1. Introduction

TopCode (“TopCode”, “we”, “us”, or “our”) respects your privacy and is committed to protecting personal information processed through the TopCode CHAT platform (“Platform” or  “Service”).

This Privacy Policy explains how we collect, use, store, disclose, transfer and protect personal information when you access or use TopCode CHAT.

TopCode processes personal information in accordance with applicable South African data-protection laws, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), where applicable.

TopCode CHAT provides businesses with software functionality that may include AI-powered customer communication, business knowledge-base management, conversation management, conversation history, inbound and outbound call management, WhatsApp messaging, message templates, campaigns, flows, automation and customer journeys.

Because the Platform may process personal information belonging to a business customer’s own customers, this Privacy Policy distinguishes between information TopCode processes for its own business purposes and information TopCode processes on behalf of its business customer

2. Who We Are

TopCode is a South African software development company providing custom software, cloud, API, mobile application and artificial intelligence solutions.

TopCode CHAT is a software-as-a-service platform operated by TopCode.

3. Important Definitions and POPIA Roles

For purposes of this Privacy Policy:

Personal information means personal information as defined in the Protection of Personal Information Act, 2013 (POPIA), or applicable data-protection legislation.

Business customer means a business or organisation that subscribes to, configures or uses TopCode CHAT.

End customer means an individual who communicates with a business customer through a communication channel connected to TopCode CHAT.

Customer Content means information submitted, uploaded, generated or otherwise made available by a business customer or its authorised users through the Platform, including messages, conversation records, knowledge-base material, templates, flows and campaign content.

Responsible party means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information, as defined in POPIA.

Operator means a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that responsible party, as defined in POPIA.

The parties’ respective roles depend on the particular processing activity and the purposes for which personal information is processed.

Where a business customer uses TopCode CHAT to manage communications with its own customers, the business customer will generally act as the responsible party and TopCode will act as its operator when processing personal information on the business customer’s behalf.

TopCode may act as a responsible party for personal information processed for its own purposes, including account administration, billing, platform security, customer support, legal compliance and the management of its business relationship with subscribers.

3.1 Operator Obligations

Where TopCode acts as an operator, TopCode will:

a. Process personal information only in accordance with the business customer’s documented instructions, the applicable service agreement and applicable law, unless otherwise required by law.

b. Treat personal information processed on behalf of the business customer as confidential and ensure that persons authorised to process it are subject to appropriate confidentiality obligations.

c. Take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing.

d. Notify the business customer as soon as reasonably possible after becoming aware of reasonable grounds to believe that personal information processed on its behalf has been accessed or acquired by an unauthorised person, and provide reasonable assistance with investigating and addressing the incident.

e. Use third-party service providers and sub-processors where reasonably necessary to provide, maintain, secure or support TopCode CHAT, subject to appropriate contractual confidentiality, security and data-protection obligations.

f. Provide reasonable assistance to the business customer, taking into account the nature of the processing and the information available to TopCode, in responding to data subject requests and meeting applicable data-protection obligations.

g. Process, retain, disclose and otherwise handle personal information only as necessary to provide the services, comply with lawful instructions, meet legal obligations or as otherwise permitted by applicable law.

h. Upon termination of the relevant services, delete or return personal information processed on behalf of the business customer, as applicable and as reasonably requested by the business customer, subject to legal retention requirements and reasonable backup deletion cycles.

3.2 Business Customer Responsibilities

Business customers are responsible for ensuring that they have a lawful basis and, where required, the necessary consents or authorisations to collect, use and provide personal information through TopCode CHAT.

Business customers must ensure that their use of the Platform, including customer communications, campaigns and automated messages, complies with applicable data-protection, consumer-protection and electronic-communications laws.

Business customers remain responsible for fulfilling their obligations as responsible parties under POPIA, including responding to data subject requests and making notifications to the Information Regulator or affected data subjects where required by law. This does not exclude any independent legal obligations that may apply directly to TopCode.

