Privacy notice

Amiti Connect (Pty) Ltd runs Amiti, an assistant that helps estates, schools and clubs run their WhatsApp groups. In this notice "Amiti", "we" and "us" mean Amiti Connect (Pty) Ltd, registration number 2019/387758/07, Crossfire Place, 15 Gardener Williams Avenue, Paardevlei, Somerset West, 7130.

This notice explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It covers:

• this website, amiti.co.za;
• people who contact us, and our customers and the people who use the dashboard for them;
• members of the WhatsApp groups that our customers connect to Amiti, and anyone who messages the assistant.

Two roles

For this website, our customers and our own business records, we decide why and how personal information is used. POPIA calls us the responsible party.

For the messages and member details in a community's groups, the community decides. An estate's homeowners' association, a school or a club (our customer) chooses to add Amiti to its groups and decides what Amiti is used for. The customer is the responsible party for that information, and we act for it as its operator. We process that information on the customer's instructions, under a written agreement with the customer.

If you are a member of a group and have a question about it, ask your community first. We will help them answer. You can also contact us directly (section 7).

When you visit this website

The website has no forms and sets no tracking or advertising cookies. Like any website, the service that hosts it receives technical details each time your browser asks for a page: your IP address, your browser and device type, the page you asked for and the time. These are used only to deliver the site and keep it secure.

When you contact us

If you WhatsApp us, email us or call us, we receive your name, your phone number or email address, the organisation you work for and whatever you choose to tell us.

When your organisation is a customer

We hold the names, phone numbers, email addresses and roles of the people who set up and run Amiti for a customer, their dashboard log-in details, and the records of our work together: agreements, set-up notes, support conversations, invoices and payments. When someone uses the dashboard, we record how it is used, so that we can find and fix faults.

When you are a member of a group that uses Amiti

From the day a community adds its dedicated observer number to a group, Amiti records what happens in that group:

• your phone number and WhatsApp profile name;
• the messages you post, with replies, reactions, edits and deletions;
• photos, voice notes, documents and other files you post, and the text Amiti reads from them so they can be searched, such as a transcript of a voice note;
• when you join or leave the group, and whether you are a group admin;
• the group's name and its list of members.

This information comes from WhatsApp, through the observer number, not from you directly. Amiti does not import a group's earlier history.

Your community may also give us its member list, so that its admins can check who belongs in each group. A member list usually holds names, phone numbers and details such as a unit or house number.

When you message the assistant

If you message the assistant number, we receive your phone number, your WhatsApp profile name, your messages and the assistant's replies. The assistant answers only members of the community's groups, so it checks your number against those groups.

Information about other people

Messages sometimes mention other people, such as a plumber that a neighbour recommends. On the Estate plan, or with the provider recommendations add-on, the assistant can suggest service providers that members have recommended in the groups, using the names and contact details posted there.

Sensitive information

Amiti does not ask members for special personal information, such as details of health, religion or political views. A school's member list may name learners. Members sometimes post sensitive details in a group anyway, and Amiti records them with the rest of the group. Think before you post sensitive details about yourself or anyone else in a group.

Do you have to give us this information?

• Website. No. You can read the whole site without telling us anything.
• Contacting us. It is up to you. We need a way to reply.
• Customers. Yes. We cannot set up Amiti, invoice you or keep the records that tax law requires without it. The Value-Added Tax Act 89 of 1991 sets out what a tax invoice must contain, and the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008 require us to keep our records.
• Members. You choose what you post in a group and whether to message the assistant. If you do not want your messages recorded, speak to your community, which decides whether Amiti is used in its groups. If you do not give the assistant your number, it cannot answer you, because WhatsApp messages always carry the sender's number.

For the community that uses Amiti

We use the information in a community's groups to provide Amiti to our customers:

• to keep a record of its groups that its admins can read and search;
• to flag messages that look abusive or that break the community's own rules, so that its admins can decide what to do;
• to compare each group's members with the community's member list, and to help admins approve requests to join and add or remove members;
• to answer members' questions in a private chat, from the community's rules and documents and recent notices in its groups;
• to send a welcome message to new members the community adds;
• to send the broadcasts and notices that the community chooses to send;
• to show activity in the dashboard, and to prepare the reports included in the community's plan.

Amiti does not decide by itself to delete your messages or remove you from a group. It flags, and the community's admins decide.

The community must have a lawful reason under POPIA to use Amiti in its groups. Our agreement with each customer requires it.

For our own business

What we use it for	Our reason in law (POPIA section 11)
Answering your enquiry	Our legitimate interest in replying to people who contact us
Setting up and running a customer's account, support and invoicing	Performing our agreement with the customer
Keeping accounting, tax and company records	Complying with the law
Finding and fixing faults, and keeping the service and this website secure	Our legitimate interest, and our customers', in a service that works and is safe
Telling customers about changes to Amiti, prices and new features	Our legitimate interest in our customer relationship, with the right to opt out at any time
Protecting our legal rights, or responding to a lawful request from an authority	Complying with the law, and our legitimate interest

Our team reads a community's records to set Amiti up, to help when the community asks for support, to fix a fault, or to prepare a report the community has asked for.

