Privacy Policy

1. Who is responsible for your information

The responsible party for your personal information is Stonelion Labs(Pty) Ltd, registration number 2023 / 192802 / 07, trading as "Stonelion" and "Stonelion Labs".

Registered address

4 Duffton Way, Aston Manor, Kempton Park, 1618 Johannesburg, Gauteng, South Africa

Information Officer

Kuziwa Sachikonye

Email

info@stonelionlabs.com

2. What personal information we collect

2.1 Information you give us

• Identity and contact details: your name, email address, phone number and company name, for example when you submit the playbook form, book a call, or enrol in the Course.
• Engagement information: information you share while we scope or deliver a project, including details about your business, processes, systems and, where you choose to give us access, data held in those systems.
• Billing information: the details needed to invoice you and record payment. Card payments, where offered, are handled by our payment provider and we do not store full card numbers.
• Correspondence: the content of emails, messages and call notes.

2.2 Information we collect automatically

• Technical and usage data: IP address, browser and device type, pages viewed, referring page and timestamps, collected through server logs and analytics.
• Cookies and similar technologies: see section 4.

2.3 Information from third parties

• Our scheduling, email, analytics and hosting providers, which pass us information such as booking details or delivery and open events for emails you have asked to receive.

3. How and why we use your information

We process your personal information for the following purposes, relying on the POPIA justifications shown:

Responding to enquiries and booking calls

To reply to you and arrange a consultation. Justification: steps at your request before entering a contract, and our legitimate interest in responding to enquiries.

Providing the Services

To scope, deliver and support System Build, Systems Partner and Course engagements, and to invoice you. Justification: performance of our contract with you.

Sending the free playbook and related resources

To deliver the resource you requested and follow up about it. Justification: your consent, given when you submit the form.

Marketing updates

To send occasional updates about new content, resources and services. See section 10. Justification: your consent, or our legitimate interest in marketing to existing clients about similar services.

Website analytics and improvement

To understand how the site is used and improve it. Justification: our legitimate interest in maintaining and improving the site, and your consent for non-essential cookies where required.

Legal, accounting and security

To keep records required by law, enforce our terms, and protect against fraud and misuse. Justification: compliance with a legal obligation and our legitimate interests.

4. Cookies and analytics

This site uses cookies and similar technologies. Strictly necessary cookies keep the site working and cannot be switched off. We also use Google Analytics to measure traffic; depending on the provider this may set analytics cookies or use cookieless measurement.

You can control cookies through your browser settings. Blocking some cookies may affect how the site works.

5. Who we share your information with

We do not sell your personal information. We share it only with operators (processors) who process it on our instructions under a written agreement, and where the law requires or allows it:

• Hosting and infrastructure: Google Firebase Hosting
• Email and CRM: Google Workspace | Convert Kit.
• Scheduling: Google Workspace.
• Analytics: Google Analytics.
• Payment Processing: Payfast.
• Professional advisers such as our accountant or lawyers, where needed.
• Authorities or third parties where disclosure is required by law, or to establish, exercise or defend a legal claim.
• A successor entity if the business is reorganised, sold or merged.

6. Cross-border transfers

Some of our providers store or process personal information outside South Africa, including in the European Union and the United States. Where we transfer personal information across borders, we do so in line with section 72 of POPIA, relying on the recipient being subject to a law or binding agreement that provides an adequate level of protection, on your consent, or on the transfer being necessary to perform our contract with you.

7. How long we keep it

• Enquiry and marketing data: until you unsubscribe or ask us to delete it, and then removed within a reasonable period.
• Client and engagement records: for the duration of the engagement and for 5 years afterwards, or longer where tax, company law or a potential legal claim requires it.
• Invoicing and accounting records: for at least five years, as required by South African tax and company law.
• Website logs and analytics: for 60 months.

8. How we protect it

We take appropriate, reasonable technical and organisational measures to safeguard personal information against loss, unauthorised access and misuse, including access controls, encryption in transit, use of reputable providers, and limiting access to those who need it. No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

9. Your rights under POPIA

Subject to the conditions and exceptions in POPIA, you have the right to:

• ask whether we hold personal information about you, and request access to it;
• request that we correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds, to our processing of your personal information;
• object at any time to processing for direct marketing;
• withdraw consent where we rely on consent, without affecting processing already carried out;
• lodge a complaint with the Information Regulator (see section 13).

To exercise any of these rights, email info@stonelionlabs.com. We may need to verify your identity before acting. Access requests may be made on the prescribed form under the Promotion of Access to Information Act 2 of 2000.

10. Direct marketing

We send marketing communications only where you have consented or where section 69 of POPIA otherwise permits it, for example to existing customers about similar services. Every marketing email includes an unsubscribe link, and you can reply STOP to marketing SMS messages. You can also opt out at any time by emailing info@stonelionlabs.com. We will action opt-out requests promptly.

11. Children

Our website and Services are intended for businesses and are not directed at children. We do not knowingly collect personal information about children under 18. If you believe we have, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, with the "Last updated" date at the top. If a change is significant, we will take reasonable steps to tell you.

13. Contact and complaints

For any question or request about your personal information, contact our Information Officer at info@stonelionlabs.com.

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

Website

inforegulator.org.za

General enquiries

enquiries@inforegulator.org.za

POPIA complaints

POPIAComplaints@inforegulator.org.za

See also our Terms & Conditions.