Privacy & POPIA notice | AutonomyLabs

1. Who we are and our Information Officer

The responsible party is Ubuhlakani Labs (Pty) Ltd, trading as AutonomyLabs (registration number 2026/174689/07), 21 Cleargrove Rd, Grove End, Phoenix, Durban, KwaZulu-Natal, 4068, South Africa.

Information Officer: Dushendrin Naidoo, director. Email: naidoorn@autonomylab.co.za (subject "POPIA request"). Phone: 075 905 8374 (email preferred).

2. What we collect, and why

We collect only what we need, mostly directly from you. We process it lawfully under section 11 of POPIA: to perform a contract with you, to meet legal obligations, for our legitimate business interests, or with your consent.

Who	What we collect	Why we use it
Website visitors	No forms, accounts or analytics on this website. Our hosting provider automatically processes technical data such as IP address, browser type and pages requested.	To deliver the website securely and protect it from abuse (legitimate interest).
People who email us	Your name, email address and whatever you include in your message.	To answer you and keep a record of our correspondence (legitimate interest; contract where it relates to an order).
Digital product customers	Name, email address, country, order details and payment status, collected by Payhip or Gumroad at checkout. Card details go directly to the payment processor. We never see or store full card numbers.	To deliver your download, provide support and refunds, prevent fraud, and keep the accounting and tax records the law requires (contract and legal obligation).
Free template downloaders	Email address (and name, if you give it), and whether you ticked the marketing opt-in box, with the date and time.	To send you the download link. If, and only if, you opt in: to send occasional tips and new templates (consent).
Marketplace customers (Amazon.co.za and Bob Shop)	The information the marketplace gives us to fulfil your order: your name, delivery address, the items ordered and, in some cases, a contact number for the courier. We don't receive your payment details.	To pack and deliver your order, handle returns and support, and keep required records (contract and legal obligation). We don't use it for marketing.
Procurement and business contacts (government and corporate buyers)	Names, job titles, work email addresses and business contact details of officials and staff, and the RFQ, tender, purchase order and delivery documents you send us.	To prepare quotations, respond to RFQs and tenders, fulfil orders, invoice and meet procurement and legal record-keeping requirements (contract, legal obligation and legitimate interest).
Suppliers and partners	Contact details of your staff, company details, price lists and correspondence.	To assess and manage the supply relationship and pay invoices (contract and legitimate interest).

We don't sell personal information. We don't knowingly collect special personal information or information about children. Our products and services are for adults. People under 18 should not buy from us without a parent or guardian.

3. Who we share it with

We share personal information only with service providers ("operators") who process it for us under contract, with the marketplaces you choose to buy through, or where the law requires it (for example SARS or a court order).

Payhip (United Kingdom): our online shop for digital products, including checkout, file delivery, receipts and, if you opt in, our email list.
Paystack (payment processor): processes card and other payments on Payhip for South African Rand checkouts.
Gumroad (United States): an alternative shop and payment platform for buyers outside South Africa, if you buy there.
Amazon.co.za and Bob Shop: the marketplaces where our physical products are sold. They are responsible for the personal information they collect under their own privacy notices, and share order and delivery details with us.
Couriers and delivery services: receive your name, delivery address and contact number to deliver store orders.
GoDaddy: our domain and business email provider, which stores our email correspondence.
Website hosting (Cloudflare Pages or Netlify, whichever is used): serves this website and processes technical request data.
Third-party AI providers: AI tools that help us draft replies and quotations, read tender documents and, once our store is live, coordinate orders. See "AI tools and automated processing" below.
Our accountant or auditor, and government bodies such as SARS or procurement authorities, where the law or a procurement process requires it.

AI tools and automated processing

We use third-party AI tools and automation to help run the business, for example to draft email replies and quotations, summarise tender and RFQ documents, and, once our store is live, track marketplace orders and supplier stock. This means personal information in your messages, orders or procurement documents may be processed by a third-party AI provider acting as our operator, which may be located outside South Africa (see section 4).

We share only what a task needs, and we don't put card details or special personal information into AI tools.
A person reviews every AI-assisted output before it's used or sent. We don't make decisions about you based solely on automated processing (section 71 of POPIA).
If you'd prefer we don't use AI tools on your correspondence, tell us in your email and we'll handle it manually.

4. Information stored outside South Africa

Some of the providers above store information outside South Africa, for example in the United Kingdom, the European Union or the United States. Under section 72 of POPIA, we only use providers bound by laws, binding corporate rules or agreements that give a level of protection substantially similar to POPIA, or where the transfer is needed to perform our contract with you.

5. Marketing emails

We send marketing emails only to people who have opted in by ticking a separate, unticked box. Downloading a free product or buying a product never requires you to accept marketing.
Every marketing email identifies AutonomyLabs, includes our contact details and has a one-click unsubscribe link. You can also unsubscribe by emailing us.
We keep a record of your consent (date, time, where you signed up and the wording shown).
We never buy, rent or scrape email lists, and we don't send unsolicited marketing to procurement contacts or marketplace customers.

6. Cookies and website data

This website doesn't use cookies, analytics or advertising trackers. When you click through to Payhip, Gumroad, Amazon.co.za or Bob Shop, those sites use their own cookies under their own privacy notices.

7. How long we keep information

Sales, invoice and accounting records: at least 5 years, as tax law requires, and up to 7 years where the Companies Act requires company records to be kept that long.
Procurement records (quotations, purchase orders and delivery records): for as long as the law or the buyer's procurement rules require.
Email correspondence: for as long as needed to deal with your matter and any follow-up, then deleted, unless the law requires us to keep it.
Marketing list: until you unsubscribe. After that we keep only the minimum needed to respect your opt-out.

8. Security

We use reputable providers, encrypted (HTTPS) connections, strong passwords and two-factor authentication where available, and we give access to personal information only to people who need it. If a security compromise affects your personal information, we'll notify you and the Information Regulator as section 22 of POPIA requires.

9. Your rights

Under POPIA you have the right to:

ask whether we hold personal information about you, and ask for a copy (access requests are handled under the Promotion of Access to Information Act, PAIA);
ask us to correct, update or delete your personal information;
object to processing on reasonable grounds, and object to direct marketing at any time;
withdraw your consent at any time, where we rely on consent;
complain to the Information Regulator.

To make a request, email naidoorn@autonomylab.co.za with the subject "POPIA request". We may need to confirm your identity before acting on it. We'll respond within a reasonable time and within any deadline the law sets. Our PAIA manual is available on request.

10. Complaints to the Information Regulator

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Regulator (South Africa):

Website: inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za (using POPIA Form 5)
General enquiries: enquiries@inforegulator.org.za
Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

We may update this notice. The date at the top shows the latest version.