POPIA Notice

Last updated: 9 November 2026

This notice is provided by Zarto (Pty) Ltd, through its Zarto AI division, as a responsible party under section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). Please read it with our Privacy Policy.

1. Responsible party

Zarto AI, a division of Zarto (Pty) Ltd, registration number 2026/882078/07, 77 Sea Hare Circle, Cape Town, 7441, South Africa. Email: info@zartoai.com.

2. Information Officer

Our Information Officer is Etiene van Wyk, who can be contacted at info@zartoai.com.

3. Information we collect and its source

We collect the information you give us through our contact form or by email: your name, email address, optional phone number, project type and message. Technical information, such as your IP address and browser details, is collected automatically when you use the website. Details are in our Privacy Policy.

4. Purpose of processing

• Responding to enquiries and discussing and preparing proposals for projects.
• Keeping records of our correspondence.
• Keeping the website secure and protecting our forms from spam, fraud and automated abuse.
• Understanding how visitors use the website, only with consent.
• Complying with legal obligations.
• Direct marketing, only as section 69 of POPIA permits, with the right to opt out at any time.

5. Lawful basis

We process personal information with your consent, where necessary to take steps towards or perform a contract with you, to comply with a legal obligation, or to pursue our or a third party’s legitimate interests, as permitted by section 11 of POPIA.

6. Voluntary or mandatory

Providing your information is voluntary. No law requires you to give it to us through this website. If you do not provide your name, a way to contact you and a description of what you need, we cannot respond to your enquiry. Choosing not to allow optional analytics has no effect on your use of the website.

7. Recipients and cross-border transfers

We share information with our service providers: Cloudflare, Inc. (website hosting, security, form processing and, with consent, visitor statistics), Resend (email delivery) and xneelo (email hosting). Cloudflare and Resend may process information outside South Africa, including in the United States and the European Union. We make these transfers as permitted by section 72 of POPIA, subject to each provider’s data processing terms, and with your consent when you submit our form.

8. Your rights as a data subject

• To be told that your personal information is being collected.
• To ask whether we hold your personal information, and to request access to it.
• To request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
• To object to processing on reasonable grounds, and to object to direct marketing.
• To withdraw consent at any time, without affecting earlier lawful processing.
• Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, as provided in section 71 of POPIA.
• To lodge a complaint with the Information Regulator.

9. How to exercise your rights

Send your request to our Information Officer at info@zartoai.com. The POPIA Regulations prescribe Form 1 for objections and Form 2 for correction or deletion, and we can send you these forms. We may need to verify your identity before acting on a request, and will respond within a reasonable time and in line with POPIA and the Promotion of Access to Information Act 2 of 2000. To withdraw consent to analytics, use the Cookie settings link at the bottom of any page.

10. Security safeguards

As required by section 19 of POPIA, we maintain appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information, including encrypted (HTTPS) connections, restricted access to our systems and mailboxes, bot protection and limits on repeated form submissions.

11. Security compromises

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as required by section 22 of POPIA.

12. Information Regulator

If you are not satisfied with how we handle your personal information, you may complain to the Information Regulator (South Africa). Website: inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za.

13. Visitors in Namibia

We apply this notice to all visitors and enquirers, including those in Namibia. Please contact our Information Officer to exercise any of these rights. Nothing in this notice limits any right you have under Namibian law.