1. Lawful Processing
Vynta processes personal information only where we have a lawful basis: performance of a contract with you, your consent, our legitimate interests (balanced against your rights), legal obligation, or the protection of a legitimate interest of the data subject.
2. Consent
Where consent is required, we obtain it in a clear, specific and informed manner. Consent can be withdrawn at any time by contacting our Information Officer.
3. Consent for Voice Dictation & AI Features
Voice dictation and AI assistance are optional and switched on by choice. Each user opts in before dictation is available to them, a visible indicator shows when recording is active, and consent can be withdrawn at any time from the user's profile. Account holders may disable AI features for an entire workspace or for individual roles.
Dictation audio is processed for one purpose only: producing a transcript for the record the user is working on. Audio is discarded once transcription completes, transcripts remain inside the workspace under row-level security, and neither audio nor transcripts are used to train third-party AI models. Transcription may take place outside South Africa under operator agreements and standard contractual clauses, consistent with Condition 8 of POPIA.
Workspaces act as responsible party for what their users dictate and should limit recordings to information required for the work being performed.
4. Information Officer
Information Officer: Michael Dyer, Vynta (Pty) Ltd
Email: info@vyntaintegrate.com
Postal: Vynta (Pty) Ltd, Cape Town, South Africa.
The Information Officer is registered with the Information Regulator of South Africa.
4A. Website and product analytics
Analytics are optional and off until accepted. We use Google Analytics 4 and PostHog (European Union hosting) for aggregate measurement only, with IP anonymisation, no advertising signals, no session recording and no person profiles. The full cookie list is in our Cookie Policy. In the mobile apps there is no cookie banner; analytics stay off until switched on under Settings → Profile → Privacy.
5. Data Subject Rights Under POPIA
- To be notified that personal information is being collected.
- To access your personal information held by Vynta.
- To request correction or deletion of personal information.
- To object to the processing of personal information.
- To object to direct marketing.
- To complain to the Information Regulator.
6. Direct Marketing (Section 69)
Vynta only sends electronic direct marketing to data subjects who have given prior opt-in consent, or to existing customers in relation to similar products and services. Every marketing communication includes a clear opt-out mechanism.
7. Security Safeguards
We implement appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, unlawful access or unlawful processing of personal information, including encryption, access controls, monitoring and staff training.
8. Breach Notification
If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Vynta will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with Section 22 of POPIA.
9. Operator Agreements
All third parties that process personal information on Vynta's behalf are bound by written agreements requiring them to comply with POPIA and to maintain the confidentiality and security of personal information. Each one is named in our subprocessor list, and the terms that apply when Vynta acts as operator for a customer are set out in our Data Processing Addendum.
10. Retention & Disposal
Personal information is retained only as long as necessary for the purpose for which it was collected, or as required by law. After this period, information is securely deleted or de-identified.
11. Complaints
Complaints regarding the processing of personal information may be lodged with our Information Officer or directly with the Information Regulator (South Africa) at inforegulator.org.za (complaints: complaints.IR@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg).