Privacy Policy

1. Definitions

In this Policy (as defined below), unless the context requires otherwise, the following capitalised terms shall have the meanings given to them —

• "Active Processing" means instances where Flexo Africa has directly been provided with the Personal Information/Personal Data of Data Subjects, such as when Data Subjects submit an enquiry in respect of Services, or when Data Subjects provide Personal Information/Personal Data to Flexo Africa pursuant to concluding any commercial agreement(s) with Flexo Africa;
• "Inactive Processing" means instances where Flexo Africa has not actively been provided with the Personal Information/Personal Data of Data Subjects, such as when Flexo Africa deploys Passive Processing Means to collect information from Data Subjects. These Passive Processing Means allow Flexo Africa to Process certain kinds of Non-personally Identifiable Information which cannot be linked to Data Subjects;
• "Anonymisation" means the Processing of Personal Information/Personal Data in such a manner that the Personal Information/Personal Data can no longer be attributed to Data Subjects without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Information/Personal Data are not attributed to Data Subjects;
• "Applicable Laws" means any laws applicable to Personal Data and Personal Information and includes any statute, regulation, notice, policy, directive, ruling or subordinate legislation; the common law; any binding court order, judgement or ruling; any applicable industry code, policy or standard enforceable by law; or any applicable direction, policy or order that is given by any regulator, competent authority or organ of state or statutory industry body;
• "Child" means any natural person under the age of 18 (Eighteen) years;
• "Competent Person" means anyone who is legally competent to consent to any action or decision being taken by any matter concerning a Child, for example a parent or legal guardian;
• "Consent" means any voluntary, specific and informed expression of will in terms of which permission is given for the Processing of Personal Information;
• "Cookies" means small text files that store Non-personally Identifiable Information/Data about Data Subjects, either temporarily in connection with a Data Subjects Internet Protocol (IP) address (known as a temporary or session cookie and deleted once a Data Subject closes their browser window) or more permanently on the hard drive of a Data Subject's device (known as a permanent or persistent cookie). Flexo Africa's Website(s) or Mobile Application(s) may from time to time use session cookies so that Data Subject's do not have to fill in the same information from page to page within our website(s) or Mobile Application(s). If Data Subject's elect not to receive cookies, they may be able to view some, but not all, of the content on our website(s) or Mobile Application(s);
• "Customer(s)" means any natural person(s), or juristic person(s), who have concluded an agreement with Flexo Africa in terms of which such Customer procures the Products or Services provided by Flexo Africa;
• "Data Subject" means Flexo Africa's Customer(s) or any Third Party in respect of whom Flexo Africa Processes Personal Information/Personal Data;
• "Data Processing Infrastructure" means any and all systems, networks, servers, workstations, laptops, mobile devices, web applications, mobile applications, cloud storages, websites owned, controlled or operated by Flexo Africa;
• "Embedded Scripts" means programming code that is designed to collect information about a Data Subject's interactions with the relevant website(s) or Mobile Application(s). It is temporarily downloaded onto a Data Subject's device from our web server or a Third-Party Operator. This program is active only while a Data Subject is connected to the relevant website(s) or Mobile Application(s) and is deleted or deactivated thereafter;
• "Electronic Means" means, in relation to the Processing of any Personal Information/Personal Data, the use of any Website(s), Mobile Application(s), electronic mail (email), text, voice, sound or image messages by Flexo Africa;
• "Flexo Africa" means Flexo Africa (Pty) Ltd, a Private Company with Company Registration Number: 2023/284028/07;
• "Non-Electronic Means" means, in relation to the Processing of any Personal Information/Personal Data, the use of traditional means of Processing, such as hard copy documents, traditional filing systems deployed for the storage and retention of Personal Information/Personal Data and face-to-face personal engagements with Data Subjects;
