This Privacy Policy is published by Sifat Trading (Pty) Ltd, a company registered in the Republic of South Africa under the Companies Act 71 of 2008, which operates the Zaxara brand and trading name ("Zaxara", "we", "us", or "our").

Zaxara provides WhatsApp AI automation services to estate agents and private clinics in South Africa, including the design, installation, and ongoing operation of automated lead capture and communication systems.

For all client-facing purposes — including service delivery, proposals, service agreements, and marketing — we operate as Zaxara. The legal contracting entity is Sifat Trading (Pty) Ltd, trading as Zaxara. All invoices, legal agreements, and formal correspondence are issued by Sifat Trading (Pty) Ltd t/a Zaxara.

Zaxara is the Responsible Party for personal information collected directly through its website (zaxara.co.za), onboarding process, and communications. Where Zaxara processes personal information on behalf of clients — such as property buyer enquiry data flowing through client WhatsApp systems — Zaxara acts as an Operator under POPIA and processes that data under the client's authority and instructions.

2.1 Information you provide directly to us

2.2 Information collected automatically when you visit our website

2.3 Lead data processed in our Operator role

Where Zaxara operates a WhatsApp automation system on behalf of a client, we process the following data about the client's leads — solely as Operator, not as Responsible Party:

• Name and phone number of the person making the property enquiry
• Responses to qualification questions (budget, area, purchase intent)
• Date and time of the enquiry
• Content of WhatsApp conversation messages

This data is stored in the client's own Google Sheet and is used only to deliver the contracted service. It is never used by Zaxara for any secondary purpose.

We collect and process personal information only for the specific, explicitly defined, and lawful purposes listed below, in accordance with section 13 of POPIA:

We use the personal information we collect to:

• Respond to your website enquiries, WhatsApp messages, and emails within one Business Day;
• Configure, build, test, and launch your WhatsApp Lead Capture System according to your onboarding form specifications;
• Connect your WhatsApp Business number to the Meta WhatsApp Business API on your behalf;
• Share your Google Sheet lead log with your nominated Google account;
• Send you Qualified Lead notifications to your nominated WhatsApp number in real time;
• Generate and deliver your monthly performance report to your nominated email address;
• Issue invoices and manage payment records;
• Communicate with you about your service, including updates, maintenance, and support;
• Maintain records for legal, accounting, and regulatory compliance;
• Analyse anonymised website traffic data to improve our website and services.

We do not sell, rent, or transfer your personal information to third parties for commercial purposes. We do not use your information for profiling or automated decision-making that has significant legal effects on you.

5.1 What are cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. Under POPIA, non-essential cookies require your explicit consent before being placed on your device.

5.2 Types of cookies we use

5.3 Cookie consent

When you first visit zaxara.co.za, a cookie consent banner will appear. You may accept all cookies, reject non-essential cookies, or manage your preferences. Your choice is remembered for 12 months, after which we will ask for your consent again. You can change your cookie preferences at any time by clicking "Cookie Settings" in the footer of our website.

5.4 Google Analytics

We use Google Analytics (provided by Google LLC) to understand how visitors use our website. IP addresses are anonymised before being sent to Google. You can opt out at any time by rejecting analytics cookies in our consent banner, or by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

Zaxara uses the following third-party platforms to deliver its services. Each processes certain personal information as part of service delivery:

We enter into appropriate data processing agreements with our third-party service providers to ensure they handle personal information with appropriate data protection measures.

Zaxara shares personal information only in the following limited circumstances:

• With service providers as Operators: We share necessary information with the platforms listed in Section 6, solely to enable service delivery. These providers are bound to use your information only for specified purposes.
• When required by law: We may disclose personal information if required by South African law, court order, or a lawful request from a government authority or the Information Regulator.
• To protect our rights: Where necessary to protect the rights, property, or safety of Zaxara, our clients, or others, in accordance with applicable law.
• Business transfer: If Sifat Trading (Pty) Ltd t/a Zaxara is acquired or merged, your personal information may be transferred. We will notify you before this occurs.

We do not sell, rent, or trade your personal information to any third party for commercial purposes.

Some third-party services we use — including Meta Platforms and Google LLC — are based outside South Africa, primarily in the United States. When we share personal information with these providers, your information may be transferred to and stored in countries outside South Africa. In accordance with section 72 of POPIA, we only transfer personal information to recipients that provide an adequate level of protection or that have agreed to appropriate contractual safeguards.

Zaxara implements appropriate technical and organisational measures to protect your personal information, in accordance with section 19 of POPIA. Our security measures include:

• TLS encryption: All information transmitted between our website and users is encrypted via HTTPS;
• Access controls: Access to personal information is restricted to authorised personnel on a need-to-know basis, protected by strong passwords and two-factor authentication where available;
• Cloud security: Data is stored on reputable cloud platforms (Google, Meta) with ISO 27001 and SOC 2 certifications;
• No unnecessary local storage: Lead data is stored in the client's own Google Sheet and not retained on Zaxara's servers beyond operational necessity;
• Subcontractor obligations: All subcontractors and service providers are required to maintain appropriate security measures.

As a data subject under the Protection of Personal Information Act 4 of 2013, you have the following rights:

To exercise any of these rights, contact our Information Officer at privacy@zaxara.co.za. We will verify your identity and respond within 30 calendar days.

Zaxara's services are intended exclusively for business clients and are not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected such information, we will delete it immediately in accordance with sections 34 and 35 of POPIA. Please contact our Information Officer immediately if you believe a child's information has been collected.

Zaxara may send you marketing communications only where: (a) you have given explicit consent; or (b) you are an existing client and we are communicating about similar services, in accordance with section 69(3)(b) of POPIA. Every marketing communication includes an easy opt-out mechanism. Reply STOP to any WhatsApp marketing message or click the unsubscribe link in any marketing email. We will process your opt-out within five (5) Business Days.

In the event of a data breach involving your personal information, Zaxara will: submit a notification to the Information Regulator through the eServices portal at inforegulator.org.za as soon as reasonably possible; notify all affected data subjects as soon as reasonably possible after the breach is confirmed; and include in our notification a description of the possible consequences, measures taken, and our Information Officer contact details — in full compliance with section 22 of POPIA.

We may update this Privacy Policy to reflect changes in our practices or South African legal requirements. The most current version is always available at zaxara.co.za/privacy-policy. For material changes, we will notify you by email at least 30 days before the change takes effect. The "Last updated" date at the top of this policy reflects the most recent revision.

Under section 55 of POPIA, we have appointed an Information Officer responsible for ensuring our POPIA compliance and handling all data subject requests and complaints.