Privacy notice

1. Who handles your information

VasKem (Pty) Ltd, registration 2026/371208/07, determines the use of account, enquiry, billing, security and website-administration information for its own business purposes. For customer operational records, the customer generally determines the purposes and VasKem processes on documented instructions. These roles depend on the actual activity, not its label.

Contact us on WhatsApp at +27 81 438 8821 (preferred), or email hello@vaskem.com for routing of privacy enquiries. Email is checked less often than WhatsApp. Start with a brief description, not identity documents or private customer records; we will arrange an appropriate channel where needed. The responsible party's required contact disclosures, business/service address and Information Officer details are outstanding in this review draft.

2. Information and reasons

Account and enquiry information includes names, work contact details, company information and correspondence supplied by you or your organisation. We use it to assess requests, provide access, respond to support, administer the relationship and meet applicable obligations. Required registration fields are identified in the form; without them we cannot create the requested account.

Customer-entered information can include products, orders, invoices, contacts, documents, activities and logistics records. Security and audit records record relevant account activity. We rely on an appropriate lawful basis for each activity, such as an agreement, legal duty, justified legitimate interests or consent where required; accepting terms is not blanket consent to every use.

3. AI assistance and external processing

When an authorised company uses Ask VasKem, a specialist third-party AI processing service receives the question, relevant chat context, company background and permitted records or approved knowledge needed to prepare an answer. Processing can occur outside South Africa, including the United States. Public examples are fictional and do not send questions to an AI service.

Credential fields are excluded from business lookups, but text entered by users can still contain sensitive information. Do not submit secrets or data you are not authorised to share. Customer onboarding and the signed-in AI processing notice identify the provider and explain retention and transfer details. AI is not enabled for a company merely by visiting this website.

4. Sharing and transfers

Recipient categories include authorised customer users, restricted VasKem support/operations personnel, hosting and infrastructure services, communications providers, and the AI processor where that feature is used. Information may also be disclosed where law requires or in a safeguarded business transfer. We do not sell customer records.

Before a transfer or subprocessor engagement, the parties must establish the applicable protection, purpose, contractual safeguards and lawful transfer basis. The operator/subprocessor register and signed processing schedule must be completed and reviewed for the actual deployment; this notice does not claim that an unsigned arrangement is already in force.

5. Retention and security

Access controls, HTTPS, password hashing, tenant-scoped queries and encrypted AI chat fields are part of the application. These controls are not a guarantee against every incident and are not a claim of ISO certification, universal encryption at rest or a particular availability level.

AI chat content expires after the configured retention period, 30 days by default, with scheduled cleanup normally within six hours when the service is running. Users can delete their chats. Approved company knowledge is separate. Operational records, billing evidence, logs, exports and backups have different purposes and retention requirements; the final retention schedule and backup rotation remain to be approved. We retain information only where a justified purpose or obligation remains, with restricted access.

6. Website choices and your rights

Optional visitor analytics runs only after an affirmative choice. Referrer query strings and raw IP addresses are not included in new analytics records. Essential authentication and request-protection cookies support the service; cookie choices can be changed on the Cookies page. Existing server security logs and older records are distinct from optional analytics.

You may request access, correction or deletion where applicable, object to relevant processing, withdraw consent for future consent-based processing, and complain to the Information Regulator. We verify identity proportionately and explain any lawful refusal or retention requirement. If your information belongs to a customer workspace, contact that organisation first or ask us to route the request. A normal data export is a product facility, not a claim of a universal statutory portability right.

Marketing permission is separate from service messages. Contact us to stop optional marketing. We do not direct the service to children; report unintended collection for review.

7. Complaints and updates

The Information Regulator's official website provides current POPIA complaint forms and contact details. You do not need our permission to complain. Material changes to processing require appropriate notice and, where required, a new choice or agreement. The review date shown here is fixed to this version.