• "Mobile Application(s)" means any multi-device software application, whether in web-based format or device-native format, to which this Privacy Policy relates and through which Customer(s) and Third Parties gain access to Flexo Africa's Products and/or Services;
• "Mobile Device Identifier" means device information if you access our website(s) or Mobile Application(s) through mobile devices. Certain features of the relevant website(s) or Mobile Application(s) may require collection of mobile phone numbers, and we may associate that phone number with the mobile device identifiers. Additionally, some mobile phone service providers operate systems that pinpoint the physical location of devices that use their service. Depending on the provider, Flexo Africa and/or our Third-Party Operators may receive this information. If Flexo Africa associates any such passively collected information with the Personal Information/Personal Data of Data Subjects, we will treat the combined information as Personal Information/Personal Data as contemplated in this Policy;
• "Non-personally Identifiable Information/Data" means any information/data which cannot be linked to Data Subjects, such as an internet domain name, the type of web browser used by a Data Subject, the type of operating system relied on by a Data Subject, the date and time of a Data Subject's visit to our Website(s) and Mobile Application(s), the specific pages a Data Subject may have visited, and the address of the website which a Data Subjects may have visited prior to entering or gaining access to Flexo Africa's Website(s) or Mobile Application(s);
• "Operator" means a person or entity who Processes Personal Information/Data for a Responsible Party;
• "Passive Processing Means" means the use of technologies to facilitate the Inactive Processing of Personal Information/Personal Data, namely the use of Cookies, Web Beacons, Embedded Scripts and/or Mobile Device Identifiers;
• "Personal Data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, which in the context of Flexo Africa shall comprise of the types of Personal Data recorded in this Policy below;
• "Personal Information" shall have the same meaning as is given in section 1 of POPIA, but shall in the context of Flexo Africa comprise of the types of Personal Information recorded in this Policy below;
• "Policy" means this Data Protection and Privacy Policy;
• "POPIA" means the Protection of Personal Information Act, No 4 of 2013, as amended from time to time;
• "Processing" means any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information/Personal Data, including: (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form by electronic communications or other means; or (c) merging, linking, blocking, degradation, erasure or destruction. For the purposes of this definition, "Process" has a corresponding meaning;
• "Regulator" means the Information Regulator established in terms of POPIA;
• "Responsible Party" means in the context of this Policy, Flexo Africa;
• "Services" means the various services provided by Flexo Africa to its Customer(s) from time to time;
• "Special Personal Information/Data" means Personal Information/Personal Data concerning, amongst other aspects contemplated in terms of section 26 Part B of POPIA, a Data Subject's religious beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric data, or criminal behaviour;
• "Third-Party" means any Customer(s), Data Subject(s), employees, independent contractor, agent, consultant or user of Flexo Africa's Products, Services, Website or any other digital application interface;
• "Unique Identifier" means any identifier that is assigned to a Data Subject and is used by the Responsible Party for the purposes of the operations of that Responsible Party and that uniquely identifies that data subject in relation to the Responsible Party;
• "Website" means the website owned and operated by Flexo Africa sourced at https://www.flexoafrica.com/;
• "Web Beacons" means small graphic images called web beacons, also known as "Internet tags" or "clear gifs", which Web Beacons may be deployed in Flexo Africa's Website(s) pages and e-mail messages. Web beacons may be invisible to Data Subjects, but any electronic image inserted into a web page or e-mail can act as a Web Beacon. Flexo Africa may use web beacons or similar technologies for a number of purposes, including, without limitation, to count the number of visitors to our Websites, Mobile Application(s), to monitor how users navigate the Website(s) or Mobile Application(s), to count how many e-mails that we have sent were actually opened or to count how many particular articles or links were actually viewed by Data Subjects in certain circumstances.