3.3 Third-Party Service Providers and International Transfers

TopCode CHAT may rely on third-party service providers, including hosting providers, messaging platforms and artificial intelligence providers, to deliver and support the Platform.

Where these providers process personal information on behalf of TopCode’s business customers, TopCode will take reasonable steps to ensure that appropriate contractual confidentiality, security and data-protection safeguards are in place.

Personal information may be processed or stored outside South Africa. Where applicable, TopCode will take reasonable steps to ensure that any cross-border transfer complies with POPIA, including section 72, where relevant.

3.4 Deletion and Retention

When a business customer’s subscription or use of the relevant services ends, TopCode will handle personal information processed on that customer’s behalf in accordance with section 3.1(h), the applicable service agreement and applicable law.

Personal information may be retained where required by law or where necessary for legitimate operational, security, backup or dispute-resolution purposes, subject to applicable data-protection requirements.

3.5 Relationship with Other Agreements

This Privacy Policy describes TopCode’s general approach to processing and protecting personal information. The contractual obligations governing the provision of TopCode CHAT, including operator processing, are also addressed in the applicable Subscription Terms.

Where the parties enter into a separate Data Processing Agreement, that agreement will supplement the applicable Subscription Terms and govern the parties’ specific data-processing arrangements. In the event of a conflict concerning operator processing, the Data Processing Agreement will prevail to the extent of that conflict.

 4. Information We Collect

Depending on how you use the Platform, we may collect and process the following categories of information.

4.1 Account Information

This may include:

• Name and surname;

• Email address;

• Telephone number;

• Company name;

• Login and account identification details; and

• Account preferences.

4.2 Organisation Information

This may include:

• Business or organisation name;

• Business contact information;

• Company logo; and

• Account configuration and related business information.

4.3 Payment Information

Payments for Platform services may be processed through third-party payment providers.

In connection with payments, we may receive and process information such as:

• Transaction reference;

• Payment status;

• Amount;

• Currency;

• Date of payment; and

• Other transaction-related information.

We generally do not store complete payment card details that are processed directly by third-party payment providers. Such information is handled in accordance with the applicable payment provider’s privacy and security practices.

4.4 Account Security

We take reasonable and appropriate measures to protect login credentials and other authentication information against unauthorised access, disclosure or misuse. Authentication credentials are handled using appropriate security measures, where applicable.

5. Customer Conversation Information

Businesses using TopCode CHAT may connect their customer communication systems to the Platform.

As a result, the Platform may process information contained in customer conversations, templates, journeys, flows, campaigns and calls which may include:

• names;
• telephone numbers;
• email addresses;
• messages;
• enquiries;
• conversation history;
• Inbound and outbound calls;
• Call recordings and transcripts, where applicable;
• order or service information; and
• other information voluntarily provided during a conversation.

The business using TopCode CHAT is responsible for determining what information it submits to the Platform and for ensuring that it has an appropriate lawful basis for processing that information, including complying with applicable notification and consent requirements relating to call recordings and transcripts.

Special Personal Information

Business customers should not submit special personal information through the Platform, including health information, religious or philosophical beliefs, biometric information or other categories of special personal information recognised under the Protection of Personal Information Act 4 of 2013 (“POPIA”), unless they have identified and satisfied an applicable lawful basis and all relevant legal requirements for processing that information. Business customers are responsible for ensuring that any such processing is lawful and that appropriate safeguards are in place.

6. Knowledge Base Information

Businesses may provide information to TopCode CHAT for use by their AI agents.

This may include:

• documents;
• FAQs;
• product information;
• business policies;
• website content;
• instructions;
• internal business information; and
• other Customer Content.

We process this information to provide the AI functionality requested by the customer.