Marketing

We do not send marketing messages by WhatsApp, SMS or email unless you have asked to receive them. If you are a customer who bought Amiti from us, we may also tell you about our own similar services, as long as we gave you a free, simple chance to say no when we collected your contact details. Every marketing message tells you how to stop them, and stopping is free. We do not sell personal information.

• The community's admins. The people a customer authorises can see the records of that customer's groups, the member list, and the conversations members have with the assistant.
• The community's own systems. Every plan includes access through an API, so a customer can connect its own systems to its records.
• Our operators. We use other companies to run Amiti for us: cloud hosting and storage; the WhatsApp messaging provider that connects the assistant number to WhatsApp; AI language services that write the assistant's answers and help check messages; services that transcribe voice notes and read documents and images; and services for dashboard sign-in, tracing the assistant's AI requests, logging and error monitoring, product analytics and email delivery. A technology company in the European Union develops and runs the Amiti platform for us. Each operator must keep personal information secure and is bound to us by a written agreement.
• WhatsApp. Every message to and from Amiti travels through WhatsApp. WhatsApp handles messages under its own terms and privacy policy, not on our behalf.
• Our professional advisers, such as our accountant, auditor and lawyers, when they need it to advise us.
• Authorities, such as the South African Revenue Service, a court or the Information Regulator, when the law requires us to.
• A buyer, if we sell or reorganise our business. The buyer must keep to this notice.

Information sent outside South Africa

Our main servers, database and backups are in South Africa. Some of our operators process parts of the information in other countries:

• European Union. The platform company, the dashboard and its sign-in, the store of member lists and community documents, tracing of the assistant's AI requests, logging and error monitoring, and product analytics.
• United States. The AI language service that writes the assistant's answers, voice-note transcription and email delivery.
• India. The WhatsApp messaging provider for the assistant number.
• Other countries. Some services, including the one that reads documents and images and checks messages for abuse, run on global networks and may process information wherever they have servers. WhatsApp also handles messages in several countries.

We send personal information outside South Africa only as section 72 of POPIA allows. Usually that means the recipient is bound by law, binding corporate rules or a written agreement that protects the information in ways substantially similar to POPIA, including rules on passing it on to anyone else.

We take reasonable technical and organisational steps to keep personal information safe and to stop it being lost, damaged or used without permission. They include:

• encrypting information when it travels between your device, our servers and our operators;
• giving people access only to what their role needs, with extra sign-in checks for accounts that can see everything;
• written agreements with every operator that require them to keep information secure;
• regular backups, kept in South Africa.

If we believe someone has accessed or obtained personal information without permission, we act as POPIA requires. For our own records, we tell the Information Regulator and the people affected as soon as reasonably possible (section 22). For a community's records, we tell the community straight away (section 21(2)) and help it tell the Regulator and its members.

How long we keep it

We keep personal information only as long as we need it for the reason we collected it, unless the law requires or allows us to keep it longer.

• A community's records are kept, and deleted or returned, as our agreement with the community says.
• Customer, accounting and tax records are kept for as long as tax and company law require.
• Enquiries from people who do not become customers are deleted when we no longer need them to reply.

When we no longer need information, we delete or destroy it, or remove what identifies you so it can no longer be linked to you.

Under POPIA you have the right to:

• ask whether we hold personal information about you, free of charge, and ask for a copy of it (section 23);
• ask us to correct or delete it if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or if we are no longer allowed to keep it (section 24);
• object to us using it, on reasonable grounds, where we rely on a legitimate interest, and at any time to marketing (section 11(3));
• withdraw your consent where we rely on it, without affecting what we did before;
• not be subject to a decision based only on automated processing that has legal effect for you or affects you substantially (section 71). Amiti flags messages, and people decide;
• complain to the Information Regulator (below).

To use these rights, contact our Information Officer (section 7). We may ask you to prove who you are before we act. To object, you can use Form 1 of the POPIA Regulations. To ask us to correct or delete, you can use Form 2 of the POPIA Regulations. A clear email is also enough. We will answer within a reasonable time. Copies of records are covered by our access to information manual, which sets out the prescribed fees.

If you want a copy of a community's records about you, we decide that request ourselves under our access to information manual, and we tell the community. If you want a community's records about you corrected or deleted, or object to how they are used, we pass your request to that community, because it decides about its records, and we help it respond. If you want your messages left out of a community's record, ask that community.

If you are a customer

POPIA requires you to tell your members, before or as soon as reasonably possible after you add Amiti to a group, that Amiti is recording the group and why. We can give you a short notice to share with your members.

Complaints to the Information Regulator

If you are unhappy with how we have handled your personal information, please tell us first, so we can try to put it right. You can also complain to the Information Regulator at any time:

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200
• Website: inforegulator.org.za

Our Information Officer is Theunis de Klerk, our director. Contact the Information Officer about this notice or about your personal information:

• Email: hello@amiti.co.za
• Phone: +27 83 244 5540
• Post or by hand: Crossfire Place, 15 Gardener Williams Avenue, Paardevlei, Somerset West, 7130

We update this notice when what we do changes or when the law changes. The date at the top shows when it last changed. If a change affects our customers, we tell them by email before it takes effect.