Privacy Policy

1 Who We Are

DSE Connect (Pty) Ltd ("DSE Connect", "we", "us", or "our") is a South African business communications company, registered under company number 2021/395875/07, and a division of DSE Group, based in Benoni, Gauteng, South Africa.

We provide Cloud PBX, AI Receptionist, call centre solutions, IT support, web hosting, domain registration, email hosting, and internet connectivity services to businesses across South Africa.

DSE Connect is the Responsible Party as defined in the Protection of Personal Information Act, 4 of 2013 ("POPIA"). This means we determine the purpose and means of processing your personal information and are accountable for its lawful handling.

2 Information Officer

DSE Connect has designated an Information Officer responsible for ensuring compliance with POPIA and handling all privacy-related queries and requests.

All data subject requests, privacy queries, and complaints must be directed to the Information Officer using the contact details above.

3 Personal Information We Collect

Depending on your interaction with us, we may collect the following categories of personal information:

• Identity information: Full name, job title, company name
• Contact information: Email address, telephone number, physical or postal address
• Communication records: Call recordings (where applicable under our call centre and Cloud PBX services), email correspondence, support tickets
• Technical information: IP address, browser type and version, device identifiers, and data arising from your use of our website and services
• Service account information: Login credentials, service configuration data, billing contact details
• Financial information: Billing address and payment reference details (we do not store full card numbers)

We do not intentionally collect special personal information (such as health, religious, or biometric data) through our website or services. If such information is provided incidentally, it will be treated with the highest level of protection.

4 Why We Collect It (Purpose of Processing)

We collect and process personal information only for lawful, specific, and legitimate purposes, including:

• Responding to enquiries submitted via our website or by telephone
• Providing and managing the services you have contracted with us
• Setting up and maintaining Cloud PBX, AI Receptionist, email hosting, and connectivity services
• Processing billing, invoicing, and payment administration
• Providing technical support and resolving service faults
• Complying with our legal and regulatory obligations
• Improving our website and services through anonymised usage analytics
• Sending service-related communications (updates, maintenance notices, invoices)
• Sending marketing communications — only where you have given consent or where a prior business relationship exists, and only until you opt out

We will not process your personal information for any purpose other than those listed above without informing you and, where required, obtaining your consent.

5 How We Collect Personal Information

We collect personal information through the following means:

• Directly from you: When you complete a contact or quote request form on our website, call our offices, or engage with us via email or WhatsApp
• Automatically: Through a strictly necessary session cookie and limited technical data (such as a hashed IP address used for spam prevention) when you use our website virtual assistant or submit a form (see Section 8)
• Via our AI Receptionist: When you interact with our AI Receptionist service, call transcripts, voicemail transcriptions, and intent data may be captured and stored
• From third parties: Referrals from business partners or publicly available business directories, where relevant to a legitimate business enquiry
• During service delivery: Information generated as part of using our services, such as call records, support logs, and configuration data

6 Third Parties We Share Information With

We share personal information with third-party operators only to the extent necessary to deliver our services or meet our legal obligations. All operators are required to handle your information lawfully and in accordance with POPIA.

• Telecommunications & voice services provider — carriage and voice call handling
• Cloud telephony provider — PBX infrastructure and unified communications
• Billing & service management provider — invoicing and account administration
• Web hosting provider — website and server infrastructure
• Call-recording & compliance operator — call recording, archiving and compliance
• US-based AI provider — powers the website virtual assistant; may process chat messages in the United States

We do not sell, rent, or trade your personal information to any third party for their own marketing purposes.

We may also disclose personal information where required to do so by law, court order, or at the request of a regulatory authority.

7 Cross-Border Transfers of Personal Information

In the course of providing our services, your personal information may be transferred to, stored, or processed in countries outside the Republic of South Africa, including but not limited to the United States of America and the People's Republic of China, for the purposes of disaster recovery, offsite backup, and infrastructure redundancy.

We acknowledge that some of these countries may not have data protection laws equivalent to POPIA. Where such transfers occur, we take reasonable steps to ensure that your information is protected by:

• Binding contractual obligations with our service providers requiring them to maintain appropriate security and confidentiality standards
• Limiting the data transferred to what is strictly necessary for the purpose
• Requiring providers to notify us of any security breach affecting your information

By engaging with our services and submitting your personal information to us, you acknowledge and consent to these cross-border transfers on the basis described above.

8 Cookies

Our website uses only strictly necessary cookies. We do not use advertising, tracking, profiling, or third-party analytics cookies, and we do not run Google Analytics or any equivalent analytics service on this website.

The following cookie may be placed on your device:

• Session cookie (PHPSESSID): Set when you open our website virtual assistant. It exists only to limit the number of messages per session and to prevent abuse of the service. It contains no personal information and expires when you close your browser.

In addition, when you submit a form on our website we temporarily process a one-way hashed version of your IP address solely to prevent spam and repeated automated submissions. The hash cannot be reversed to identify you and is discarded after one hour.

Because we use no analytics or tracking cookies, there is nothing to opt out of. You may block cookies in your browser settings, but doing so may prevent the website virtual assistant from working.

9 How Long We Keep Your Information

We retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. Our general retention periods are as follows:

• Client account and service records: 5 years from the end of the service relationship
• Call recordings and AI Receptionist transcripts: 5 years, unless a shorter period is required by applicable sector regulations or agreed with the client
• Invoice and financial records: 5 years in accordance with the Companies Act and applicable tax legislation
• Website enquiry and contact form submissions: 5 years from the date of submission, or until the business relationship ends
• Spam-prevention data (hashed IP address): Discarded automatically one hour after submission

Once the retention period has expired, personal information is securely deleted or anonymised so that it can no longer be linked to any individual.

10 Security Safeguards

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or disclosure. These measures include:

• Secure server infrastructure and access controls
• Encryption of data in transit via TLS/SSL
• Role-based access restrictions limiting who can access personal information internally
• Regular review of our security practices and third-party operator agreements

While we take all reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. In the event of a security compromise that is likely to harm you, we will notify you and the Information Regulator as required by POPIA.

11 Your Rights as a Data Subject

Under POPIA, you have the following rights regarding your personal information:

• Right to access: Request a copy of the personal information we hold about you
• Right to correction: Request that inaccurate, incomplete, or outdated information be corrected
• Right to deletion: Request that your personal information be deleted, subject to our legal retention obligations
• Right to object: Object to the processing of your personal information, including for direct marketing purposes
• Right to withdraw consent: Where processing is based on your consent, withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint: Lodge a complaint with our Information Officer or directly with the Information Regulator (see Section 12)

To exercise any of these rights, contact our Information Officer at popia@dseconnect.co.za or on 010 110 1680. We will respond within a reasonable period and no later than 30 days of receiving your request.

12 Complaints to the Information Regulator

If you believe your personal information has been processed unlawfully, or that DSE Connect has failed to comply with POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

We encourage you to contact us first so that we may attempt to resolve any concern directly before you escalate to the Regulator.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or service offerings. The most current version will always be available on this page, with the effective date updated accordingly.

We recommend reviewing this policy periodically. Where changes are material, we will take reasonable steps to notify clients directly.