Privacy & PAIA Policy v1.1

1. Who we are

MY-LO installs and configures agentic-AI assistants for South African businesses. We are the responsible party for personal information we collect directly, and we act as a processor for personal information our clients' AI assistants handle on the client's behalf. This policy covers information MY-LO collects directly through our website and communications.

2. What we collect

• Enquiry details you submit (name, business, email, phone, message) via our contact/lead form.
• Communications you send us by email or chat.
• Basic technical data (browser, device) needed to run the site securely.

We do not collect special personal information (race, health, religion, etc.) unless you freely give it to us in a message. Where a client engagement requires processing special personal information, we rely on the specific POPIA condition for that category and document it in the engagement agreement.

3. Why we process it (POPIA lawful purposes)

• To respond to your enquiry and provide our service (performance of a contract).
• To send you what you asked for and service updates (legitimate interest / consent).
• To meet legal, accounting, and PAIA record-keeping obligations.

4. Where your data is stored

We store personal information on South-African servers (host-h.net, Johannesburg, ZA). We do not transfer it outside the Republic except to a vetted subprocessor with equivalent protection, and we will tell you if that changes. This is our data-sovereignty commitment.

5. Sharing

We do not sell your data. We share it only with vetted service providers (e.g. our hosting provider, email delivery) strictly to operate the service, under confidentiality. Subprocessors are bound by written agreements requiring POPIA-equivalent protection.

6. Your rights (POPIA)

You may, at any time and free of charge (except where the law allows a reasonable fee):

• Request access to the personal information we hold about you.
• Request correction or deletion of inaccurate or unlawful data.
• Object to processing, including solely-automated decisions (we will put a human in the loop).
• Withdraw consent (where processing is based on consent).

7. Accessing information under PAIA

In addition to POPIA access rights, MY-LO is a private body as defined in the Promotion of Access to Information Act (PAIA). We have prepared a PAIA Manual (required under section 51) describing the records we hold, the request process, applicable fees, and the forms to use. The manual is available: View our PAIA Manual —

• On request from our Information Officer (details in section 8), or
• From the PAIA text and the Information Regulator's guidance.

How to request records: send your request to the Information Officer with enough detail to identify the record. Use Form A (access to your own personal information) or Form B (access to other records). Requests are processed within the time periods PAIA prescribes (30 days, extendable by a further 30 days where noted). A request may attract the prescribed fee set by the Information Regulator; we will confirm any fee before processing.

If we refuse a request, we will give written reasons and tell you of your right to internal appeal and to complain to the Information Regulator.

8. How to exercise your rights

Contact our Information Officer:
📧 support@mylo.co.za
Information Officer: Mylo (MY-LO). We respond within the periods required by POPIA and PAIA.

You may also lodge a complaint with the Information Regulator:
🌐 inforegulator.org.za · ☎ 010 023 5200 · ✉ POPIAComplaints@inforegulator.org.za

9. Retention & security

We keep personal information only as long as needed for the purpose or legal obligation (including PAIA retention periods), then delete or anonymise it. We apply safeguards (access controls, ZA hosting, credential hygiene) appropriate to the risk.

10. Changes

We may update this policy. The current version is always published here with its effective date and a change log.