Privacy Policy

Who we are and what this policy covers

Gracious Growth Systems is an AI automation and growth-systems business based in South Africa. In this policy, "we" and "us" mean Gracious Growth Systems. Our Information Officer is Grace Biney, Founder and CEO. You can reach us at ops@graciousgrowthsystems.africa or on WhatsApp at +27 73 671 9170.

This policy applies to people who visit our website, submit our forms, message us on WhatsApp, email us, contact us on social media, leave us a Google review, or subscribe to our emails. Information we handle for our clients is covered in the section "Information we handle for clients" below.

What we collect, by channel

• Website forms (Google Forms): for the Free Profit Leakage Engineering Framework, your email address and any other details the form asks for. For the Free AI Growth Audit, your name, contact details, business details, and the information you share about your enquiries, follow-up and admin. Both forms have an optional tick box for free practical tips by email.
• WhatsApp (+27 73 671 9170): your phone number, your WhatsApp profile name, the messages you send, and any voice notes, images or files you share, with the details you give us in the conversation.
• Email (ops@, support@ and grace@graciousgrowthsystems.africa): your email address, your name, what you write, and any attachments you send.
• Phone calls: the details you give us during a call. If we take notes, we keep them with your enquiry record. We do not record calls unless we tell you first.
• Social media and reviews: messages, comments and profile information you share with us on Instagram or LinkedIn, and any Google Business Profile reviews or messages you send us.
• Email subscribers: your name, email address, the date you subscribed, and whether you open or click our emails. Our email service records opens and clicks.
• Website technical information: your IP address, browser type and the pages you visit, recorded in our hosting provider's server logs. Google Fonts also receives your IP address when the site loads.
• Support requests: the content of any support email, including error messages and screenshots. Please remove personal information from screenshots where you can.

We do not ask for passwords, ID numbers, banking details or medical records. Please do not send them to us. If you do, tell us and we will delete them where we can.

Sensitive information

Some information is sensitive under POPIA, such as health information. We do not collect health information through our website forms or our general enquiry channels. If a client service needs to handle sensitive information, we do so only under a separate written agreement that sets out the purpose, the safeguards and the retention period.

Information we handle for clients

When we build or run a system for a client, that client's own customers' information may pass through systems we set up. This can include names, phone numbers, WhatsApp messages, bookings, and records in the client's CRM. In these cases we act on the client's instructions under a written agreement with that client. The client is responsible for having a lawful reason to share its customers' information with us. This section does not change how we handle the information you give us directly.

Why we use it

• To send you the framework you asked for.
• To respond to your audit request and arrange your Free AI Growth Audit.
• To reply to your WhatsApp messages, emails and enquiries, and to follow up on them.
• To give you support on a service we have delivered.
• To deliver the services in a client agreement.
• To keep records of our conversations and agreements, and to meet legal and tax obligations.
• To send free practical tips by email, only to people who ticked the box.
• To protect our systems and respond to security incidents.

We do not sell your information, and we do not share it with other businesses for their marketing.

Our lawful basis

POPIA allows us to use personal information where you have consented, where it is needed to respond to your request or perform a contract, where the law requires it, or where we have a legitimate business interest that does not override your rights. We rely on consent for marketing emails, and on responding to your request or performing a contract for the rest.

Who we share it with

• Google: Google Forms, Gmail, Google Drive, Google Business Profile, Google Search Console, Google Fonts, and Google Apps Script, which sends the framework emails.
• Meta: WhatsApp, and Instagram where we use it. WhatsApp messages are encrypted in transit, but Meta can process message details such as phone numbers and timestamps.
• Microsoft: LinkedIn messages and our LinkedIn company page.
• Host Africa: our website and our email mailboxes.
• Our email marketing service: stores subscriber names and email addresses, and records opens and clicks. We will name the provider here once it is chosen.
• Business tools for client projects: such as HubSpot and n8n, and any other tool named in your project agreement.
• Professional advisers: such as accountants and lawyers, who must keep the information confidential.
• Authorities: where the law requires us to share information.

Where information is stored

Several of these providers store information outside South Africa. Before we send personal information to a provider, we check that it protects the information in a way comparable to POPIA's requirements, and we use it only for the purposes set out in this policy.

Cookies, tracking and advertising

We do not currently use advertising or tracking cookies on this website. The site loads fonts from Google. Our marketing emails record whether they are opened and clicked. If we add advertising or conversion tracking, such as Google Ads or Meta pixels, we will update this policy first and, where the law requires it, ask for your consent before tracking starts.

Automated systems

We use automation to reply to, route and organise enquiries. We do not use automation to make decisions that have a legal or similarly significant effect on you without a person reviewing them.

How long we keep it

• Framework and audit requests: six months from the date you submit them, then deleted from the form responses and any linked spreadsheet. If you become a client, we keep the information needed for your service under your agreement.
• WhatsApp and email enquiries that do not become work: six months after the last message, then deleted from our phones, mailboxes and tools.
• Client records: for the length of the client agreement and for as long as the law requires. After that, we delete or return them as the agreement says.
• Support requests: 12 months after the request is closed, so we can follow up on earlier support.
• Email subscribers: until you unsubscribe. We remove subscribers who have not opened or clicked any email for 12 months. Unsubscribed addresses stay on a suppression list so we do not email you by mistake.
• Website server logs: kept by our hosting provider for security and operation, for the period it sets.
• Backups: copies held in backups by Google, Meta or our host may take a little longer to clear.

Email updates

If you tick the box, we will send you free practical AI and automation tips by email. We send these through an email marketing service, which stores your name and email address and may process them outside South Africa.

We ask you to confirm each new subscription by email before we add you to the list. Every email we send includes an unsubscribe link. When you unsubscribe, we stop sending emails straight away and keep your address on a suppression list, so we do not email you again by mistake.

Your rights

You can ask us to:

• tell you what information we hold about you
• correct it
• delete it before the retention periods above are up
• stop using it, or withdraw your consent for the request you made
• stop receiving our marketing emails at any time, using the unsubscribe link in any email we send

Send your request by email to ops@graciousgrowthsystems.africa with the subject "Privacy request", or message us on WhatsApp at +27 73 671 9170. We will confirm your identity before we act on the request. You can also complain to the Information Regulator of South Africa at inforegulator.org.za.

Security and breaches

We take reasonable steps to protect the information you give us, including limiting who can access it and protecting our accounts. No online system is completely secure, so please do not send passwords or other sensitive information through any channel. If a security incident puts your information at real risk, we will tell you and the Information Regulator, as POPIA requires.

Children

Our services are for businesses. We do not knowingly collect information from children. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. If the changes are significant, we will tell you before they take effect.

Related pages