Privacy policy.

1. Introduction

Servana Pty Ltd (“Servana”, “we”, “us”, “our”) respects your privacy and is committed to protecting the personal information you share with us. We handle personal information in accordance with the Protection of Personal Information Act, 2013 (“POPIA”), the Promotion of Access to Information Act, 2000 (“PAIA”) and other applicable South African law.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have in relation to it. It applies to our website at servanaplatforms.com (the “Website”), to our products, and to our security and compliance services, except where a separate product- or engagement-specific privacy notice says otherwise.

By using the Website, submitting information to us, or engaging our products or services, you acknowledge that you have read and understood this policy.

2. Who we are (the Responsible Party)

For the purposes of POPIA, Servana is the “responsible party” that determines why and how your personal information is processed. Our details are:

• Legal name: Servana Pty Ltd
• Registration number: 2025/897026/07
• Registered address: 95 Owl Road, Kikuyu Estate, Midrand, Gauteng, 2090, South Africa
• Information Officer: contactable at legal@servanaplatforms.com
• General enquiries: hello@servanaplatforms.com

Our Information Officer is registered (or in the process of being registered) with the Information Regulator of South Africa and is responsible for ensuring our compliance with POPIA.

3. Scope of this policy

This policy applies to personal information we process:

• through the Website, its forms and its communications;
• when you request a demo, subscribe to updates, apply for a role, or contact us;
• when you use our products, such as Roo; and
• when you engage, or enquire about, our security and compliance services.

Our products and client engagements may involve additional or more specific privacy terms. Where those terms conflict with this policy, the product- or engagement-specific terms govern the processing carried out within that product or engagement.

4. Definitions

In this policy:

• “Personal information” means information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person, as defined in POPIA.
• “Special personal information” means information about religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour.
• “Processing” means any operation performed on personal information, including collecting, storing, using, sharing, or deleting it.
• “Operator” means a person who processes personal information on our behalf under our authority (for example, a hosting or email provider).
• “Data subject” means the person to whom personal information relates.

5. Information we collect

We collect and process the following categories of personal information, depending on how you interact with us:

• Identity and contact information — your name, email address, telephone number, job title, and the company or institution you represent.
• Enquiry and communication content — the content of demo requests, messages, ideas, feedback, and correspondence you send us.
• Account and product information — where you use a product such as Roo, the information needed to create and operate your account and the content you generate within it.
• Engagement information — for security and compliance services, information about the systems, environments, policies and personnel within the agreed scope of work, which may include technical data and, incidentally, personal information of your staff or users.
• Recruitment information — where you apply for a role, your CV, qualifications, work history, and any information you choose to share.
• Technical and usage information — IP address, browser type, device information, referring pages, and pages visited, collected through standard server logs and privacy-respecting analytics.
• Transaction information — where you purchase a product or service, billing details and records of payments (card details are handled by our payment processors, not stored by us).

We try to collect only what we need for the purpose at hand. We do not knowingly collect special personal information through the Website, and we ask that you do not send us special personal information unless we have specifically requested it.

6. How we collect information

We collect personal information:

• Directly from you — when you complete a form, email us, book a demo, create an account, apply for a role, or engage our services.
• Automatically — through cookies and server logs when you use the Website, as described below.
• From third parties — for example, from your colleagues who introduce you, from public sources such as a company website or professional network, or from service providers who help us operate our business, where lawful to do so.

Where the law requires your consent, we will ask for it. Where we rely on another lawful basis, we will process your information only as this policy describes.

7. Cookies and similar technologies

A cookie is a small text file placed on your device. Our Website uses:

• Strictly necessary cookies, which are required for the Website to function and remain secure. These do not require your consent.
• Analytics and performance cookies (if and where enabled), which help us understand how the Website is used so we can improve it. Where these are not strictly necessary, we rely on privacy-respecting analytics and, where required, your consent.

We do not currently use third-party advertising or cross-site tracking cookies. You can control or delete cookies through your browser settings; blocking strictly necessary cookies may affect how the Website works. If we introduce non-essential cookies in future, we will update this policy and, where required, request your consent first.

8. Why we process your information, and our lawful basis

We process personal information for the purposes below, relying on one or more of the lawful grounds in section 11 of POPIA — your consent; the conclusion or performance of a contract; compliance with a legal obligation; the protection of a legitimate interest of yours; or the pursuit of our (or a third party’s) legitimate interests:

• to respond to your enquiries and demo requests, and to provide the products and services you ask for;
• to create and administer product accounts and deliver product features;
• to scope, plan, perform and report on security and compliance engagements;
• to send you service messages and, where you have opted in, updates and newsletters;
• to process payments, issue invoices, and keep accounting records;
• to consider job applications and manage recruitment;
• to operate, secure, maintain and improve the Website, our products and our services;
• to detect, prevent and respond to fraud, abuse, and security incidents; and
• to comply with the law and to establish, exercise or defend legal claims.