7. Usage and Technical Information

We may collect technical and usage information such as:

• IP address;
• browser type;
• operating system;
• device information;
• login timestamps;
• pages accessed;
• API usage;
• WhatsApp message credits;
• journeys;
• templates;
• flows;
• campaigns;
• AI message usage;
• error information;
• security logs; and
• other information necessary to operate and secure the Platform.

8. How We Use Personal Information

We may use personal information to:

• create and manage accounts;
• provide TopCode CHAT services;
• process payments;
• maintain AI agents;
• process knowledge bases;
• process conversations;
• provide human-handoff functionality;
• monitor AI message usage;
• maintain billing records;
• provide customer support;
• authenticate users;
• prevent fraud and abuse;
• detect security incidents;
• maintain and improve the Platform;
• communicate with customers;
• comply with legal and regulatory requirements; and
• enforce our agreements.

9. AI Processing

TopCode CHAT uses artificial intelligence (AI) technology to provide features such as automated responses, processing customer enquiries and generating content.

Information submitted to an AI agent, including customer messages and relevant Customer Content, may be processed by TopCode’s AI orchestration infrastructure and third-party AI technology providers to generate responses and provide the requested functionality.

Use of Customer Information for AI Training

TopCode does not use customer conversations or Customer Content processed through TopCode CHAT to train its own general-purpose AI models.

TopCode will verify the data-use terms and configurations of its third-party AI providers before making any commitment that customer conversations or Customer Content will not be used by those providers to train or improve their AI models. Any applicable provider use of customer information for model training will be disclosed to business customers before such processing takes place.

Use and Protection of Customer Information

TopCode processes customer information through AI systems only as reasonably necessary to provide, maintain, secure and support the Platform, in accordance with applicable contractual obligations and data-protection law.

TopCode will take reasonable steps to ensure that third-party AI providers processing personal information on its behalf are subject to appropriate contractual confidentiality, security and data-protection obligations.

AI Providers and Processing Locations

TopCode may change the third-party AI technology providers used to operate the Platform.

Business customers may request information about the AI providers used to process their information and the countries or regions in which such information is processed or stored. TopCode will provide the relevant information reasonably available to it, subject to applicable confidentiality and security requirements.

Limitations of AI-Generated Content

AI-generated responses may be inaccurate, incomplete or inappropriate in certain circumstances. Business customers remain responsible for configuring and monitoring their AI agents and for reviewing AI-generated content where appropriate to their use case and legal obligations.

10. Third-Party Service Providers

We may use third-party providers for services including:

• cloud hosting;
• artificial intelligence processing;
• payment processing;
• email delivery;
• analytics;
• monitoring;
• security;
• storage;
• communications, including the WhatsApp Business Platform provided by Meta Platforms, Inc. and/or its relevant affiliates (“Meta”); and
• other infrastructure required to operate the Platform.

These providers may process personal information on our behalf or receive personal information where necessary to provide their services. Where a business customer uses WhatsApp functionality through TopCode CHAT, relevant personal information may be transmitted to or processed by Meta to facilitate messaging and related functionality.

Meta may process personal information in accordance with its own applicable privacy policy and terms. TopCode does not control Meta’s independent processing activities.

We take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are applied where required by applicable data-protection laws, including POPIA.

11. Payment Processing

Payments for TopCode CHAT services may be processed by PayFast or another authorised payment provider.

Payment providers process payment information according to their own privacy policies and terms.

TopCode receives transaction information necessary to identify and reconcile payments and provide purchased services.

12. Cookies and Similar Technologies

The Platform may use cookies and similar technologies for purposes including:

• authentication;
• maintaining sessions;
• security;
• remembering preferences;
• analytics; and
• improving the user experience.

Where required, appropriate consent mechanisms will be provided.

13. Sharing Personal Information

We may disclose personal information to:

• service providers working on our behalf;
• payment providers;
• AI and technology providers;
• hosting providers;
• professional advisers;
• Meta Platforms, Inc. and /or its relevant affiliates (“Meta”), where necessary to provide Whatsapp functionality through the Whatsapp Business Platform;
• legal or regulatory authorities where required;
• law-enforcement authorities where legally required; and
• other parties where necessary to provide the Service or where authorised by law.

