Privacy Policy

This Privacy Policy explains how Elula Business Dynamics (Pty) Ltd (Registration 2021/607597/07), trading as Elula BizHub ("EBD", "we", "us" or "our"), collects, uses, shares and protects personal information, in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Who we are and what this policy covers

This policy applies to personal information about our customers and the people who work for them; prospective customers and people who make enquiries; visitors to elulabizhub.co.za and any other website or landing page we operate for ourselves; people who contact us by phone, email, WhatsApp or social media; and our suppliers and business contacts.

Our two roles. For the personal information described above, EBD is the responsible party: we decide why and how it is processed. When our customers load information about their own customers, prospects and callers onto Elula BizHub, the customer is the responsible party and EBD acts as its operator, processing that information only on the customer's instructions.

Information Officer. Our Information Officer is Gary Maulgue, who can be contacted at info@elulabiz.co.za or +27 60 017 9494, or at 76 Wagenaar Road, Edenvale, Gauteng, South Africa.

This policy forms part of our Terms & Conditions. Words defined in the Terms have the same meaning here.

2. What personal information we collect

We collect only the personal information we need for the purposes in clause 3.

We may also receive personal information from public sources (such as company registers and your public website or social media pages) and from people who refer you to us.

We do not intentionally collect special personal information (such as health, religious or biometric information) about you. Please do not send it to us unless we ask for it for a specific lawful reason.

Providing personal information is voluntary. However, if you do not provide information we need to supply the Services or meet a legal duty, we may not be able to provide the Services to you.

Elula Mobile is supplied by Melon Mobile Business (Pty) Ltd ("Melon"), for which EBD is an independent master dealer. SIM registration under RICA and identity verification are done directly by Melon under its own privacy policy, and Melon invoices and collects all payments for Elula Mobile. We do not collect or store ID numbers, passport numbers, residential addresses or payment details for Elula Mobile.

3. Why we use your personal information and our lawful basis

We process personal information only where section 11 of POPIA allows it.

We will not use your personal information for a purpose that is incompatible with the purpose for which we collected it, unless the law allows it or you consent.

Where we rely on your consent, you may withdraw it at any time by contacting us. Withdrawing consent does not affect processing that took place before you withdrew it.

We do not sell personal information.

4. Direct marketing

If you are an existing customer, we may send you electronic marketing about our own similar products and services. If you are not a customer, we will send you electronic marketing only if you have given your consent, as required by section 69 of POPIA.

Every marketing message will identify EBD and give you a free and easy way to opt out. You can also opt out at any time by emailing info@elulabiz.co.za. We will act on your request promptly.

Opting out of marketing does not stop service messages, such as invoices, account notices and changes to our Terms.

5. Cookies and website analytics

Our website uses cookies and similar technologies to make the site work, remember your preferences, understand how visitors use it and measure our advertising.

Where required, we will ask for your consent before setting analytics or marketing cookies. You can change your preferences through our cookie banner or your browser settings. Blocking some cookies may affect how the site works.

Third-party advertising and analytics providers process data under their own privacy policies.

6. Who we share personal information with

We share personal information only where necessary for the purposes in clause 3, and only with:

• our operators (service providers) who help us run our business, including CRM and hosting infrastructure, AI providers, telecommunications, email, SMS and WhatsApp providers, payment processors (PayFast), accounting software, and IT support;
• Melon Mobile Business, which supplies Elula Mobile, to set up, manage and support your mobile service. Melon processes this information as a responsible party under its own privacy policy;
• professional advisers, such as our attorneys, accountants and auditors, who are bound by confidentiality;
• advertising and social media platforms, such as Meta and Google, for measuring and delivering our own advertising;
• regulators, law enforcement and courts, where the law requires it or to protect our legal rights; and
• a buyer or successor of our business, if EBD is sold or restructured, subject to the same protections.

Every operator that processes personal information for us must do so under a written agreement that requires it to process the information only on our instructions, keep it confidential and secure it appropriately, as required by sections 20 and 21 of POPIA.

