AI Inside (Pty) Ltd · Effective date: 12 October 2026
This notice explains how AI Inside (Pty) Ltd collects, uses, shares and protects personal information, as required by section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to this website, our enquiries and events, and the training, programmes and advisory services we deliver.
Our German-language website is directed at organisations in Germany. For people in the European Union, the EU General Data Protection Regulation (GDPR) may apply in addition to POPIA. Our German Datenschutzerklärung at https://ai-inside.co.za/de/datenschutzerklaerung/ sets out the details.
1. Who we are
| Item | Details |
|---|---|
| Responsible party | AI Inside (Pty) Ltd, registration number 2026/410708/07 |
| Registered address | No 61 Ferero Avenue, Randpark Ridge, Randburg, Gauteng, 2156, as registered with CIPC |
| Information Officer | Daniela Purps, Director |
| Privacy contact | info @ ai-inside.co.za |
| PAIA Manual | here |
2. Our role: responsible party or operator
When we decide why and how personal information is processed, for example for our website, enquiries, marketing and our own client relationships, we are the responsible party.
When an organisation engages us to train its staff, we often process participant information on that organisation’s behalf and according to its instructions. In that case we act as an operator (section 21 of POPIA), and the organisation remains the responsible party. Its own privacy notice then applies to participants. We set out our role in each client agreement.
3. What personal information we collect
| Category | Examples |
|---|---|
| Contact and identification | Name, job title, role, organisation, business email, business telephone number |
| Enquiries and correspondence | Content of messages, meeting notes, training needs and organisational context you share |
| Training and learning | Attendance, learning platform activity, assessment results, completion certificates, pre- and post-training survey responses |
| Contract and billing | Proposals, contracts, purchase orders, invoicing and payment details |
| Website and technical | IP address, approximate location, browser and device information, pages visited, cookie choices (see section 10) |
| Applications | CV, qualifications, references |
Where it comes from. We collect most information directly from you. We also receive information from your employer when it registers you for a programme, and we use publicly available professional sources such as LinkedIn when you or your organisation contacts us.
Voluntary or required. Providing personal information is voluntary. Without your name and contact details we cannot answer your enquiry. Without the participant details your employer provides, we cannot register you for a programme or issue a certificate. Survey participation is voluntary, and not taking part has no consequences for your training or certificate.
Special personal information
We do not intentionally collect special personal information, such as health information, biometric data, religious beliefs or criminal behaviour, or personal information of children. Please do not include such information in survey responses or free-text fields.
4. Why we process personal information and on what basis
| Purpose | Lawful basis (section 11 of POPIA) |
|---|---|
| Responding to enquiries | Legitimate interest (s 11(1)(f)); steps you requested before a contract (s 11(1)(b)) |
| Proposals and contracts with organisations | Legitimate interest of AI Inside and the client organisation (s 11(1)(f)); contract, where you contract in your own name (s 11(1)(b)) |
| Delivering training, the AI READY 360° programme, webinars and keynotes | As operator: the client’s lawful basis. As responsible party: contract or legitimate interest (s 11(1)(b) or (f)) |
| Issuing certificates and keeping training records | Legitimate interest of the participant and the client in proof of competence (s 11(1)(f)); contract (s 11(1)(b)) |
| Pre- and post-training surveys | Legitimate interest in designing and evaluating training (s 11(1)(f)); participation is voluntary |
| Invoicing, accounting and tax | Contract (s 11(1)(b)); legal obligation (s 11(1)(c)) |
| Newsletters and other direct marketing | Consent, or our existing customer relationship (section 69 of POPIA); see section 11 |
| Website operation and security | Legitimate interest (s 11(1)(f)) |
| Analytics and non-essential cookies | Consent (s 11(1)(a)), given through our cookie banner |
| Job and freelance applications | Steps you requested before a contract (s 11(1)(b)) |
| Legal and regulatory obligations | Legal obligation (s 11(1)(c)) |
We do not use personal information for purposes that are incompatible with those listed above.
5. How we use AI tools in our own work
We use AI tools in our own work, for example to draft documents, summarise meeting notes and analyse aggregated survey results. Where these tools process personal information, we use business versions under written agreements that do not allow the provider to use our inputs to train its models. We pseudonymise survey responses before analysis. AI tools do not make decisions about participants that have legal or similarly significant effects. Certificates are issued on the basis of the completion criteria of the learning platform.
6. Who we share personal information with
- Operators who process information on our behalf under written agreements (section 21 of POPIA): website hosting, email, video conferencing, learning platform, survey tools, accounting and CRM. Section 7 lists the providers.
- Client organisations that commission training: attendance lists and certificates of their own participants by name, and survey results in aggregated form only.