2. Introduction

This Policy regulates the Processing of Personal Information/Personal Data by Flexo Africa and sets forth the requirements with which Flexo Africa undertakes to comply when Processing Personal Information/Personal Data pursuant to undertaking its operations and fulfilling its contractual obligations in respect of Data Subjects and Third Parties in general.

Flexo Africa places a high premium on the privacy of every person or organisation with whom it interacts or engages with and therefore acknowledges the need to ensure that Personal Information/Personal Data is handled with a reasonable standard of care as may be expected from it. Flexo Africa is therefore committed to ensuring that it complies with the requirements of POPIA.

When a Data Subject or Third Party engages with Flexo Africa, whether it be physically or via any digital, electronic interface such as Flexo Africa's Website, the Data Subject or Third Party acknowledges that they trust Flexo Africa to Process their Personal Information/Personal Data, including the Personal Information/Personal Data of their dependents, beneficiaries, customers, members, or employees as the case may be, which further entrenches the importance of Flexo Africa's compliance with Applicable Laws in regards to the Processing of Personal Information/Personal Data.

All Data Subjects and Third Parties have the right to object to the processing of their Personal Information/Personal Data. It should be voluntary to accept the Terms and Conditions to which this Policy relates. However, Flexo Africa does require the Data Subject or Third Party's acceptance to enable the proper use of Flexo Africa's Website and/or Services.

3. Purpose and Application

The purposes of this Policy are not only to inform Data Subjects of what Personal Information/Personal Data of theirs Flexo Africa may process, where Flexo Africa may have collected such Personal Information/Personal Data from (if not directly from them as the Data Subject), how Flexo Africa processes their Personal Information/Personal Data, but also to establish a standard by which Flexo Africa and its employees, representatives and operators shall comply in as far as the processing of Personal Information/Personal Data is concerned.

Flexo Africa, in its capacity as a Responsible Party and/or Operator and/or Controller, as the case may be, shall strive to observe and comply with its obligations under POPIA when it processes Personal Information/Personal Data from or in respect of any Data Subject.

4. Collecting & Processing of Personal Information/Personal Data

Whenever any Data Subject engages with Flexo Africa, whether it be physically or electronically, or through the use of its Services, facilities or Website, Flexo Africa will in effect be processing the Data Subject's Personal Information/Personal Data.

It may be from time to time that Flexo Africa has collected a Data Subject's Personal Information/Personal Data from other sources and in such instances Flexo Africa will inform the Data Subject by virtue of any privacy notices it deploys from time to time. In the event that a Data Subject has shared their Personal Information/Personal Data with any third parties, Flexo Africa will not be responsible for any loss suffered by the Data Subject, their dependents, beneficiaries, customers, representatives, agents or employees (as the case may be).

When a Data Subject provides Flexo Africa with the Personal Information of any other Third Party, Flexo Africa will process the Personal Information/Personal Data of such Third Party in line with this Policy, as well as any terms and conditions or privacy notices to which this Policy relates.

Flexo Africa will primarily Process Personal Information/Personal Data in order to facilitate and enhance the delivery of Products and/or Services to its Customers, manage and administer its business, foster a legally compliant workplace environment, as well as safeguard the Personal Information/Personal Data relating to any Data Subjects which it in fact holds. In such an instance, the Data Subject providing Flexo Africa with such Personal Information/Personal Data may also be required to confirm that they are a Competent Person and that they have authority to give the requisite consent to enable Flexo Africa to process such Personal Information/Personal Data.

Flexo Africa undertakes to process any Personal Information/Personal Data in a manner which promotes the constitutional right to privacy, retains accountability and Data Subject participation.

Prior to recording the purpose(s) for which Flexo Africa may, or will, process the Personal Information/Personal Data of Data Subjects, Flexo Africa hereby records the types of Personal Information/Personal Data of Data Subjects it may process from time to time:

Category	What	Why
Account	Name, email/username, company name, password (hashed only)	Authentication, account management
Subscription	Plan tier, billing cycle, PayFast subscription token, payment status	Subscription billing
Usage	Tools run, run timestamps, run counts per period	Quota enforcement, support, product analytics
Uploaded files	PDFs, images and other artwork you upload to run tools against	Processing by the tools you invoke
Email correspondence	Messages you send us	Customer support
Technical	IP address, approximate location (city/country) and network derived from it, browser type, basic request logs and page views	Security, abuse prevention, and first-party site analytics

Flexo Africa does not collect payment card numbers, banking details, government IDs, biometrics, or any special-category data.

In supplementation of the above and any information privacy notices provided to any Data Subjects from time to time pursuant to any engagement with them, Flexo Africa may process Personal Information/Personal Data for the following purposes:

• To provide or manage any information and/or Services requested by or delivered to Data Subjects in general;
• To create and operate the account and the Service that the Data Subject signed up for;
• To process the Data Subject's subscription payments;
• To provide customer support to Data Subjects;
• To establish a Data Subject's needs, wants and preferences in relation to the Services provided by Flexo Africa;
• To help Flexo Africa identify Data Subjects when they engage with Flexo Africa;
• To facilitate the delivery of Services to Customers;
• To allocate to Customers and Data Subjects Unique Identifiers for the purpose of securely storing, retaining and recalling their Personal Information/Personal Data from time to time;
• To maintain records of Data Subjects and specifically Customer records;
• To maintain Third Party records;
• For general administration purposes;
• For legal and/or contractual purposes;
• To monitor access, secure and manage any facilities owned or operated by Flexo Africa regardless of location;
• To transact with Third Parties;
• To improve the quality of Flexo Africa's Services;
• To transfer Personal Information/Personal Data to Third Party service providers so as to enable Flexo Africa to deliver Services to its Customer(s);
• To analyse the Personal Information/Personal Data collected for research and statistical purposes;
• To transfer Personal Information/Personal Data across the borders of South Africa to other jurisdictions if it is required;
• To identify other products and services which might be of interest to our Customers and Data Subjects in general, as well as to inform them of such products and/or services;
• To comply with all relevant Applicable Laws and legal obligations.

