Home Orbio App Privacy Policy PAIA Manual POPIA Notice Terms of Service

POPIA Section 18 Privacy Notice

As required by Section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA)

1. Responsible Party

Name: Orbio (Pty) Ltd

Registration Number: 2026/515396/07

Physical Address: Johannesburg, South Africa

Contact Email: info@orbio.africa

Information Officer: Jody-Lee Sias (paia@orbio.africa)

2. Purpose of Collection

We collect and process your personal information for the following purposes:

To provide CRM and ITSM services
To manage customer relationships and support
To comply with legal and regulatory obligations
For internal business administration and analytics
To communicate with you about our products and services

3. Categories of Personal Information

We may collect the following categories of personal information:

Personal details: Name, surname, email address, phone number
Employment details: Job title, department, organisation
Technical data: IP address, browser information, device ID
Usage data: Service interactions, preferences, activity logs

4. Lawful Basis for Processing

We process your personal information based on the following lawful grounds under POPIA:

Consent: Where you have provided explicit consent
Contract: Where processing is necessary for the performance of a contract
Legal Obligation: Where required by South African law
Legitimate Interest: For our legitimate business interests

5. Data Recipients and Transfer

Your personal information may be shared with:

Our service providers and contractors (under confidentiality agreements)
Regulatory authorities when legally required
Business partners with your consent

Cross-border transfers: Your data may be transferred to and stored on cloud infrastructure located outside South Africa (currently Oregon, USA). We ensure adequate data protection for all cross-border transfers as required by POPIA Section 72, including Standard Contractual Clauses and Data Processing Agreements with all sub-processors.

6. Your Rights as a Data Subject

Under POPIA, you have the right to:

Access: Request details of personal information we hold about you
Correction: Request correction of inaccurate or outdated information
Deletion: Request deletion of your personal information
Objection: Object to processing of your personal information
Data Export (service feature): Request your data in a structured, machine-readable format — offered as a convenience, not a POPIA-guaranteed right
Withdraw Consent: Withdraw consent at any time
Lodge a Complaint: Complain to the Information Regulator

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this notice, or as required by law. Default retention period is 7 years. After this period, your data will be securely deleted or anonymised.

8. Security Measures

We implement appropriate technical and organisational security measures to protect your personal information, including:

Encryption of data in transit and at rest
Access controls and role-based permissions
Regular security assessments
Staff training on data protection

9. How to Exercise Your Rights

To exercise any of your data subject rights, please contact us below, or submit a request directly via our DSAR Portal:

Email (DPO): dpo@orbio.africa

Information Officer: Jody-Lee Sias (paia@orbio.africa)

Address: Johannesburg, South Africa

Information Regulator (South Africa)

Salu Building, 33 Hoofd Street, Pretoria, 0001

Email: enquiries@inforegulator.org.za

Website: www.inforegulator.org.za

Tel: +27 (0)10 023 5200

10. Collection of Information from Data Subject

We collect personal information directly from you, the data subject, where you:

Register for or use our CRM and ITSM services
Submit enquiries, support requests, or feedback
Complete forms or documentation
Communicate with us via email, phone, or our portal

We may also collect information from publicly available sources, business partners, or your organisation, in accordance with POPIA Section 13.

Mandatory vs Optional: The following personal information is mandatory to create and maintain your account: email address, name, and organisation name. Without this information, we cannot provision your account or provide the platform services. The following information is optional: profile picture, phone number, and marketing preferences. You may decline to provide optional information without affecting your ability to use the platform.

11. Consequences of Failure to Provide Personal Information (Section 18(1)(e))

If you fail to provide the mandatory personal information described above, we will be unable to create your account, provision your tenant, or provide the platform services. You will not be able to register or use Orbio. Failure to provide optional information will not affect your access to the platform.

12. Automated Decision-Making (Section 18(1)(m))

Orbio does not make decisions based solely on automated processing that produce legal effects concerning data subjects. Where automated decision-making is used (e.g., workflow triggers, SLA breach detection), human oversight is always available and data subjects may request manual review.

13. Notification of Changes (Section 18(1)(n))

Where we provide your personal information to a third party (in accordance with Section 19 of POPIA) or process your personal information for a new purpose not originally collected for, we will take reasonable steps to ensure that you are notified of such changes before the new processing begins, unless notification is impracticable or legally impermissible.