Privacy Policy

1. Responsible party

2. Personal information we collect

2.1 Website enquiries

When you submit a form on our website — including the contact form, demo booking, security briefing request, or AFIIA meeting request — we collect your first name, last name, work email address, organisation name, role (if provided), organisation type, team size (if provided), and any message you include.

2.2 Platform usage

When your organisation uses the Looom platform, we process personal information necessary to deliver the service, including user names, email addresses, role assignments, login records, and activity logs. The specific categories depend on your organisation's deployment configuration.

2.3 Client engagement data

Audit engagement data, working papers, findings, and client-related information uploaded to the platform is processed on behalf of your organisation. We act as an operator (processor) in respect of this data. It is governed by your organisation's service agreement with us and is never used for any purpose other than delivering the contracted service.

2.4 Website analytics

We may collect non-identifying technical information when you visit our website, including IP address, browser type, device type, pages visited, and time on site. This information is used to understand visitor behaviour and improve the website experience.

3. Purpose of processing

We process personal information for the following purposes: responding to your enquiries and providing requested information; scheduling and delivering product demonstrations; delivering, maintaining, and supporting the Looom platform under contract; complying with legal and regulatory obligations; communicating service updates, security notices, and material changes to our terms; and improving our website and platform based on usage patterns.

4. Legal basis for processing

Consent — where you have voluntarily submitted information through our website. Contract — where processing is necessary to perform our obligations under a service agreement. Legitimate interest — where processing is necessary for our legitimate business interests, provided those interests do not override your rights. Legal obligation — where processing is required by applicable law.

5. Sharing of personal information

We do not sell, rent, or trade your personal information. We may share personal information with service providers who assist in delivering our platform and website (under data processing agreements); professional advisors including legal, auditing, and insurance advisors; and regulatory authorities or law enforcement where required by law.

6. AI and client data

Client data processed through the Looom platform is never used to train or refine AI models. This is an architectural constraint. Each client operates in an isolated environment with no shared data pool and no cross-client inference. Full details are available on our Privacy & Security page.

7. Data retention

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law. Website enquiry data is retained for a maximum of 24 months unless you request earlier deletion. Platform data is retained in accordance with the service agreement and applicable record retention requirements.

8. Security measures

We implement appropriate technical and organisational measures to protect personal information, including AES-256 encryption at rest, TLS 1.2+ in transit, multi-factor authentication, and role-based access controls. Full details are available on our Privacy & Security page.

9. Your rights under POPIA

You have the right to request access to personal information we hold about you; request correction of inaccurate or incomplete information; request deletion where there is no lawful reason for continued processing; object to processing on reasonable grounds; withdraw consent where processing is based on consent; and lodge a complaint with the Information Regulator.

10. Cross-border transfers

Where personal information is transferred outside South Africa, we ensure appropriate safeguards are in place in accordance with Section 72 of POPIA, including ensuring the recipient jurisdiction has adequate data protection legislation or that binding contractual obligations exist.

11. Breach notification

In the event of a security compromise involving personal information, we will notify the Information Regulator and affected data subjects within 48 hours in accordance with the POPIA amendments and our internal incident response procedures.

12. Cookies

Our website may use essential cookies to ensure correct functionality. We do not use cookies for advertising or behavioural tracking. Any analytics cookies are configured to anonymise data where possible.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via our website. The date at the top of this page indicates the most recent revision.

14. Contact

You may also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.