Privacy Policy — XEQT (Pty) Ltd
Effective date: 2026-07-30 · Last updated: 2026-07-30
Published at: xeqt.co.za/privacy
XEQT (Pty) Ltd ("XEQT", "we", "us") respects your privacy and processes personal information in accordance with the Protection of Personal Information Act, 2013 ("POPIA").
1. Who we are
XEQT (Pty) Ltd, a South African company providing AI-powered business operating systems built on monday.com, WhatsApp automation, and workflow integration services.
Information Officer: Erik Bester · erik@xeqt.co.za · +27 66 109 0940
Registered with the Information Regulator (South Africa).
2. What we collect
- Contact details: name, phone number, email, company name — when you message us on WhatsApp, complete a form, or become a client.
- Conversation content: WhatsApp messages exchanged with us (including messages handled by our automated assistant).
- Support and ticket data: issues you report and their resolution history.
- Billing data: company registration/VAT details for invoicing.
We do not collect special personal information (health, race, biometric, etc.) and ask that you not send it to us.
3. Why we process it (lawful bases)
- To perform a contract (§11(1)(b)): delivering the systems and support you engaged us for.
- Legitimate interest (§11(1)(f)): operating and securing our systems, keeping business records, responding to enquiries.
- Your consent (§11(1)(a)): WhatsApp communication and any direct marketing — which you may withdraw at any time by replying STOP.
- Legal obligation (§11(1)(c)): tax and companies-act record keeping.
4. Automated processing
Our WhatsApp support assistant uses AI (OpenAI) to draft replies to your messages. It can read your ticket status, create support tickets, and log enquiries on your behalf — nothing else. A human reviews escalations, and you may request a human at any time. Automated replies are clearly within a business-support context and no decisions with legal or similarly significant effect are made solely by automated means.
5. Who we share it with (operators & sub-processors)
We use the following service providers, each bound by a data processing agreement providing protection substantially similar to POPIA (§72):
| Provider | Purpose | Location |
|---|---|---|
| monday.com | CRM & project boards | US/EU |
| Meta / WhatsApp | Messaging delivery | Global |
| TimelinesAI | WhatsApp Business API management | EU |
| OpenAI | AI assistant replies (API; data not used for model training) | US |
| Hostinger | VPS hosting (EU region) | EU |
| Cloudflare | Network security | Global |
We do not sell personal information. We do not share your information with other clients.
6. Retention
- Contacts/leads: 3 years after last interaction.
- Support tickets: 5 years.
- Security/error logs: 12 months (phone numbers masked).
- AI conversation threads: 30 days (provider default).
- Billing records: as required by tax law (5–7 years).
After retention, records are deleted or de-identified.
7. Security
Encryption in transit (TLS) and at rest; access restricted to authorized personnel; MFA on all administrative accounts; per-client system isolation; credential management via environment variables; breach response plan in place. If a breach risks your information, we will notify you and the Information Regulator as required by §22.
8. Your rights
You may request access to, correction of, or deletion of your personal information; object to processing; withdraw consent; and lodge a complaint. One access request per year is free. Email erik@xeqt.co.za with subject "POPIA Request". We respond within 30 days.
To opt out of WhatsApp messages at any time: reply STOP.
9. Complaints
Information Regulator (South Africa): complaints.IR@inforegulator.org.za · 010 023 5200 · JD House, 27 Stiemens Street, Braamfontein, Johannesburg.
10. Changes
We may update this policy; the current version is always at xeqt.co.za/privacy.