9. Special personal information and children

We do not seek to process special personal information through the Website. Where processing of special personal information is unavoidable during a service engagement, we do so only where POPIA permits it and under appropriate safeguards set out in the engagement agreement.

Our Website and products are not directed at children under 18, and we do not knowingly collect the personal information of children without the consent of a competent person (such as a parent or guardian). If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

10. Direct marketing

We will only send you electronic marketing (such as newsletters or product updates) where you have consented, or where you are an existing customer and the law permits us to market similar products or services to you.

Every marketing message includes an easy way to opt out, and you can unsubscribe at any time by using the link in the message or by emailing legal@servanaplatforms.com. Opting out of marketing does not stop essential service messages, such as security or billing notices, which we may still need to send you.

11. How we share your information

We do not sell your personal information. We share it only as necessary and as described here:

• Operators (service providers) who process information on our behalf — for example hosting, cloud infrastructure, email, analytics, customer-support, and payment providers — under written agreements that require them to protect your information and process it only on our instructions.
• Professional advisers such as auditors, lawyers and accountants, where reasonably required.
• Authorities and other parties where required by law, regulation, court order or lawful request, or to protect our rights, our users, or the public.
• A successor entity in connection with a merger, acquisition, restructuring or sale of assets, subject to this policy.

We do not disclose the confidential information or findings of a client engagement to any third party except as agreed with that client or as required by law.

12. Cross-border transfers

Some of our operators may store or process personal information outside South Africa. Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA — that is, where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, where you have consented, where the transfer is necessary to perform a contract with you, or where it is otherwise permitted. You may contact us for more information about the safeguards we apply.

13. How we protect your information

As required by section 19 of POPIA, we maintain reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised access, and unlawful processing. These measures include, as appropriate, access controls, encryption in transit, network and application security practices, staff confidentiality obligations, and vendor due diligence.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security, and you share information with us at your own risk.

14. Security compromises (data breaches)

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering the compromise, in accordance with section 22 of POPIA, unless a public body or law-enforcement authority tells us that notification would impede an investigation. Our notice will provide sufficient information to allow you to take protective measures.

15. How long we keep your information

We keep personal information only for as long as necessary to fulfil the purposes described in this policy, including to satisfy legal, accounting, tax, or reporting requirements, and to establish, exercise or defend legal claims. Retention periods vary by the type of information and the reason we hold it — for example, tax and accounting records are typically kept for at least five years as required by law. When information is no longer needed, we securely delete, destroy or de-identify it.

16. Your rights

Subject to POPIA, you have the right to:

• be told whether we hold personal information about you, and to request access to it (a “data subject request”);
• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained;
• object, on reasonable grounds, to the processing of your personal information;
• object to direct marketing and withdraw consent to it at any time;
• withdraw consent where we rely on it, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects, other than as permitted by law; and
• lodge a complaint with the Information Regulator.

We will not discriminate against you for exercising any of these rights.

17. How to exercise your rights (and PAIA)

To exercise any of the rights above, email our Information Officer at legal@servanaplatforms.com or use the contact page. We may need to verify your identity before acting on a request, and we may ask for enough detail to locate the relevant information.

Requests for access to information are handled in line with PAIA. Certain requests may attract a prescribed fee, and some information may be withheld where PAIA or POPIA permits or requires. We aim to respond to all requests within the timeframes set by law.

18. Automated decision-making

We do not use your personal information to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you, except as permitted by law or with appropriate safeguards. Where any product feature uses automated processing to generate suggestions (for example, draft feedback in Roo), a human remains responsible for reviewing and deciding how to use those suggestions.

19. Third-party links and products

The Website may link to third-party websites, tools or services that we do not control. This policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to read the privacy notices of any third-party service you use. Where a Servana product integrates a third-party service, we will tell you within that product.

20. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, or the law. The current version is always available on this page, with the “last updated” date shown at the top. Where changes are material, we will take reasonable steps to bring them to your attention. Your continued use of the Website or our services after an update takes effect constitutes acceptance of the updated policy.

21. Complaints and the Information Regulator

If you have a concern about how we handle your personal information, please contact us first at legal@servanaplatforms.com so we can try to resolve it. You also have the right to lodge a complaint with the Information Regulator:

• Information Regulator (South Africa) — JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: https://inforegulator.org.za

22. Contact us

For any question about this policy, or to exercise your rights, contact our Information Officer at legal@servanaplatforms.com, or reach us through the contact page and a person — not a form — will respond.