POPIA Notice

1. Who we are under POPIA

For prospect and client data, The AI Team is the Responsible Party.

For end-customer data we process on behalf of clients (e.g. running an AI receptionist or copilot built under The Pilot, Programme, or A-Team), The AI Team is the Operator — the client is the Responsible Party. The relationship is governed by the Data Processing Addendum in our Master Services Agreement.

2. Information Officer

Our Information Officer handles all privacy queries, requests, and complaints:

📧 Email: hello@theaiteam.co.za
📱 WhatsApp: +27 63 218 2763
💬 Via our contact page

3. The eight POPIA conditions and how we meet them

1. Accountability. We take responsibility for ensuring all eight conditions are met whenever we process personal information.

2. Processing limitation. We collect only what's needed for specific, legitimate purposes — running discovery calls, delivering signed engagements, complying with SA law.

3. Purpose specification. We tell you why we collect information at the point we collect it (in this notice and in our Master Services Agreement). We don't repurpose it.

4. Further processing limitation. Any new use must be compatible with the original purpose, or we get fresh consent.

5. Information quality. We keep records accurate and current. Tell us if your details change.

6. Openness. This notice plus our Privacy Policy set out exactly what we do.

7. Security safeguards. Encrypted connections, access controls, secrets management, reputable cloud providers. Where a security compromise affects you, we notify you and the Information Regulator as soon as reasonably possible (POPIA s.22).

8. Data subject participation. You can access and correct your information at any time (see Section 6 below).

4. The lawful basis we rely on

• Contract — to deliver services you've signed for.
• Legal obligation — to comply with SARS and other SA law.
• Legitimate interest — to operate, secure, and improve our service.
• Consent — for direct marketing or any processing not covered above.

5. Cross-border transfers

Some of our infrastructure providers (AI model providers, cloud hosting) operate outside South Africa. Where personal information is transferred outside SA, we ensure the recipient is bound by law, contract, or binding corporate rules that uphold protections substantially similar to POPIA (s.72).

Specifically: AI providers (OpenAI, Anthropic, Google) operate under enterprise data processing agreements that prohibit using customer data for model training and that meet POPIA-equivalent standards.

6. Your rights as a data subject

• Be informed your information is being collected (this notice).
• Request access to information we hold (POPIA s.23).
• Request correction or deletion of inaccurate, irrelevant, excessive, or out-of-date information (s.24).
• Object to processing on reasonable grounds, including for direct marketing (s.11(3)).
• Withdraw consent where consent is the basis.
• Not be subject to automated decision-making with legal effect (s.71).
• Submit a complaint to the Information Regulator.

To exercise any right, contact our Information Officer. We respond within 30 days (usually faster).

7. Direct marketing

We will not send you marketing by electronic communication unless you have explicitly opted in, or are an existing client who has not opted out. Every marketing message includes an unsubscribe option.

8. The Information Regulator

If you believe we have not handled your information appropriately and you are not satisfied with our response:

🌐 inforegulator.org.za
📧 complaints.IR@justice.gov.za
📍 JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

9. PAIA Manual

Our Promotion of Access to Information Act (PAIA) Manual is available on request via our contact page.