Legal
Privacy notice
This notice is given under section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA). It tells you what personal information we collect, why we collect it, who handles it, how long we keep it, and what rights you have.
Last updated: 16 October 2026
Who we are
ProSynth is a sole proprietorship owned by Shane Aucamp. We are the responsible party for the personal information described in this notice.
- Address: 7 Fernwood Crescent, Vergelegen, Somerset West, 7130, South Africa
- Email: shane@prosynthsystem.com
- Phone: 082 819 4015
Our Information Officer is Shane Aucamp. Our Deputy Information Officer, designated under POPIA section 56, is Martin Aucamp. Contact either of them through the Information Officer's details above.
ProSynth’s Information Officer is registered with South Africa’s Information Regulator. This is registration only, not independent compliance certification. Registration number: 2026-068901.
On this website
This website is a set of plain pages. It has no forms. The pages we publish set no cookies and run no analytics, advertising or tracking scripts. Our fonts load from our own site, not from Google or any other font service.
Two things still happen when you visit.
First, our website host receives the technical details that every website receives. These are your IP address, your browser and device type, the page you asked for and the time. We do not use these details to track you.
Second, the button "Book a free Strike Audit" is a plain link. When you click it, your browser leaves our site and opens a booking page on Cal.com. What you enter there goes to Cal.com, not to our site.
Booking through Cal.com
We use Cal.com to take bookings. On the Cal.com page you enter your details, such as your name and email address and anything else the booking form asks for. Cal.com is a United States company and processes them mainly in the United States. It handles them for us under its Data Processing Agreement. For these booking details Cal.com acts as our operator and we are the responsible party. Cal.com's own pages, including how it uses cookies, are covered by Cal.com's privacy policy.
Our website host
We host this website with Netlify, Inc., a United States company. When a page loads, Netlify receives the technical details listed above and handles them for us as a processor under its Data Processing Agreement, which forms part of its Self-Serve Subscription Agreement.
What personal information we collect and why
| Purpose | Information collected | Source | Lawful basis |
|---|---|---|---|
| Running this website | IP address, browser and device type, the page requested, the time | Your browser, through our website host | Our legitimate interest in running and securing the site (section 11(1)(f)) |
| Booking a Strike Audit | Name, email address, time zone, and anything else the booking form asks for | You, on Cal.com | Your consent: you choose to book (section 11(1)(a)) |
| Enquiries by email or phone | Name, email address, phone number, and what you write or say | You | Your consent: you choose to contact us (section 11(1)(a)) |
| Calls and meetings with you | Notes of what you tell us on a call. We tell you at the start of a call that a note-taking service transcribes it and that our AI assistant, hosted in the United States, helps us take notes and follow up, and we ask for your agreement. Our usual note-taker, Granola, transcribes the audio without keeping a recording. When a call needs a recording, we use Fathom, only with your agreement, and keep the recording for 12 months. | You | Your consent (section 11(1)(a)) |
| Lead generation and outreach | Name, work email, work phone, job title, employer name, LinkedIn profile URL | Publicly available professional profiles (LinkedIn), business websites, direct referrals | To keep your details long enough to send you one message asking whether you want to hear from us: our legitimate interest (section 11(1)(f)) and section 69(2) of POPIA, which allows one such request. To send you marketing by email, phone or LinkedIn message: your consent, asked for in that one message (sections 11(1)(a) and 69(1)(a)). If you do not say yes, we do not contact you again. |
| Client service delivery | Name, work email, work phone, job title, employer name, meeting notes, diagnostic notes | Directly from you during an engagement | Necessary for a contract (section 11(1)(b)) |
| Client staff diagnostic interviews | Name, job title, department, responses and views | Directly from interviewees during diagnostic sessions | Consent |
Is supply mandatory or voluntary?
Supply of personal information is voluntary. You can read this site without giving us anything. If you book a call, Cal.com needs your name and email address to make the booking. For leads, we collect from public sources. You do not have to reply to our message, and you can tell us at any time to stop. For clients, the information we need to do the work is necessary for the contract. For client staff in a diagnostic interview, you choose what you say.
Consequences of not providing information
If you choose not to give us information we need to do what you asked, we may be unable to do it. We cannot book you a call without a name and an email address. Where information is necessary for a contract, we may be unable to deliver the service. If you tell us to stop, or you do not reply to our one message, we do not contact you again. We keep your email address and the date of our message on a do-not-contact list so that we never ask you a second time.
Does any law require us to collect it?
