Privacy and Personal Information Policy

1. About this Policy

This Privacy and Personal Information Policy explains how Cerebral Circuit (Pty) Ltd, registration number 2023/119759/07, trading through the AnyCart product (“Cerebral Circuit”, “AnyCart”, “we”, “us” or “our”), collects, uses, stores, shares and protects personal information.

This Policy applies when you:

visit www.anycart.me;
submit a contact, enquiry or demo form;
create or use a public AnyCart demo;
interact with webchat or another public AnyCart feature;
provide feedback or ratings;
sign up to receive communications from us; or
otherwise communicate directly with Cerebral Circuit about AnyCart.

For this processing, Cerebral Circuit will generally act as the Responsible Party under the Protection of Personal Information Act, 4 of 2013 (“POPIA”).

Merchant-controlled AnyCart deployments

This Policy does not replace the privacy notice of a merchant that uses AnyCart.

If you interact with AnyCart through a merchant's website, store, WhatsApp account or another merchant-controlled environment, that merchant will generally determine why shopper information is processed and may act as the Responsible Party.

Cerebral Circuit may process that information on the merchant's behalf as an Operator under its agreement with the merchant.

If you are a shopper using a merchant-controlled AnyCart deployment, you should also read that merchant's privacy notice.

2. Personal information we collect

The information we collect depends on how you interact with AnyCart.

Contact and business information

If you contact us, request a demo or enquire about AnyCart, we may collect information such as:

your name;
email address;
telephone number;
company or organisation;
job title or role;
website or store address;
e-commerce platform;
areas of interest;
information about your business or proposed use of AnyCart; and
the content of your enquiry or other information you choose to provide.

Demo and conversation information

If you use a public AnyCart demo, webchat or similar interactive feature, we may collect:

messages you send;
AnyCart-generated responses;
products, preferences, questions or scenarios mentioned in the conversation;
demo cart or checkout interactions;
session identifiers;
timestamps;
conversation logs;
relevant technical metadata; and
feedback or ratings you provide.

Public demo conversations may be reviewed for testing, evaluation, security and improvement of AnyCart.

You should not submit payment-card information, passwords, API keys, access tokens, identity documents or unnecessary sensitive or confidential information through a public demo.

Technical and usage information

When you use the Website, we may automatically receive technical or usage information such as:

IP address;
browser and device information;
operating system;
referring website;
pages or features used;
session information;
cookie or similar identifiers;
error and performance information; and
general Website usage information.

Communication preferences

If you subscribe to, receive or interact with communications from us, we may record your communication preferences, subscription or opt-out status and relevant engagement information.

Is providing information compulsory?

Providing personal information through the Website is generally voluntary.

However, some information may be necessary for us to provide a particular feature, create a demo, respond to an enquiry or communicate with you.

If you do not provide information that is reasonably required for that purpose, we may not be able to provide the relevant functionality or respond to your request.

3. How we collect and use personal information

We may collect information:

directly from you;
automatically when you use the Website or a demo;
through your interaction with AnyCart;
from service providers that help us operate the Website or communicate with you; or
from publicly available or business information where lawful and relevant to an enquiry or business relationship.

We process personal information only where we have a lawful reason to do so.

Depending on the circumstances, this may include your consent, steps taken at your request before entering into an agreement, performance of an agreement, compliance with a legal obligation, or our legitimate interests or those of a third party where permitted by POPIA.

We may use personal information to:

operate, maintain and secure the Website and public demos;
provide AnyCart-generated responses and demo functionality;
respond to enquiries and demo requests;
communicate with prospective merchants and other users;
understand how the Website and demos are being used;
test, evaluate and improve AnyCart;
investigate faults, abuse, fraud or security incidents;
maintain records reasonably required for our business;
protect our legal rights;
comply with legal, regulatory, accounting, tax or audit obligations; and
send marketing communications where permitted by law.

Where reasonably possible, we may use aggregated or de-identified information for analytics, product improvement and internal reporting.

4. How AnyCart processes conversations and information

AnyCart uses automated systems and third-party language-model, inference, hosting and infrastructure providers to understand requests, retrieve relevant information and generate responses.

When you interact with a public AnyCart demo or webchat, information necessary to provide that interaction may therefore be transmitted to service providers involved in operating the service.

This may include:

the message you submit;
relevant conversation context;
product or demonstration information;
system instructions;
tool or retrieval results; and
other information reasonably necessary to generate and deliver the response.

We aim to limit the personal information shared with these providers to what is reasonably necessary for the relevant purpose.

Public demo conversations may also be used by Cerebral Circuit to test, evaluate, secure and improve AnyCart.

You should treat public demos as evaluation environments and avoid providing information that is sensitive, confidential or unnecessary.

We do not sell personal information.

We may share personal information where reasonably necessary with service providers and other parties that help us operate AnyCart and Cerebral Circuit.

These may include providers of:

Website and cloud hosting;
data storage;
language models and inference infrastructure;
analytics and logging;
email and communication services;
CRM and business administration tools;
security and monitoring services; and
technical support or infrastructure.