Where personal information is shared with Meta through the WhatsApp Business Platform, Meta may process that information in accordance with its own applicable privacy policy, terms and legal obligations. TopCode does not control Meta’s independent processing activities.

We do not sell customer personal information as a commercial product.

14. International Transfers

Some technology providers used by TopCode may store, access or process personal information outside South Africa. The countries or regions in which personal information is processed will depend on the services used and the technical configuration of the relevant providers.

Where personal information is transferred to a foreign country, TopCode will ensure that the transfer complies with section 72 of the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Where required, TopCode will ensure that the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection for personal information, substantially similar to the protection afforded under POPIA, including appropriate limitations on further transfers to third parties in foreign countries.

Where applicable, international transfers may also take place on another lawful basis permitted by section 72 of POPIA, provided that the requirements of the relevant provision are satisfied.

TopCode will take appropriate steps to ensure that applicable contractual and technical safeguards are in place to protect personal information transferred internationally.

15. Data Security

TopCode takes reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• misuse;
• alteration; and
• unauthorised disclosure.

  Security measures may include:
  

• encrypted communications;
• access controls;
• authentication;
• logging;
• monitoring;
• secure infrastructure; and
• appropriate credential management.

No internet-based system can be guaranteed to be completely secure.

16. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the Service, maintain appropriate business records, resolve disputes, enforce agreements, prevent fraud, or comply with legal and regulatory obligations.

Different categories of information may be retained for different periods, as set out below.

16.1 Customer Data

During an active subscription, customer data will be retained for as long as necessary to provide the Service and in accordance with the applicable customer agreement and lawful instructions.

Following termination or expiry of a subscription, the business customer may request an export or return of its customer data within 30 days. Unless retention is required by law or otherwise lawfully justified, we will delete or irreversibly anonymise customer data within 60 days after termination or expiry.

16.2 Backup Data

Customer data held in routine backup systems will be deleted or overwritten through the applicable backup cycle, ordinarily within 90 days after termination or expiry. Backup data retained during this period will remain protected and will not be used for ordinary business purposes.

16.3 Financial and Transaction Records

Invoices, payment confirmations, transaction references and other financial or accounting records will be retained for the period required by applicable law. Where South African tax legislation requires retention, relevant records will generally be retained for at least five years, or longer where legally required or necessary for an audit, investigation or legal proceeding.

16.4 Account, Security and Support Records

Account information, security logs, technical records and support communications may be retained for as long as reasonably necessary for account administration, security, troubleshooting, fraud prevention, dispute resolution and compliance with legal obligations.

16.5 Information Retained for Legal Reasons

Where we are legally required or otherwise lawfully entitled to retain personal information beyond the periods described above, we will restrict its processing to the relevant lawful purpose and continue to protect it in accordance with applicable data-protection requirements.

16.6 Secure Deletion

When personal information is no longer required and no lawful basis for retention remains, we will take appropriate steps to securely delete or irreversibly anonymise it.

Where we process personal information on behalf of a business customer, its return or deletion following termination will also be governed by the applicable customer agreement and lawful instructions.

17. Customer Responsibilities

Businesses using TopCode CHAT are responsible for:

• ensuring they have a lawful basis for providing personal information to TopCode;
• providing appropriate notices to their own customers where required;
• ensuring Customer Content is accurate and lawful;
• configuring their AI agents appropriately; and
• complying with applicable privacy and data-protection requirements.

Where TopCode processes personal information on behalf of a business customer, the respective roles and responsibilities of the parties may be further governed by the applicable agreement between TopCode and that customer.

18. Your Privacy Rights

Subject to applicable law, individuals may have rights relating to their personal information, including rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion where legally applicable;
• object to certain processing;
• request restriction of processing in certain circumstances; and
• exercise other rights provided by applicable data-protection law.

