Vital Pursuit Website: POPIA Notice (South Africa)

• Last updated: 17 September 2026

Read together with the Privacy Policy.

This notice explains how personal information collected through https://vitalpursuit.co.za is processed under South Africa's Protection of Personal Information Act, 2013 (POPIA). It is the notification required by section 18 of POPIA. Our apps have their own POPIA notices.

1. Responsible party & Information Officer

• Responsible party: Bioscience and Technology Holdings (Pty) Ltd, trading as Vital Pursuit, Reg. no. 2016/366514/07, 32 Ryneveld Street, Stellenbosch, 7600
• Contact: info@vitalpursuit.co.za · +27 76 861 9520
• Information Officer: Jan H. Esser, info-officer@vitalpursuit.co.za (full particulars in our PAIA Manual) (Registered with the Information Regulator, https://inforegulator.org.za)

2. What we process, and why

The website processes personal information in three ways only:

1. Enquiries you send us. Through the contact form or the follow-up form, you send your name and email address (required); your phone number and organisation (optional); your message; and, on the follow-up form, the challenge you typed in the Strategy Preview and its AI response. These details reach our business mailbox by email and become our enquiry and client records. We use them to reply, to discuss and prepare an engagement, and to serve you if you become a client. Supplying them is voluntary, but we cannot respond to you without a name and an email address.
2. Strategy Preview (AI tool). The text you type is passed through our web server to our AI provider (OpenAI) to generate a response, and the response is returned to your browser. The tool collects no name or contact details and accepts no uploads, and we do not store the text or the response. The text may still contain personal information if you include it, so we ask you not to. To prevent abuse, our server records the times of recent requests against a one-way code derived from your IP address and browser identifier. We treat this code as personal information, even though it cannot be turned back into an IP address.
3. Technical and security processing. When you visit, our hosting provider's web server logs your IP address, browser identifier and the pages requested. Google Fonts and Google reCAPTCHA load on the website and receive your IP address and browser information. reCAPTCHA also assesses browser and interaction signals to detect automated abuse. We use these only to deliver, secure and protect the website.

We use no analytics, advertising or tracking tools, and we set no cookies of our own.

3. Lawful basis

• Enquiries: your consent, given by sending the form for this purpose (section 11(1)(a)), and processing necessary to take steps you request before a contract and, if you become a client, to perform that contract (section 11(1)(b)).
• Strategy Preview: processing necessary to provide the response you request (section 11(1)(b)).
• Technical logs, reCAPTCHA and rate limiting: our legitimate interest in a secure website that is protected from spam and abuse (section 11(1)(f)).

You may withdraw consent at any time. Withdrawal does not affect processing that has already taken place, or client records we must keep by law.

4. Recipients (operators)

• Google Workspace: our business email and document storage, where enquiries and client records are held (Europe).
• OpenAI (United States): generates Strategy Preview responses; retains the text and the response for up to 30 days and does not train on them.
• Google (Fonts and reCAPTCHA): delivers the website's fonts and protects the forms from abuse.
• Our hosting provider: hosts the website, its server logs and the rate-limit records on a managed server in Cape Town, South Africa.
• Professional advisers and authorities: only where needed for our business or required by law.

We do not sell personal information or share it for advertising.

5. Cross-border transfer (Section 72)

• OpenAI, United States: only the Strategy Preview text. The transfer is necessary to provide the response you ask for (section 72(1)(c)). OpenAI is bound by its API terms with us to protect the data, not to use it to train its models, and to delete it within up to 30 days (section 72(1)(a)).
• Google Workspace, Europe: enquiries and client records. The recipient is subject to the EU General Data Protection Regulation, which gives protection comparable to POPIA (section 72(1)(a)), and to Google's data processing terms with us.
• Google Fonts and reCAPTCHA: your IP address and browser information, processed on Google's global infrastructure, including the United States, under Google's terms, to deliver and protect the website.

6. Retention

• Enquiries: kept as part of our business records for as long as they remain reasonably necessary, for example to follow up, to keep the history of a business relationship, or to establish or defend legal claims (POPIA section 14). You can ask us to delete them at any time.
• Client records: kept for the relationship, and afterwards as the law requires or allows, including at least five years for accounting and tax records and as needed to establish or defend legal claims (POPIA section 14).
• Strategy Preview: not kept by us; OpenAI deletes the text and the response within up to 30 days.
• Web server logs: kept for a limited period under the hosting provider's standard log rotation, then deleted.
• Rate-limit records: deleted automatically after 3 years at most.

7. Security

• The website uses encrypted HTTPS connections.
• Forms and the AI tool are protected by reCAPTCHA and rate limiting.
• API keys and server settings are held outside the public web folder.
• Enquiries are held in Google Workspace, which encrypts data at rest and in transit and requires account authentication.

8. Your rights as a data subject

Under POPIA you may:

• Access the personal information we hold about you;
• Correct or delete it;
• Object to processing and withdraw consent;
• ask us not to contact you again;
• Complain to the Information Regulator.

To exercise these, contact the Information Officer above. A formal request for access to records may be made using the prescribed PAIA Form 2 (Request for Access to Record), https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf, submitted to the Information Officer as described in our PAIA Manual.

9. Information Regulator

Information Regulator (South Africa). JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. POPIA complaints: POPIAComplaints@inforegulator.org.za · https://inforegulator.org.za