DRAFT — FOR PROFESSIONAL LEGAL REVIEW
Prepared for ORION269 (PTY) LTD / WhatsMyBiz.App
This document is a draft for review only. Subject to professional legal review and approval.
Operated by ORION269 (PTY) LTD | CIPC 2026/535275/07
Draft v2.0 for review — effective date to be confirmed on approval. Draft prepared for ORION269 (PTY) LTD. Subject to professional legal review and approval.
This Privacy Policy explains how ORION269 (PTY) LTD, operating WhatsMyBiz.App, collects, uses, stores, shares and protects personal information. It is intended to support compliance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.
ORION269 (PTY) LTD is a South African private company registered under CIPC number 2026/535275/07. For processing activities for which ORION269 determines the purpose and means, ORION269 acts as the Responsible Party. Where a Customer determines the purpose and means and ORION269 processes information on the Customer's instructions, ORION269 may act as an Operator.
ORION269 processes personal information in accordance with the applicable conditions for lawful processing under POPIA. Depending on the circumstances, processing may rely on consent, performance of a contract, compliance with a legal obligation, protection of legitimate interests, or another lawful ground recognised by applicable law. Consent is not treated as a universal substitute where another lawful basis applies.
A Customer may provide personal information about its own customers, employees, suppliers or other data subjects. Where the Customer determines why and how that information is processed, the Customer remains responsible for its lawful collection, instructions, notices and use, including ensuring it has the necessary rights, permissions, authority and lawful basis. ORION269 processes such information only for authorised service purposes and under the applicable Business Data Processing Terms.
WhatsMyBiz provides Intelligent Agent (iA) design, configuration, grounding, integration and deployment services. Intelligent Agents operate using the business information, instructions, rules and knowledge supplied or authorised by the Customer, together with third-party technology. The underlying artificial-intelligence models and related infrastructure may be supplied by independent third-party providers, which may change over time. ORION269 does not itself provide or own the underlying foundation models used by an Intelligent Agent.
Where an Intelligent Agent processes personal information as part of the service, the applicable role depends on the actual processing activity: where the Customer determines the purpose and means, the Customer is the Responsible Party and ORION269 acts as an Operator; ORION269 may separately be a Responsible Party for its own processing (accounts, billing, website operation, security, administration, its own communications and legal compliance).
ORION269 will use appropriate contractual and technical controls for providers used to process personal information and will not knowingly sell personal information for advertising.
WhatsMyBiz uses service providers in defined categories, including:
Access is limited to what is reasonably necessary for the relevant service. Not every provider is a "data processor" of personal information in every case; the role of each provider depends on what it actually does with the information. ORION269 will require appropriate contractual or equivalent protections where a provider processes personal information on ORION269's behalf.
Some service providers may process information outside South Africa, including in the United States, Europe or elsewhere. The actual provider and location may vary and may change over time. Transfers of personal information outside South Africa will rely on one of the grounds in section 72(1) of POPIA, and consent will be obtained where required. ORION269 will take reasonable steps to ensure that the applicable requirements are considered and met, including appropriate contractual, technical or other lawful safeguards where required. Customers must ensure their instructions and use of the service remain lawful.
ORION269 will conduct direct marketing using electronic communications only where permitted by applicable law. Customers may unsubscribe from marketing communications where an unsubscribe mechanism is required.
No internet or cloud service can be guaranteed to be completely secure. ORION269 takes reasonable technical and organisational measures appropriate to the nature and risk of the information, as required by POPIA. ORION269 does not promise zero breaches, perfect security or unbreakable encryption.
Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, contractual requirements, legitimate business needs, dispute handling, security, or legal obligations. Following service termination, Customer business data will be deleted or anonymised in accordance with the applicable retention schedule for the relevant system (generally within 60 days of service termination where the system supports it, and otherwise within the system's scheduled purge cycle), subject to legal retention obligations, active disputes, security requirements, secure backup and technical deletion cycles, fraud prevention and accounting/tax obligations. This does not guarantee deletion from every third-party backup within that period. Accounting and tax records may be retained for the period required by law. Retention schedules currently in operation include approximately three years for conversational logs and scheduled purge cycles for session data; ORION269 is implementing purge schedules for all operational records and will update this policy as those schedules take effect.
Subject to applicable law and verification of identity, data subjects may have rights including access to personal information, correction, deletion where lawful, objection to certain processing, restriction where applicable, withdrawal of consent where consent is the lawful basis, and the right to lodge a complaint with the Information Regulator. Where a Customer is the Responsible Party for the relevant processing, requests will be handled in accordance with the Customer's instructions and the Business Data Processing Terms.
WhatsMyBiz may use cookies or similar technologies necessary for website functionality, security, preferences, analytics or other permitted purposes. The WhatsMyBiz website uses Google Tag (analytics identifier G-G83X9YX29M) for audience measurement; Google may process a limited set of technical data (such as IP address and device/browser information) for this purpose. Where consent is legally required for a non-essential technology, the relevant consent mechanism will be used.
WhatsMyBiz is primarily a business service. Customers must not intentionally use the service to collect or process children's personal information except where lawful and appropriate safeguards and authorisations are in place.
Information Officer: Graham Schubach (registered with the Information Regulator: 2026-061428) Email: hello@whatsmybiz.app Company email: info@oriondevcore.com WhatsApp: +27 72 497 1810 Physical address: 26 Vasco da Gama Drive, Amanzimtoti, Durban, Kwa-Zulu Natal, 4001
A complaint may first be sent to ORION269 at the contact details above. A data subject may also contact the Information Regulator of South Africa through its official channels. The Regulator's current contact information is available on its official website.
ORION269 (PTY) LTD · CIPC 2026/535275/07 · docs.oriondevcore.com Draft prepared for ORION269 (PTY) LTD. Subject to professional legal review and approval.