Privacy notice
What we collect when you contact us or work with us, why, who receives it, how long we keep it, and your rights under POPIA.
Last updated: 16 October 2026. This notice is given under section 18 of POPIA.
Part 1 – About this notice
1.1 Who we are
Leverpoint (Pty) Ltd, registration number 2026/672248/07, 63 Boeren Street, Vryheid, KwaZulu-Natal, 3100 (“Leverpoint”, “we”). Brand: Leverpoint, Intelligence Applied. AI Consulting & Implementation.
1.2 Our two roles
Responsible party. We decide how and why we process personal information for our own enquiries, qualification forms, contracts, billing and marketing. Part 2 explains this.
Operator. When we build or run systems for our clients, we process their personal information, and their clients’ personal information, only on their instructions. Our client is the responsible party, and its own privacy notice applies. Part 3 explains this.
1.3 Contact
Information Officer: the Director of Leverpoint (Pty) Ltd, as head of the private body. Email: hello@leverpoint.co.za. Address: 63 Boeren Street, Vryheid, KwaZulu-Natal, 3100.
Part 2 – When we are the responsible party
2.1 What we collect
| CATEGORY | EXAMPLES | SOURCE |
|---|---|---|
| Contact details | Name, work email, phone, firm name, role | You, via our website form or email |
| Qualification information | Firm size, the business problem, current tools | Our written qualification form |
| Consultation and engagement records | Notes of calls; recordings only if you agree | You |
| Contract and billing | Signatory details, invoices, payments, firm registration and tax details | You, and our bank |
| Marketing preferences | Your consent, opt-outs, and when they were given | You |
| Website technical data | IP address, browser type, pages visited | Your device (see Cookie Notice) |
We do not ask for special personal information or children’s personal information. Please do not send it.
2.2 Why we use it, and our lawful basis
| PURPOSE | LAWFUL BASIS |
|---|---|
| Responding to enquiries and qualifying fit | Steps at your request before a contract: s11(1)(b). Our legitimate interest: s11(1)(f) |
| Performing and administering contracts | Contract: s11(1)(b) |
| Invoicing, accounting and tax records | Legal obligation: s11(1)(c) |
| Electronic direct marketing | Your consent: s69(1)(a); or, for existing customers, s69(3) |
| Website security and operation | Legitimate interest: s11(1)(f) |
| Recording calls (if you agree) | Consent: s11(1)(a) |
2.3 Whether you must provide it
Contact and qualification information is voluntary. Without it, we cannot respond or offer a consultation. Contract and billing information is needed to contract with you, and some of it is required by tax law.
2.4 Who we share it with
We share it only with the service providers below, which act as our operators, and with professional advisers, banks, SARS or others where the law requires.
2.5 Service providers and transfers outside South Africa
We do not promise that personal information stays in South Africa. We assess each provider’s transfer basis under POPIA s72 before use. The usual basis is s72(1)(a), a binding agreement giving adequate protection.
| PROVIDER | WHAT IT DOES FOR US | PERSONAL INFORMATION INVOLVED | LOCATION | TRANSFER BASIS |
|---|---|---|---|---|
| Formspree, Inc. | Processes submissions from our website forms, including the qualification form | Everything you type into the form | United States | s72(1)(a): Formspree terms of service and privacy policy, assessed 16 October 2026 |
| Google (Workspace) | Email, documents and storage | Correspondence, documents, contact details | United States, with Google data centres in other regions | s72(1)(a): Google Workspace Data Processing Addendum |
| Supabase | Database and hosting for our own tools | Enquiry and engagement records | European Union, Frankfurt (eu-central-1) | s72(1)(a): Supabase Data Processing Addendum |
| Anthropic | AI models used in our own work | Only what is needed for a task. We do not put your information into AI tools unless that is necessary, and our use is under Anthropic’s commercial terms, under which customer inputs are not used to train models | United States | s72(1)(a): Anthropic Commercial Terms and Data Processing Addendum |
| Vercel | Hosting our website | Website technical data (IP address, request logs) | United States and Vercel’s global edge network | s72(1)(a): Vercel Data Processing Addendum |
| FNB (FirstRand Bank Limited) | Banking: receiving and making payments | Billing and payment details | South Africa | No cross-border transfer |
We update this list before we start using any new provider.
2.6 How long we keep it
Enquiries that do not lead to a contract: 12 months after last contact.
Contract and billing records: 5 years after the end of the tax year concerned and 7 years for company accounting records.
Call recordings: 90 days, unless needed for a dispute.
Marketing consent records: while you are subscribed and 3 years after you opt out, as proof of consent.
Our Data Retention Policy has the full schedule.
2.7 Security
We take reasonable technical and organisational measures to protect personal information. If a security compromise affects you, we will tell you and the Information Regulator.
2.8 Automated decisions
We do not make decisions about you based solely on automated processing.
Part 3 – When we are an operator for our clients
We process client personal information only on the client’s documented instructions, under a written operator agreement.
We do not use it for our own purposes or to train AI models.
Our client remains the responsible party. If your information is in a client’s system, contact that client to exercise your rights. If you contact us, we will pass your request on to them.
We use the providers listed in our operator agreement, assessed under POPIA s72. Where possible, client systems run on the client’s own accounts.
We will not build systems that make decisions about individuals, such as decisions on credit, insurance, employment or legal outcomes.
Part 4 – Your rights
You may: ask whether we hold your personal information and request access to it ; ask us to correct or delete it ; object to processing based on legitimate interest ; object to direct marketing at any time ; withdraw consent ; and complain to the Information Regulator.
You may make a request by email, post, by hand, by telephone (which we will record) or by any other convenient means, free of charge, using a form substantially similar to the Regulator’s Form 1 (objection) or Form 2 (correction or deletion), or in your own words.
Our timelines. We acknowledge requests within 5 Business Days and respond within 30 days. Access requests under PAIA follow the timelines in our PAIA Manual.
Part 5 – Information Regulator
The Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Tel 010 023 5200 / toll-free 0800 017 160. Email enquiries@inforegulator.org.za. Website inforegulator.org.za. Complaints are lodged on Form 5. Contact details confirmed on the Regulator’s website on 16 October 2026: (Regulator PAIA page, checked 16 October 2026.)
Part 6 – Changes
We will post updates here and tell clients of material changes.
Last updated 16 October 2026.