Legal
Privacy policy
Last updated: 14/10/2026
This policy explains how XContent collects, uses, shares and protects personal information through xcontent.ai, and the rights you have under POPIA and the GDPR.
1. Who we are
XContent Digital Solutions (Pty) Ltd (registration number 2017/164224/07), trading as XContent, operates this website at xcontent.ai. For the personal information collected through this website, we are the responsible party under the Protection of Personal Information Act, 2013 (POPIA) and the controller under the EU General Data Protection Regulation (GDPR).
Address: 20 Charles de Gaulle Crescent, Building 1, Equity Estate, Highveld, Centurion, 0157. Information Officer: Andrew Janse Van Vuuren, [email protected], +27 11 014 1778.
2. Personal information we collect
Information you give us
When you complete a form on this website, we collect:
- your name, business email address, organisation, role and, if you provide it, phone number
- the product or service you are interested in, and for Ekard enquiries the number of users
- anything you write in the message field
Information collected automatically
- technical information such as IP address, browser type and device, recorded in security and server logs
- if you accept analytics cookies, how you use the website: pages visited, time spent, links followed and the site that referred you
- your cookie choice, so we do not ask again
We do not ask for special personal information, such as health, religious or biometric information, and we ask you not to include it in a message.
3. Why we use it and our lawful basis
| Purpose | Lawful basis (POPIA and GDPR) |
|---|---|
| Responding to your enquiry, demo, workshop or quote request | Steps at your request before entering into a contract; our legitimate interest in responding to business enquiries |
| Recording your enquiry in our sales system and following it up | Legitimate interest |
| Website analytics | Your consent, given through the cookie banner |
| Keeping the website secure and preventing spam and abuse | Legitimate interest |
| Meeting legal and regulatory obligations | Legal obligation |
We do not send you direct marketing unless you have opted in, as required by section 69 of POPIA. Every marketing message lets you opt out.
4. Who we share it with
We share personal information only with operators that process it on our instructions under a written agreement, and only as far as each one needs it:
- Microsoft: website hosting and form processing on Microsoft Azure in the South Africa North region, and Microsoft 365 for the emails we send you
- ConnectWise: our sales and service system, where your enquiry is recorded and assigned to a member of our team
- Google: Google Analytics, for website analytics, only if you accept analytics cookies
- Microsoft Clarity: website analytics, including how pages are used, only if you accept analytics cookies
We may also disclose personal information where the law requires it, to protect our rights, or as part of a sale or restructuring of our business, subject to the same protections. We do not sell personal information.
5. Transfers outside South Africa
Our ConnectWise instance is hosted in the European Union. When you submit a form, your details are sent there. We rely on section 72 of POPIA: the recipient is subject to the GDPR, which provides protection substantially similar to POPIA, and our agreement with ConnectWise binds it to protect the information.
Your form submission is processed and held temporarily in South Africa before it is sent to ConnectWise. Some Microsoft cloud services, including Microsoft 365, may process data outside South Africa. If you accept analytics cookies, Google Analytics and Microsoft Clarity process analytics data outside South Africa, mainly in the United States. For these transfers we also rely on section 72 of POPIA: each provider is bound by written data processing terms that give protection substantially similar to POPIA.
6. How long we keep it
| Information | Retention |
|---|---|
| Form submissions held for delivery to our sales system | Deleted within 30 days of successful delivery |
| Enquiries and contact records in our sales system | For as long as needed to manage the business relationship, then under our records retention policy |
| Security and delivery logs (no form content) | 12 months |
| Analytics data | Google Analytics: up to 14 months. Microsoft Clarity: up to 13 months. |
| Your cookie choice | 6 months, then we ask again |
7. Cookies and embedded content
We use essential cookies to run the website and remember your cookie choice. We use analytics cookies only if you accept them. Accept and reject are offered with equal prominence, and you can change your choice at any time through Cookie preferences in the footer.
Videos on this website use YouTube's privacy-enhanced mode and load only when you press play. Until then, YouTube sets no cookies. The office maps on our Contact page are embedded from Google Maps; when a map loads, Google receives your IP address and may set cookies under its own privacy terms. The live Ekard impact panel on our home page loads only if you accept analytics cookies or choose to load it. Links to XContent Magazine, xcontent.red, xcwf.org.za and the Ekard portal take you to other websites, which have their own privacy terms.
8. How we protect it
We use encryption in transit, a web application firewall, role-based access, secrets held in a managed key vault, and logging and monitoring. Only staff who need your information to deal with your enquiry can see it. No system is completely secure, and if a breach affects your personal information we will notify you and the Information Regulator as POPIA requires.
9. Your rights
You have the right to:
- ask whether we hold personal information about you and request a copy of it
- ask us to correct or delete personal information that is inaccurate, out of date, incomplete or unlawfully held
- object to our processing, including for direct marketing
- withdraw consent, such as for analytics cookies, at any time
- if the GDPR applies to you, ask us to restrict processing or provide your information in a portable format
- complain to the Information Regulator or, in the EU, your local data protection authority
To exercise a right, email [email protected]. We may need to verify your identity first. Requests for records may also be made under our PAIA manual.
The Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. PO Box 31533, Braamfontein, Johannesburg, 2017. General enquiries: [email protected]. PAIA complaints: [email protected]. POPIA complaints: [email protected]. Website: inforegulator.org.za.
10. Children
This website is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.
11. Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. If a change materially affects how we use information you have already given us, we will tell you directly.
12. Contact us
Information Officer: Andrew Janse Van Vuuren. Email: [email protected]. Phone: +27 11 014 1778. Address: 20 Charles de Gaulle Crescent, Building 1, Equity Estate, Highveld, Centurion, 0157. Post: Postnet Suite 218, Private Bag X1007, Lyttelton, 0140.