7. Transfers outside South Africa

Some of our operators store or process personal information outside South Africa, including in the United States and the European Union, because the cloud, CRM, AI and messaging services we use are hosted there.

We transfer personal information outside South Africa only where section 72 of POPIA allows it, for example where the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection substantially similar to POPIA; the transfer is necessary to perform our contract with you; or you have consented to the transfer.

By using our Services, you acknowledge that your personal information may be transferred and processed outside South Africa on this basis.

8. Security, breaches and how long we keep information

Security

We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, and unauthorised access or use, as required by section 19 of POPIA. These include access controls and multi-factor authentication, encryption in transit, role-based staff access, confidentiality undertakings, regular review of our security measures, and choosing reputable operators.

No system is completely secure. Please keep your login details private and tell us immediately if you suspect unauthorised access to your account.

Security compromises

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible, as required by section 22 of POPIA. Where we act as an operator, we will notify the affected customer immediately so that it can meet its own obligations.

Retention

We keep personal information only for as long as we need it for the purposes in clause 3, or as long as the law requires or allows.

After the retention period, we delete, destroy or de-identify the information so that it can no longer be linked to you. We may keep information longer where it is needed to establish or defend a legal claim.

9. Your rights

Under POPIA, you have the right to:

• know whether we hold personal information about you, free of charge (section 23);
• access the personal information we hold about you and know who has had access to it (section 23);
• ask us to correct, update or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• object to us processing your personal information on the basis of our legitimate interest (section 11(3));
• object to direct marketing and unsubscribe at any time (sections 11(3)(b) and 69);
• withdraw your consent where we rely on it;
• not be subject to a decision with legal or similarly significant effects based solely on automated processing, including profiling, except as allowed by section 71; and
• complain to the Information Regulator.

How to exercise your rights. Email our Information Officer at info@elulabiz.co.za. We may need to verify your identity before acting. We will respond within a reasonable time, and in any event within 30 days.

Requests for access to records are handled under the Promotion of Access to Information Act 2 of 2000 (PAIA). We may charge the fee prescribed under PAIA for providing copies of records, and will tell you the fee before we proceed. Our PAIA manual is available on request.

We may refuse a request where the law allows it, for example where it would disclose another person's personal information or legally privileged information. We will tell you the reason.

Complaints to the Information Regulator. We encourage you to contact us first so that we can try to resolve your concern. You may also lodge a complaint with the Information Regulator of South Africa at any time. Its current contact details are published at inforegulator.org.za.

10. Information we process for our customers (as operator)

Our customers use Elula BizHub to manage their own customers, prospects and callers. For that information, our customer is the responsible party and decides why and how it is processed. EBD processes it only as the customer's operator, under our Terms & Conditions.

If you are a customer, prospect or caller of a business that uses Elula BizHub, and you have questions about your personal information or want to exercise your rights, please contact that business directly. If you contact us, we will refer your request to the business concerned and help it respond.

As an operator, EBD will not use our customers' data for its own purposes, sell it, or use it to market to the people in it.

Where you ask us to help manage your Elula Mobile account in the Melon Mobile Business portal, we process the user, SIM and usage information in it as your operator, only to manage your account on your instructions.

11. Artificial intelligence and call recordings

Some of our Services, including Elula Voice, use artificial intelligence to answer calls and messages, transcribe and summarise conversations, draft content and route enquiries. Personal information in these interactions may be processed by our AI providers as our operators, under the safeguards in clauses 6 and 7.

We configure our AI providers so that customer content is not used to train their general AI models, where the provider offers that option.

Where Elula Voice answers or records calls for a business that uses our Services, that business is responsible for telling callers that an AI assistant may answer and that calls may be recorded.

We do not use AI to make decisions about you that have legal or similarly significant effects without human involvement.

12. Children

Our Services are intended for businesses and are not directed to children under 18. We do not knowingly collect personal information about children. If you believe we have done so, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be published on our website with a new effective date. If we make material changes, we will notify our customers by email at least 30 days before they take effect.

14. Contact us