When collecting Personal Information/Personal Data from a Data Subject, Flexo Africa shall comply with the notification requirements as set out in Section 18 of POPIA.

Flexo Africa will collect and Process Personal Information/Personal Data in compliance with the conditions as set out in POPIA to ensure that it protects the Data Subject's privacy.

Flexo Africa will not Process the Personal Information/Personal Data of a Data Subject for any purpose other than for the purposes set forth in this Policy or in any other privacy notices which may be provided to Data Subjects from time to time, unless Flexo Africa is permitted or required to do so in terms of Applicable Laws or otherwise by law.

Flexo Africa may from time-to-time Process Personal Information/Personal Data by making use of automated means (without deploying any human intervention in the decision-making process) to make decisions about the Data Subject or their application. In this instance it is specifically recorded that the Data Subject may object to or query the outcomes of such a decision.

5. Provision of Personal Information/Personal Data to Third Parties

Flexo Africa may disclose your Personal Information/Personal Data to Third-Party service providers to achieve the purpose(s) for which the Personal Information/Personal Data was originally collected and processed. Flexo Africa has/will enter into written agreements with such Third-Party service providers to ensure that they comply with Applicable Laws pursuant to the processing of Personal Information/Personal Data provided to the Third Party by Flexo Africa from time to time.

Flexo Africa currently make use of the following Third Party service providers, with whom Flexo Africa may share the Data Subject's Personal Information/Personal Data, each of whom processes data on Flexo Africa's behalf under contract:

Recipient	Purpose	Location
Railway (Railway Corp.)	Application hosting and database storage	United States
PayFast (Pty) Ltd	Subscription payment processing	South Africa
Google (Gmail SMTP)	Transactional email delivery	Global
GitHub, Inc.	Source-code repository (no user data stored)	United States

Flexo Africa does not sell a Data Subject's personal information, and does not share it with advertisers or marketing partners.

6. Cross-border transfers

In terms of Section 72 of the Protection of Personal Information Act, 4 of 2013 (POPIA), Flexo Africa may, under certain circumstances, transfer a Data Subject's Personal Information/Personal Data to a jurisdiction outside of the Republic of South Africa in order to achieve the purpose(s) for which the Personal Information/Data was collected and processed, including for processing and storage by Third-Party service providers.

By creating this account, the Data Subject consents to transfer the Personal Information/Personal Data to such foreign jurisdiction.

The Data Subject should also take note that, where the Personal Information/Personal Data is transferred to a foreign jurisdiction, the Processing of Personal Information/Personal Data in the foreign jurisdiction may be subject to the laws of that foreign jurisdiction.

7. Storage and Retention of Personal Information/Personal Data

Flexo Africa will retain Personal Information/Data it has Processed, in an electronic or hardcopy file format, with a Third-Party service provider appointed for this purpose (the provisions of clause 5 above will apply in this regard).

Personal Information/Personal Data will only be retained by Flexo Africa for as long as necessary to fulfil the legitimate purposes (such as accounting, audit and dispute resolution purposes) for which that Personal Information/Personal Data was collected in the first place and/or as permitted or required in terms of Applicable Law.

It is specifically recorded that any Data Subject has the right to object to the processing of their Personal Information and Flexo Africa shall retain and store the Data Subject's Personal Information/Personal Data for the purposes of dealing with such an objection or enquiry as soon and as swiftly as possible.

8. Data Subject's rights

Under POPIA all Data Subjects have the right to:

• Access the Personal Information/Personal Data which Flexo Africa holds about the Data Subject;
• Correct or update Personal Information/Personal Data that is inaccurate or incomplete;
• Delete the Personal Information/Personal Data, subject to overriding legal obligations;
• Object to processing of the Personal Information/Personal Data on reasonable grounds;
• Withdraw consent at any time where processing of the Personal Information/Personal Data is based on consent;
• Lodge a complaint with the Information Regulator (South Africa).

