ground of refusal in the Promotion of Access to Information Act 2 of 2000 applies.

If you are in a customer's tenant. Where we hold your information as operator, we cannot act on your request without our customer's instruction. We will tell you so, tell you who the responsible party is if we may, and pass your request to them promptly.

Please raise it with us first, at ops@kragos.app. We would rather fix it.

You may complain to the Information Regulator at any time, whether or not you have come to us first. A POPIA complaint is made on Form 5 of the POPIA regulations.

Where the GDPR applies to you, you may also complain to the supervisory authority of the Member State where you live, work, or where the alleged infringement happened, under Article 77 of the GDPR.

Nothing in this notice limits your right to approach a court.

We share personal information with the sub-processors in clause 19, each for the purpose stated there and for no other.

We also share it with our professional advisers, our auditors and our bankers where they need it, under a duty of confidence; and with a law enforcement agency, a regulator or a court where the law requires it.

If our business or a part of it is sold, transferred or reorganised, personal information may transfer with it. The acquirer becomes bound by this notice until it gives you a new one.

We do not sell personal information.

Section 72 of POPIA prohibits transferring personal information out of South Africa unless one of five grounds applies. The grounds are: the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection with principles substantially similar to POPIA's, including provisions substantially similar to section 72 for onward transfer; the data subject consents; the transfer is necessary for the performance of a contract between the data subject and the responsible party, or for pre-contractual steps at the data subject's request; the transfer is necessary for the conclusion or performance of a contract concluded in the data subject's interest between the responsible party and a third party; or the transfer is for the data subject's benefit and consent is not reasonably practicable but would probably be given.

The ground we rely on. For each transfer below we rely on section 72(1)(a), a binding written agreement with the recipient that requires an adequate level of protection and that binds onward transfer, and, where the transfer is needed to deliver something you asked for, additionally on section 72(1)(b) or 72(1)(c). Where the GDPR applies, transfers out of the European Economic Area are made on the European Commission's standard contractual clauses under Article 46(2)(c).

The primary is in South Africa. The live data for the products sits with Xneelo in South Africa. Xneelo, VALR, Omnea and its InstaPay WebPay product are South African, and STEMPA's backups with Microsoft Azure are held in its South Africa North region. Everything else in table A is a transfer out of South Africa and is treated as one. That includes Paddle: what you give Paddle at checkout you give to it directly, and what passes between Paddle and us to run your STEMPA Subscription crosses the border on section 72(1)(b) and 72(1)(c), because it is needed to supply the subscription you asked for. Google receives STEMPA's sign-up conversions on section 72(1)(b), your consent, given by ticking the box; nothing goes to Google if you do not tick it.

Two tables, because they are two different things. Table A is the sub-processors we engage to deliver the Services. Table B is services reached only because you connected an account of your own. For table B you are the controller of that account and of what it publishes; we act on your release and pass nothing to it that you did not put there.

Payments. There are two payment routes. Omnea and its InstaPay WebPay product are in table A because we use them to collect payment on our own invoices, including invoices for STEMPA plans paid that way, under a merchant contract held by Ecopackaging (Pty) Ltd with the routing code ECO; both are South African, so paying an invoice is not a cross-border transfer, and the payment page is InstaPay's. Paddle is in table A because it sells STEMPA Subscriptions as our reseller and merchant of record; the checkout is Paddle's, and Paddle is a responsible party in its own right for what you give it there. Card data reaches us on neither route. Clause 7 of the Terms of Service sets out what we do and do not handle, and clause 13 of the Terms of Service records the processor disclosure.

Analytics. There are none. We run no analytics package, no tag manager and no advertising pixel on either surface. If that changes, this notice will be updated and its version number raised before the change goes live, and the Cookie Notice will be updated at the same time. STEMPA's sign-up conversions to Google Ads, in clause 5, are sent from our server, only for people who tick the box. They are not a pixel, a tag or a cookie, and nothing on our pages loads from Google.

No third party fonts, analytics or trackers on the site. The public site loads its typeface from our own server. It makes no request to any host other than its own. This was verified in a browser against the built site, on every page, and the result is recorded in the build proof.