Requests Relating to End Customer Information

If you are an End Customer whose personal information is processed through TopCode CHAT, you should direct requests to access, correct or delete your personal information to the business that communicated with you or collected your information through the Platform.

That business is generally responsible for responding to such requests as the responsible party under the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Where TopCode processes personal information on behalf of a business customer, TopCode will provide reasonable assistance to that customer, where required and appropriate, to help it respond to requests in accordance with applicable law and the relevant customer agreement.

If TopCode receives a request directly from an End Customer relating to information processed on behalf of a business customer, TopCode may refer the request to the relevant business customer and assist with its handling, where appropriate and legally permitted.

If your request relates to personal information that TopCode processes for its own purposes, you may contact TopCode directly using the contact details provided below.

All requests are subject to applicable legal requirements, including any lawful grounds for refusing or limiting a request.

Information Regulator (South Africa)

Website: https://inforegulator.org.za/

Complaints: https://inforegulator.org.za/complaints/

Email: POPIAComplaints@inforegulator.org.za

You may consult the Information Regulator’s website for the applicable complaint procedure and the latest contact details.

19. Marketing Communications

Where permitted by law, TopCode may communicate with customers regarding:

• account activity;
• service updates;
• billing;
• security;
• important operational notices; and
• new products or services.

Marketing communications will be handled in accordance with applicable law and applicable consent requirements.

20. Data Breaches

If TopCode becomes aware of a security incident involving personal information, we will take reasonable steps to:

• investigate the incident;
• contain and remediate the incident;
• assess potential risks to affected individuals and organisations;
• implement measures to prevent or reduce further harm; and 
• comply with applicable legal and contractual notification requirements.

  
  Where TopCode acts as an operator processing personal information on behalf of a business customer, TopCode will notify the relevant business customer immediately after becoming aware of reasonable grounds to believe that personal information processed on the customer’s behalf has been accessed or acquired by an unauthorised person.

  TopCode will provide the business customer with relevant information reasonably available to it about the incident and reasonable assistance to support the investigation, mitigation of harm and fulfilment of applicable legal obligations.

  The business customer, as the responsible party where applicable, is responsible for notifying the Information Regulator and affected individuals where required by law, subject to any independent legal obligations that apply directly to TopCode.

  Where TopCode acts as a responsible party, TopCode will notify the Information Regulator and affected individuals of a security compromise where required by applicable law.

  Nothing in this section limits either party’s obligations under the Protection of Personal Information Act, 2013 (POPIA), or other applicable law.

21. Children’s Information

TopCode CHAT is intended primarily for businesses and their authorised users.

The Platform is not specifically directed at children.

Customers must not intentionally use TopCode CHAT to collect personal information from children in violation of applicable law.

22. Third-Party Websites

The Platform may contain links or integrations to third-party websites and services.

TopCode is not responsible for the privacy practices of third-party websites.

Users should review the privacy policies of those third parties before providing personal information.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

The updated version will be published on the TopCode CHAT website with a revised “Last Updated” date.

Where required by law, we will provide additional notice of material changes.

24. Contact Us

For privacy-related questions, requests concerning personal information, or complaints about how personal information is processed, please contact:

Registered company name: TopCode (PTY) LTD

Trading name: TopCode

Company registration number: 2018/205409/07

Registered or physical business address: 30 Beaver Street, Midstream Meadows, Centurion, South Africa, 1692

Information Officer: Ndivhuwo Nthambeleni

Telephone: +27 73 819 6476

General privacy enquiries: info@topcode.co.za

The Information Officer is responsible for overseeing the organisation’s compliance with applicable data-protection legislation and handling privacy-related enquiries, requests and complaints.

If you are dissatisfied with how your personal information has been handled, you may also lodge a complaint with the Information Regulator (South Africa):

Website: https://inforegulator.org.za/

Complaints: https://inforegulator.org.za/complaints/