Privacy Policy

This Privacy Policy explains how Africa This and That Trading (PTY) LTD (trading as Kudu WorkSpace) collects, uses, discloses and protects your personal information when you use Kudu WorkSpace and our websites (the "Services").

We are the data controller / responsible party for personal information we hold about you. You can reach us at privacy@kuduworkspace.com or by post at 8 Fairway Drive, Kibler Park, Johannesburg, Gauteng, 2091, South Africa.

1. Information we collect

• Account data: name, email address, password hash, profile photo, role, organisation.
• Customer Data: data you upload to use the Services (deals, invoices, proposals, expenses, ideas, roadmap items, retros, asset records, etc.).
• Billing data: name, billing address, VAT number and last 4 digits of payment card. Full payment details are handled by our merchant of record (Paddle), not us.
• Usage data: log data, IP address, device, browser, pages viewed, actions taken — used to operate, secure and improve the Services.
• Communications: messages you send us via email, contact form or support chat.

2. How we use your information

• Provide, maintain and improve the Services;
• Authenticate you and protect your account;
• Process payments and send invoices;
• Send transactional and service emails;
• Provide customer support;
• Detect, prevent and respond to fraud, abuse and security incidents;
• Comply with legal obligations.

3. Legal bases (GDPR / POPIA)

We process personal information on the basis of: (a) the contract with you to provide the Services; (b) our legitimate interests in operating and securing the Services; (c) your consent where required (e.g. marketing emails); and (d) legal obligations.

4. Sharing

We share personal information only with: trusted sub-processors (cloud hosting, payment processing, email delivery, error monitoring, AI providers); professional advisors; and competent authorities where required by law. A current sub-processor list is available on request from privacy@kuduworkspace.com.

5. International transfers

Some of our sub-processors are located outside South Africa and the EEA. Where required, transfers are protected by appropriate safeguards (e.g. Standard Contractual Clauses).

6. Retention

We retain Customer Data while your subscription is active and for a reasonable period thereafter to allow recovery and to meet legal obligations. You can export and delete your data at any time from Settings → Data export.

7. Security

We use industry-standard measures to protect personal information, including encryption in transit, encryption at rest, access control and audit logging. No system is perfectly secure; please contact us promptly if you suspect unauthorised access to your account.

8. Your rights

Depending on your location, you have the right to access, correct, delete, port and object to processing of your personal information, and to lodge a complaint with a supervisory authority. To exercise these rights, email privacy@kuduworkspace.com.

South African residents may lodge a complaint with the Information Regulator (inforegulator.org.za).

9. Cookies

We use cookies and similar technologies for authentication, preferences and aggregated analytics. You can control cookies via your browser settings.

10. Children

The Services are not intended for children under 16. We do not knowingly collect personal information from children.

11. Changes

We may update this Policy from time to time. Material changes will be notified via email or in-product banner. The "Last updated" date above shows when this version took effect.

12. Contact

Privacy questions: privacy@kuduworkspace.com
Postal: Africa This and That Trading (PTY) LTD, 8 Fairway Drive, Kibler Park, Johannesburg, Gauteng, 2091, South Africa