To exercise any of these rights, email Flexo Africa at flexoafrica@gmail.com. Flexo Africa will respond within a reasonable period and at no charge for reasonable requests.

9. Security

Flexo Africa will always implement appropriate, reasonable, physical, organisational, contractual and technological security measures to secure the integrity and confidentiality of Personal Information/Personal Data, including measures to protect against the loss or theft, unauthorised access, disclosure, copying, use or modification of Personal Information/Personal Data in compliance with Applicable Laws.

To protect all Personal Information/Personal Data with reasonable, appropriate technical and organisational measures, Flexo Africa makes use of the following:

• passwords stored as bcrypt hashes (never as plain text);
• encrypted transport (TLS / HTTPS) between your browser and the Service;
• JWT-based session authentication;
• per-company data isolation for uploaded assets;
• access controls limiting administrative access to authorised personnel.

In further compliance with Applicable Laws, Flexo Africa will take steps to notify the relevant Regulator(s) and/or any affected Data Subjects in the event of a security breach and will provide such notification as soon as reasonably possible after becoming aware of any such breach.

Notwithstanding any other provisions of this Policy, it should be acknowledged that the transmission of Personal Information/Personal Data, whether it be physically in person, via the internet or any other digital data transferring technology, is not completely secure. Whilst Flexo Africa has taken all appropriate, reasonable measures to secure the integrity and confidentiality of the Personal Information/Personal Data it Processes, in order to guard against the loss of, damage to or unauthorized destruction of Personal Information/Personal Data and unlawful access to or processing of Personal Information/Personal Data, Flexo Africa in no way guarantees that its security system(s) are 100% secure or error-free. Therefore, Flexo Africa does not guarantee the security or accuracy of the information (whether it be Personal Information/Personal Data or not) which it collects from any Data Subject.

Any transmission of Personal Information/Personal Data will be solely at the own risk of a Data Subject. Once Flexo Africa has received the Personal Information/Personal Data, it will deploy and use strict procedures and security features to try to prevent unauthorised access to it. As indicated above, Flexo Africa reiterates that it restricts access to Personal Information/Personal Data to Third Parties who have a legitimate operational reason for having access to such Personal Information/Personal Data. Flexo Africa also maintains electronic and procedural safeguards that comply with the Applicable Laws to protect the Data Subject's Personal Information/Personal Data from any unauthorized access.

Flexo Africa shall not be held responsible and by accepting any terms and conditions to which this Policy relates, any Data Subject agrees to indemnify and hold Flexo Africa harmless for any security breaches which may potentially expose the Personal Information/Personal Data in Flexo Africa's possession to unauthorized access and/or the unlawful processing of such Personal Information/Personal Data by any Third-Party.

10. Cookies and local storage

The Service stores a session token in the User's browser localStorage to keep the User signed in. Flexo Africa does not use cookies for advertising or third-party tracking. Flexo Africa may use cookies for essential session management.

11. Children

The Service is not directed at children under 18. Flexo Africa does not knowingly collect personal information from children. If you believe a child has registered, please contact us so we can delete the account.

12. Changes to this Policy

Flexo Africa may amend this Policy from time to time. Material changes will be communicated by email to the Data Subject's registered address and posted on this page. The "Last updated" date at the top reflects the most recent revision.

13. Complaints to the Information Regulator

If you are of the view or belief that Flexo Africa has processed your Personal Information/Personal Data in a manner or for a purpose which is contrary to the provisions of this Policy, you are requested to first attempt to resolve the matter directly with Flexo Africa, failing which you shall have the right to lodge a complaint with the Information Regulator, under the provisions of POPIA.

The current contact particulars of the Information Regulator are:

The Information Regulator (South Africa)
Website: inforegulator.org.za
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2107

14. Contact

All comments, questions, concerns or complaints regarding Personal Information/Personal Data or this Policy should be forwarded to Flexo Africa's Information Officer at the following email address:
Cameron Manning, Information Officer
Flexo Africa (Pty) Ltd
Registered with the Information Regulator (South Africa), Registration No. 2026-061298
Email: flexoafrica@gmail.com