POPIA & lawful basis
We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA). We act as a responsible party for the data we collect to deliver and support your service, and as an operator when we process personal information on your behalf inside the AI systems we build for you.
Our lawful bases for processing include:
- Contract — processing needed to build, deliver and run the service you signed up for.
- Legitimate interest — securing our systems, preventing fraud and improving reliability.
- Consent — where you or your end users explicitly opt in (for example, marketing or optional data collection).
- Legal obligation — tax, accounting and other statutory record-keeping.
We collect only what we need, keep it only as long as needed, and never sell personal information.
Encryption
Credentials, API keys and sensitive configuration are stored encrypted and are never exposed in client-side code.
Hosting
Our systems run on established hosting and database providers in the EU and elsewhere. Where personal information leaves South Africa, we transfer it under section 72 of POPIA. The Privacy Policy lists every provider and where it is.
A limited number of trusted sub-processors (for example, AI model APIs and payment processing via PayFast) may process data strictly to deliver the service. We use only reputable providers and pass through only the minimum data required. The full list of sub-processors is in our Privacy Policy.
Backups & recovery
We run automated nightly backups of our databases, kept on access-controlled servers. This protects you against accidental loss, corruption or service disruption.
Data Processing Agreement (DPA)
For enterprise and any client who requires one, we provide a POPIA-aligned Data Processing Agreement covering processing scope, security measures, sub-processors, breach notification and data return/deletion on termination.
Request a DPA by emailing sales@doubledownai.co.za.
Your rights (data subjects)
Under POPIA, data subjects may request access to, correction of, or deletion of their personal information, and may object to certain processing. We will action valid requests within a reasonable period and free of charge in most cases.
For full details on what we collect and why, see our Privacy Policy | Unsubscribe. To exercise a right or raise a concern, contact us using the details below.
Incident response
If a security incident affects personal information, we will assess and contain it promptly and notify affected parties and the Information Regulator where POPIA requires it. Security questions and responsible-disclosure reports are welcome at sales@doubledownai.co.za.