What changed at version 1.2. STEMPA at stempa.kragos.app, with free self-serve accounts and confirmation requests, is now covered: clause 2.1, two rows in the clause 4 table, a new table in clause 5 and new rows in clause 21. Microsoft Azure, South Africa North, was added to table A for STEMPA's backups, and Microsoft as the sender of STEMPA's email. The AI assistant a STEMPA account holder connects was added to table B. The Backblaze backup was described as a backup of the whole server; it is a backup of named data sets, and clause 14.1, table A and clause 21 now say which. The Backblaze retention was stated as purged within 12 months; the backup job does not delete old backups at present, and clause 21 now says so. Xneelo's location is given as South Africa, the city not being recorded in our own register. Microsoft's location is given only as far as we verified it. The STEMPA journal was stated as kept 7 years; clause 21 now states what STEMPA does when a tenant or account closes. Each statement was checked against our own code, our dependency register or the server itself on the version date.

What changed at version 1.1. Omnea, InstaPay WebPay, ClamAV, VALR, Xero, Stability AI and Healthchecks.io were added to table A, and the whole of table B and table C are new. They were found by reading our own code for every outbound connection it makes, rather than by copying the previous list forward.

These tables are current at the version date of this notice. We will update them before adding a sub-processor that processes personal information, and clause 18.5 of the Terms of Service gives customers 30 days notice and a right to object.

What changed at this version, 1.3. Paddle, which sells STEMPA Subscriptions as our reseller and merchant of record, was added to table A, to the table in clause 4, to the STEMPA table in clause 5 and to clause 21, and clauses 19.3 and 19.5 now describe the two payment routes, either of which can be used for a STEMPA plan. No STEMPA Subscription had been sold when this version was published.

What changed at this version, 1.4. STEMPA's sign-up conversions to Google Ads were added: the short version, two rows in the STEMPA table in clause 5, Google in table A, clauses 19.3 and 19.6, and a row in clause 21. Act governance on the self-serve plans was added to the STEMPA table in clause 5 and to the table B row for the AI assistant. No conversion had been sent to Google when this version was published: the uploader had not been started.

Section 71(1) of POPIA prohibits a decision that results in legal consequences for a data subject, or that affects the data subject to a substantial degree, being based solely on the automated processing of personal information intended to provide a profile.

We do not make such a decision solely by automated means. Where AI Output informs a decision, the decision is made by a natural person who holds release authority, who sees what is proposed, and who may refuse it. That person's release is recorded in STEMPA together with the authority relied on.

Because a human makes the decision, the exceptions in section 71(2) are not the basis on which we operate. We do not rely on them, and we do not need to.

Under the GDPR, Article 22(1) gives the same right. Our position is the same: there is meaningful human involvement by a person with the authority and competence to change the outcome, so Article 22(1) is not engaged. Where a customer configures its tenant so that this is no longer true, that customer is the controller of that decision and takes on the Article 22 obligations.

If you believe a decision affecting you was made about you solely by automated means in a KRAGOS product, write to ops@kragos.app. We will tell you what happened, who released it, and on what authority, and if we are the operator we will refer you to the responsible party.

Section 14 of POPIA requires us to keep a record no longer than is necessary. These are the periods.

Where two periods apply to the same record, the longer applies, and only for the purpose that justifies it.

The services are not directed at children. We do not knowingly collect the personal information of a child, as defined in section 1 of POPIA, through the public surfaces, and we do not market to children.

Section 34 of POPIA prohibits processing the personal information of a child except in the circumstances in section 35, including with the consent of a competent person. We do not rely on section 35 for the public surfaces.

If you believe a child has given us personal information, write to ops@kragos.app and we will delete it.

A customer may hold the personal information of a child in its own tenant, for example a non-profit that runs a programme for children. Where it does, that customer is the responsible party, clause 18.8 of the Terms of Service applies, and the customer must comply with sections 34 and 35 itself.

KRAGOS is established in South Africa and does not currently target the European Union or the United Kingdom market. We do not offer the products in a Union or United Kingdom currency or language, and we do not monitor behaviour in those territories.

A representative is an outstanding action, not a claim. If and when we accept a customer established in the European Union or the United Kingdom, and Article 3(2) of the GDPR or the United Kingdom GDPR applies to us as a result, we will appoint a representative under Article 27 before that customer goes live, and we will publish that representative's name and address in this notice. We have not appointed one, and we do not claim to have one.

The GDPR rights and bases set out in this notice are given voluntarily to any visitor who wants them, whether or not the GDPR applies to that visitor.

The Cookie Notice is a separate document, linked from the footer. In short: the public site sets no cookies at all, and uses no local or session storage.

We will update this notice when our processing changes. Every version carries a version number and a last updated date at the top.

Where a change materially affects you, and in particular where we add a sub-processor that processes personal information, add analytics or advertising, or change a retention period, we will raise the version number and, where we have your contact details and the change is material, tell you before it takes effect.

We keep the superseded versions and will provide one on request.