- Freelance trainers and delivery partners who co-deliver a programme, limited to what they need for their role and bound by confidentiality.
- Professional advisers, such as accountants, auditors and lawyers.
- Public bodies, such as SARS, the Information Regulator or a court, where the law requires it.
We do not sell, rent or trade personal information.
7. Transfers outside South Africa
Some of our providers store or process data outside South Africa, and we work with clients and participants in the European Union. We transfer personal information across borders only where section 72 of POPIA allows it, in particular where the recipient is bound by law, binding corporate rules or a binding agreement that provide adequate protection, or where the transfer is necessary to perform a contract.
| Provider | Purpose | Data location | Safeguard |
|---|---|---|---|
| Ionos | Website hosting | Europe | Agreement / DPA |
| Microsoft 365 | Email and documents | USA | DPA |
| Video conferencing Teams / Zoom | Live training and meetings | USA | DPA |
| Learning platform | Self-learning course, certificates | Europe | DPA |
| Pre- and post-training surveys | USA | DPA | |
| AI tools | See section 5 | Germany | DPA |
| SureCookie (WordPress plugin) | Cookie consent | Stored on our server | – |
| Accounting software | Invoicing | South Africa | DPA |
8. How long we keep personal information
| Category | Retention period |
|---|---|
| Enquiries without a resulting engagement | 3 years from last contact |
| Client contracts and project records | 5 years after the engagement ends |
| Accounting and financial records | 7 years (section 24 of the Companies Act 71 of 2008; section 29 of the Tax Administration Act 28 of 2011) |
| Attendance records and certificates | 5 years after completion, or as agreed with the client |
| Individual survey responses | 12 months after the report is delivered; afterwards only aggregated or anonymised results |
| Marketing contacts | Until you withdraw consent or opt out. We keep a minimal record so that we can honour your opt-out. |
| Job applications | 12 months, unless you agree to a longer period |
| Cookies | As shown in the cookie banner |
We then delete, destroy or de-identify the information securely (section 14 of POPIA).
9. How we protect personal information
We take appropriate, reasonable technical and organisational measures (section 19 of POPIA).
- encrypted transmission (HTTPS/TLS);
- multi-factor authentication for business accounts;
- access on a need-to-know basis and regular review of access rights;
- written agreements with operators;
- confidentiality obligations for trainers and contractors;
- a documented procedure for security compromises.
If we have reasonable grounds to believe that personal information has been compromised, we notify the Information Regulator through its eServices portal and inform affected people as required by section 22 of POPIA.
10. Cookies and website tools
We use the SureCookie plugin to manage cookie consent. Essential cookies keep the website working and store your cookie choice. We only set analytics or marketing cookies – Google Analytics after you have agreed. You can change your choice at any time via Cookie settings link in the footer.
Our website links to our LinkedIn and Instagram pages and to our Google Business profile. These are plain links. The providers receive data only when you click them, and their own privacy policies apply.
11. Direct marketing
We send newsletters and information about our services by email or other electronic means only if you have agreed, or if you are an existing client and the information concerns similar services (section 69 of POPIA). We do not treat silence, pre-ticked boxes or the mere option to opt out as consent.
Every marketing message identifies us and includes a simple way to unsubscribe. You can also object at any time, free of charge, by email to info @ ai-inside.co.za with the subject “Unsubscribe”. Where a block registered with the National Consumer Commission’s Opt-Out Registry applies to you, we honour it.
12. Your rights
- Access: to ask, free of charge, whether we hold personal information about you, and to request a copy (section 23).
- Correction and deletion: to ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24).
- Objection: to object to processing based on legitimate interest, and to object to direct marketing at any time (section 11(3)).
- Withdrawal of consent: at any time, without affecting earlier lawful processing.
- Automated decisions: not to be subject to a decision based solely on automated processing with legal or similarly significant effects (section 71).
- Complaint: to lodge a complaint with the Information Regulator (section 74).
You can contact us by email, post, telephone or WhatsApp [delete if not offered]. You may use the Regulator’s forms (Form 1 for objections, Form 2 for correction or deletion), but you do not have to. We may ask you to verify your identity. We respond in writing within 30 days. Requests for access to other records are handled under our PAIA Manual.
13. Complaints to the Information Regulator
| Information Regulator (South Africa) | Details |
|---|---|
| Address | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| Postal address | P.O. Box 31533, Braamfontein, Johannesburg, 2017 |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za · 010 023 5200 |
| Website | inforegulator.org.za |
We would appreciate the chance to resolve your concern first. Please contact our Information Officer.
14. Changes to this notice
We update this notice when our services, providers or legal requirements change. The current version is always available on this page. Last updated: October 2026.