Privacy Policy
This Privacy Policy explains how Strategix Application Solutions (Pty) Ltd collects, uses, stores, and protects personal information through its website, sales processes, and platform-related interactions.
1. Scope
This policy applies to personal information collected through the XGRC® website, enquiry and proposal processes, and any platform-related interactions with prospects, customers, and other individuals who interact with Strategix. It does not cover personal information processed by Strategix as an Operator / Processor on behalf of its customers in connection with the XGRC® platform — that processing is governed by the Data Processing Addendum.
2. Information We Collect
We may collect: contact details (name, email, telephone, job title); company and organisation information; communications and correspondence; website usage data; support and service records; and any personal information submitted through our forms or business processes.
3. Why We Use Personal Information
We use personal information to manage enquiries, proposals, contracts, onboarding, support, billing, compliance, platform administration, and other lawful business purposes.
4. Direct Marketing
We send marketing messages (news, events and offers about XGRC® Software) by email or WhatsApp only to people who have agreed to receive them, for example by ticking the opt-in box on one of our forms, or to existing customers about similar products and services, as section 69 of POPIA allows. Every marketing message tells you how to stop receiving them, and you can opt out at any time by replying STOP, using the unsubscribe link or contacting us. We keep a record of when and how you agreed or opted out. Messages about an enquiry you made or about your account are not marketing and do not need this consent.
5. Legal Basis
We process personal information in accordance with POPIA and, where applicable, equivalent data protection legislation. Where consent is required, we will request it separately.
6. Sharing and Disclosure
We do not sell personal information. We may share personal information with service providers and subprocessors who support our business operations, subject to appropriate contractual safeguards. We share limited information with advertising platforms only as described in section 7. We may also disclose personal information where required by law.
7. Measuring Our Advertising
When you arrive on our website by clicking one of our adverts on Google, Microsoft (Bing), LinkedIn or Meta (Facebook, Instagram) and then send us an enquiry, we tell that platform what happened to the enquiry: for example, that it became a qualified lead, an opportunity or a customer, and the deal value. This shows us which adverts bring real customers, so we spend less on the ones that do not. To match the enquiry to the advert, we send the platform the advert's click identifier and, only where the platform needs it, your email address or telephone number in hashed form (scrambled one way with SHA-256, so the platform can only match it to an account it already holds, not read it). We send nothing else from your enquiry. We do this only for enquiries that came from one of our adverts, and only within 90 days of the click. We rely on our legitimate interest in measuring our advertising (POPIA section 11(1)(f); GDPR Article 6(1)(f)). These platforms may process the information outside South Africa, under their own privacy policies and our agreements with them. You can object at any time through our Privacy Requests page, and we will stop including your details.
8. Security
We apply reasonable technical and organisational safeguards aligned to ISO 27001:2022 to protect personal information against loss, unauthorised access, disclosure, or misuse.
9. Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to lawful retention obligations.
10. Data Subject Rights
You may request access to, correction of, or deletion of your personal information, or raise a privacy concern, using the process described on our Privacy Requests page.
11. Changes
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date.
Questions about this document, or need a signed copy for procurement? Contact us.
Contact us