Privacy & Cookies Policy

This Privacy & Cookies Policy explains how Think Tank T2 (Pty) Ltd, operating the Automate CRM platform, handles personal information when you use our services, websites, platforms, products, and related tools.

The Protection of Personal Information Act, 2013 (“POPIA”) regulates how personal information must be collected, used, stored, shared, protected, and destroyed. Protecting your personal information is important to us, and we take reasonable steps to ensure that your personal information is protected and kept private.

This policy also serves as a data subject notification as contemplated in section 18 of POPIA. It explains what personal information we collect, why we collect it, how we use it, and what safety measures are in place to protect it.

Personal information means any information that identifies you or specifically relates to you. This may include, but is not limited to:

In the context of Automate CRM, personal information may also include user profiles, tenant account data, lead records, customer records, communication logs, booking records, ticket records, student or learner records, billing records, and platform usage information.

In some cases, the supply of personal information is mandatory because we are required by law to collect it. If you do not provide this information, we may not be able to comply with our legal obligations or provide our services to you.

In other cases, the supply of personal information is voluntary. However, even where the law does not require us to collect certain information, we may need it to provide the Automate CRM platform, create your account, manage your workspace, support your users, process transactions, or deliver services to you.

If you choose not to provide required information, we may be unable to provide some or all of our services.

We will process your personal information for lawful purposes relating to our business where:

• you have consented to the processing;
• a person legally authorised by you, the law, or a court has consented;
• processing is necessary to conclude or perform a contract with you;
• the law requires or permits the processing;
• processing is required to protect or pursue your, our, or a third party’s legitimate interests;
• processing is necessary to provide, secure, improve, or support the Automate CRM platform.

Special personal information may include information about race, ethnic origin, health, biometric information, criminal behaviour, religious beliefs, political persuasion, trade union membership, philosophical beliefs, or sex life.

We will only process special personal information where the law allows us to do so, where you have consented, where it is required for human resources or payroll purposes, where it is needed to create, use, or protect a right or obligation in law, or where processing is required or permitted by applicable legislation.

We may collect personal information from:

• you directly;
• your company, employer, school, training provider, or organisation;
• public records;
• areas where you have deliberately made information public;
• your use of Automate CRM, our websites, products, service channels, or support platforms;
• your communication with us through email, telephone, support tickets, forms, surveys, or online channels;
• partners, service providers, payment processors, banks, and third-party integrations;
• regulatory authorities, courts, government departments, or law enforcement agencies where applicable.

Where the law requires us to obtain consent before collecting personal information from third parties, we will request such consent.

We may process your personal information to:

We may also process personal information to communicate with you, respond to enquiries, provide support, improve services, conduct customer satisfaction surveys, send service notifications, develop and test products, perform research and analytics, and carry out any related lawful business purpose.

We may use your personal information to market Automate CRM products, services, features, promotions, or related offerings to you.

We may do this in person, by post, telephone, SMS, email, or other electronic channels. Where required by law, we will only send electronic direct marketing to you with your consent.

You may request us to stop sending marketing communications to you at any time by using the unsubscribe option provided or by contacting us.

We will generally only share personal information where:

• you have consented;
• it is necessary to conclude or perform a contract with you;
• the law requires or permits it;
• it is necessary to protect or pursue your, our, or a third party’s legitimate interests;
• it is necessary to provide, secure, support, or improve Automate CRM services.

We may share information with:

• authorised Automate CRM personnel;
• client or tenant administrators;
• service providers, hosting providers, cloud providers, and email providers;
• payment service providers and banks;
• professional advisers, auditors, legal advisers, and compliance providers;
• regulators, courts, law enforcement agencies, or government bodies where required.

We may transfer personal information to third parties in another country where the transfer is allowed by law, including where:

• the information will be adequately protected under the other country’s laws or by agreement;
• the transfer is necessary to perform a contract with you;
• the transfer is necessary for a contract with a third party that is in your interest;
• you have consented to the transfer;
• the transfer is in your interest and it is not reasonably practical to obtain your consent.

Where possible, we will require third parties outside South Africa to apply appropriate safeguards to protect your personal information.

We take appropriate and reasonable technical and organisational steps to protect personal information in line with industry practices.

• keeping systems secure by monitoring access and usage;
• storing records securely;
• controlling access to systems, databases, files, and records;
• using authentication and access permissions;
• using secure hosting and backup processes where applicable;
• safely destroying or deleting records where appropriate;
• reviewing and improving safeguards over time.

We will keep personal information for as long as:

• the law requires us to keep it;
• a contract between you and us requires us to keep it;
• you have consented to us keeping it;
• we need it to achieve the purposes listed in this policy;
• we require it for statistical, research, audit, or reporting purposes;
• a code of conduct requires us to keep it;
• we require it for lawful business purposes.

A cookie is a small piece of data sent from our website or application to your browser or device, where it may be saved. Cookies help personalise your experience, improve our services, remember preferences, support login sessions, measure usage, and improve security.

Automate CRM may use cookies and similar technologies for:

• remembering that you have visited the website or platform before;
• identifying your browser or device;
• maintaining secure sessions;
• preventing fraud or misuse;
• understanding website and platform usage;
• analytics and performance improvement;
• improving user experience.

By using our websites, applications, or platform, you agree that cookies may be used as described in this policy. You may manage cookies through your browser settings, although disabling cookies may affect how some features work.

You must provide proof of identity when enforcing your rights. You must also inform us when your personal information changes so that we can keep our records accurate.

You have the right to request:

• confirmation that we hold personal information about you;
• a copy or description of the record containing your personal information;
• the identity or categories of third parties who have had access to your personal information;
• correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information;
• restriction of processing where allowed by law;
• withdrawal of consent where processing is based on consent;
• objection to processing on reasonable grounds where allowed by law.

It may take up to 15 business days for certain changes to reflect on our systems. If the law requires us to keep certain personal information, it may not be deleted upon request.

Objections, Withdrawal of Consent and Complaints

You may object on reasonable grounds to the processing of your personal information. You may also withdraw consent where you previously provided consent. We will explain the consequences of withdrawal where relevant.

You also have the right to file a complaint with us or with a regulator that has jurisdiction over personal information protection matters.

For any query about this Privacy & Cookies Policy or our processing of personal information, please contact our Information Officer or Compliance Team.