Privacy Notice

Last updated: 31 July 2026

1. Who we are

This notice is issued by Foundry Digital Studio (Pty) Ltd (registration number 2026/384110/07), trading as Foundry Digital AI ("Foundry", "we", "us"). We build and operate AI automation systems for South African businesses.

Registered address: 56 Victoria Square, 15 Harris Avenue, Edenglen, 1613, South Africa.

Our Information Officer is Melissa (Pathmawathie) Mathurai, registered with the Information Regulator (registration number 2026-063471). Contact: melissa@foundrydigitalai.com.

2. Whose information this notice covers

This notice applies where Foundry decides why and how personal information is processed, that is, where Foundry is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). That covers:

• visitors to foundrydigitalai.com;
• people who contact us or complete our AI Readiness assessment;
• prospective clients we contact or hold details for;
• the contact and billing details of our clients and their staff.

If you interacted with an automated system we run for one of our clients (for example a WhatsApp booking or reminder service for a business you deal with), that business is the responsible party for your information and its privacy notice applies. We process that information only as an operator on the business's instructions, under a written agreement. Please direct requests about that information to the business itself; if you contact us instead, we will pass your request to them.

3. What we collect

• Contact details you give us: name, email address, phone number, company name, and the content of your enquiry.
• AI Readiness assessment responses, together with the contact details you submit with them.
• Client account information: the contact, billing and correspondence records needed to run a client engagement.
• Prospecting information about businesses we believe may benefit from our services: publicly available business contact details such as a name, role, work email address and company information.
• Technical website data: our hosting infrastructure keeps standard server logs (IP address, pages requested, timestamps). We do not run third-party analytics or advertising trackers on this website.

We collect this information directly from you, from publicly available sources, or from the company you work for.

4. Why we process it

Purpose	Lawful basis (POPIA s11)
Responding to enquiries and assessment submissions	Your consent, or steps taken at your request before entering a contract
Providing services to clients, including support and billing	Performance of a contract
Contacting businesses about our services	Our legitimate interests in marketing our services, subject to section 69 (see section 5)
Keeping accounting and tax records	Compliance with a legal obligation
Securing and troubleshooting our website and systems	Our legitimate interests

5. Direct marketing

We only send unsolicited electronic marketing in accordance with POPIA section 69: with your consent, or where you are an existing customer and the message concerns similar services. Every marketing message we send identifies us and gives you a way to opt out. If you opt out, we stop; we keep only the minimum record needed to honour the opt-out.

6. Who we share it with

We do not sell personal information. We share it only with:

• Service providers that host or support our systems: Hostinger (server hosting), Supabase (database hosting), Google, Microsoft, Meta Platforms (WhatsApp Business Platform) and Anthropic (AI processing). Each is bound to handle the information securely and only on our instructions. Content submitted to Anthropic is not used to train AI models.
• Professional advisers (legal, accounting, insurance) where necessary.
• Authorities, where the law requires it.

7. Where it is processed

Some of our service providers process information outside South Africa: in the United Kingdom (server hosting, Manchester), the European Union (database hosting, Frankfurt), Ireland and the United States. We transfer information across borders only as permitted by POPIA section 72, relying on recipients being bound by laws or binding agreements that protect personal information to a substantially similar standard.

8. How long we keep it

We keep personal information only as long as needed for the purpose it was collected for. Enquiry and prospecting records are deleted when no longer relevant. Client account and billing records are kept for the duration of the engagement and thereafter for the periods required by tax and company law (generally five years). You may ask us to delete information sooner; see section 10.

9. How we protect it

We apply the safeguards required by POPIA section 19: encrypted connections, access-controlled credential management, per-client separation of hosted data, and version-controlled backups. No system is perfectly secure, but if a breach occurs that affects your information, we will notify the Information Regulator and, where required, you, as section 22 requires.

10. Your rights

Under POPIA you may:

• ask whether we hold personal information about you, and request access to it;
• ask us to correct or delete it;
• object to processing, including direct marketing;
• withdraw consent where processing is based on consent;
• complain to the Information Regulator.

To exercise any of these rights, contact our Information Officer at melissa@foundrydigitalai.com. Formal access requests are handled under our PAIA manual.

Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.

11. Changes to this notice

We may update this notice from time to time. The date at the top reflects the latest revision. Material changes affecting current clients are notified directly.

12. Contact

Melissa Mathurai, Information Officer
Foundry Digital Studio (Pty) Ltd, trading as Foundry Digital AI
56 Victoria Square, 15 Harris Avenue, Edenglen, 1613
melissa@foundrydigitalai.com