We may also disclose personal information:

to professional advisers such as lawyers, accountants or auditors;
where reasonably necessary to protect our rights, systems or users;
as part of a lawful corporate transaction or restructuring; or
where disclosure is required or permitted by law, a regulator, court or other competent authority.

Where a third party processes personal information on our behalf, we take reasonable steps to use providers with appropriate privacy, confidentiality and security commitments.

We do not provide personal information to third parties for their own unrelated direct-marketing purposes without an appropriate lawful basis.

6. Cookies and analytics

The Website may use cookies, analytics technologies and similar tools to operate the Website, understand usage, remember preferences, diagnose technical problems and measure Website performance.

Depending on the technologies in use, these tools may collect information such as browser or device information, page views, referring sources, session information and interactions with Website features.

You can usually control cookies through your browser or device settings. Disabling some cookies or similar technologies may affect how parts of the Website function.

Where consent is required for a particular cookie or tracking technology, we will request that consent through an appropriate notice or consent mechanism.

7. International processing, security and retention

International processing

Some of the providers used to operate AnyCart may process or store personal information outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer is permitted under POPIA, including through appropriate legal, contractual or other safeguards where required.

Security

We use reasonable and appropriate technical and organisational measures designed to protect personal information against loss, unauthorised access, misuse, alteration, disclosure or unlawful processing.

These measures may include access controls, secure credential management, encryption where appropriate, logging, monitoring, secure hosting and confidentiality obligations.

No internet-based system can be guaranteed to be completely secure.

Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or subsequently lawfully processed, or for as long as required or permitted by law.

Retention periods may differ depending on the nature and purpose of the information.

We may retain information where reasonably necessary for purposes such as:

responding to enquiries and maintaining business records;
security and fraud prevention;
resolving disputes or enforcing agreements;
legal, tax, accounting or regulatory requirements; or
maintaining records of communication preferences and opt-outs.

When personal information is no longer required and there is no lawful reason to continue retaining it, we will delete, destroy or de-identify it as appropriate.

Information that has been properly anonymised so that it no longer identifies a person may be retained and used for analytics, research, reporting or product improvement.

8. Your rights

Subject to POPIA and other applicable law, you may have the right to:

ask whether we hold personal information about you;
request access to personal information we hold about you;
request correction of personal information that is inaccurate, incomplete or out of date;
request deletion or destruction of personal information where applicable;
object to certain processing of your personal information;
withdraw consent where processing is based on your consent;
object to direct marketing; and
lodge a complaint with the Information Regulator of South Africa.

To exercise your rights, contact us at hello@anycart.me.

We may need to take reasonable steps to verify your identity before giving access to, correcting or deleting personal information.

If your request relates to information processed through a merchant-controlled AnyCart deployment, the merchant may be the Responsible Party for that information. We may therefore refer the request to the relevant merchant or assist the merchant in responding to it.

9. Marketing communications

We may send communications about AnyCart or Cerebral Circuit where permitted by applicable law.

Where consent is required for electronic direct marketing, we will obtain the required consent before sending that marketing.

Where applicable law permits communications to an existing customer without obtaining fresh consent, we will only do so subject to the applicable requirements.

You may object to or opt out of marketing communications at any time by using the unsubscribe mechanism provided or by contacting us.

If you opt out of marketing, we may still send communications that are reasonably necessary for an existing enquiry, service, transaction, security matter, legal obligation or business relationship.

10. Children, special personal information, changes and contact details

Children and special personal information

The public AnyCart Website and demos are not designed to intentionally collect personal information from children or special personal information.

Please do not intentionally submit children's personal information or information concerning health, biometrics, race or ethnic origin, religious or philosophical beliefs, political persuasion, trade-union membership, sex life, criminal behaviour or other special personal information through public demos unless there is a lawful and necessary reason to do so and an appropriate mechanism has specifically been provided.

If we become aware that such information has been submitted unnecessarily, we may delete or restrict our use of it.

Changes to this Policy

We may update this Policy from time to time to reflect changes to AnyCart, our processing activities, service providers, legal requirements or privacy practices.

The current version and its effective date will be published on the Website.

Where a change materially affects processing for which a new consent or other action is legally required, we will take the appropriate steps rather than treating continued use of the Website as consent.

Cerebral Circuit contact details

Cerebral Circuit (Pty) Ltd

Trading/product name: AnyCart

Registration number: 2023/119759/07

Information Officer: Timothy Shier

Website: www.anycart.me

Email: hello@anycart.me

Telephone: +27 68 720 5860

Physical address: HBD, 65 Langeberg, Langkloof, Riversdale, Western Cape, 6670, South Africa

Postal address: PO Box 13, Private Bag X423, Riversdale, 6670, South Africa

Information Regulator

If you believe that your personal information has been processed unlawfully, you have the right to lodge a complaint with the Information Regulator of South Africa.

Current general contact details:

Telephone: 010 023 5200

Toll-free: 0800 017 160

General enquiries: enquiries@inforegulator.org.za

POPIA complaints: POPIAComplaints@inforegulator.org.za

Complaints may also be submitted through the Information Regulator's eServices system.