No law requires you to give us personal information on this site. The law does require us to keep financial records, such as invoices and payment details. The Tax Administration Act 28 of 2011 sets how long. See "How long we keep it" below.
Who receives your information
We do not sell personal information. Lead and client records are for our own use, and we do not share them with anyone for their own marketing. We share personal information only with:
- Cal.com, which takes bookings for us.
- Our website host.
- Our email provider, Google, which carries the emails you send us and we send you.
- Fathom, which records and transcribes a call when we record one with your agreement.
- The tool providers listed under "Transfers outside South Africa", who process information for us.
- Our bank and our accounting firm, for client identity and payment details, as needed.
A client's diagnostic data goes only where the client instructs us. Otherwise we do not pass it on.
Transfers outside South Africa
Researching prospective clients
When we research a prospective client who has not yet agreed to hear from us, our AI assistant (OpenAI, through our ChatGPT plan, and models reached through OpenRouter) may process their public business contact details: name, job title, employer, work email and LinkedIn profile. We have no data processing agreement with OpenAI for this, and the research that goes through OpenAI rests on none of the section 72 grounds listed below. For research that goes through OpenRouter, its data processing agreement forms part of its Terms of Service (see its row in the table below). We use only public business details, never private or sensitive information. We do not put the personal information of people in the United Kingdom into our ChatGPT plan (see "If you are in the United Kingdom" below). Anyone can ask us to delete their details, or object to our processing, at any time through the contact details in this notice.
The providers
These service providers host or process information for us outside South Africa.
| Provider | Country | What it does for us | Safeguard |
|---|---|---|---|
| Cal.com | United States | Takes bookings for the Strike Audit. You enter your details on its pages. | Its Data Processing Agreement, under which it handles booking details for us. Cal.com states that it complies with the EU-U.S. Data Privacy Framework and uses EU standard contractual clauses where appropriate. |
| Netlify | United States | Hosts this website. Receives your IP address and request details. | Its Data Processing Agreement, which forms part of its Self-Serve Subscription Agreement. Netlify has certified to participate in and comply with the EU-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework. If that certification is invalid or lapses, the agreement falls back to the EU Standard Contractual Clauses. |
| Google (Gmail and Google Workspace) | United States and other countries where Google operates | Carries the emails you send us and we send you, and our Google Meet calls. | Google's Cloud Data Processing Addendum, which forms part of its Google Workspace agreement. Google may process data in any country where it or its subprocessors have facilities. We accepted Google's Cloud Data Processing Addendum for our Workspace on 15 October 2026. |
| OpenAI (ChatGPT, our individual plan; also the AI assistant that helps us with notes, drafts and follow-up) | United States | Note-taking and analysis | We have no data processing agreement with OpenAI. We have switched off OpenAI's use of our content to train its models. For clients and people on our calls, the ground is your consent (section 72(1)(b)). For prospective clients, see "Researching prospective clients" above. We do not put the personal information of people in the United Kingdom into our individual ChatGPT plan, because we have no data processing agreement with OpenAI for it and so no UK transfer safeguard. |
| OpenRouter | United States | Request routing. We reach it through the same AI assistant for some tasks. | OpenRouter's data processing agreement forms part of its Terms of Service. Under it OpenRouter acts as our processor, and for transfers from the United Kingdom it applies the UK Addendum to the standard contractual clauses. OpenRouter's privacy policy says it does not use inputs or outputs for model training. It passes each request to the model provider we select, and that provider's own terms apply. |
| Google NotebookLM | United States and other countries where Google operates | Document analysis and research | Through a Google Workspace work account, Google's Cloud Terms of Service apply, and Google says uploads and queries are not used to train its models. |
| Pinecone | United States | Storage of our business knowledge, for search over our own records | Pinecone's Master Subscription Agreement, which governs our account (a free plan), incorporates its Data Processing Addendum for customer data containing personal information (section 8.1). Under that addendum Pinecone acts as our processor. Pinecone may process data wherever it or its subprocessors operate. |
| Granola | United States. The company is based in the United States and the United Kingdom, and its servers are on Amazon Web Services, located primarily in the United States. | Meeting notes and transcription | Granola's privacy policy says personal data is encrypted at rest and in transit, and that it does not allow third parties such as OpenAI or Anthropic to use personal data to train their models. It may also process data in other regions where it has facilities or service providers. For transfers it relies on legal mechanisms such as standard contractual clauses, and points to its Data Processing Addendum for detail. That addendum, under which Granola acts as our processor, applies to customers using its services under its terms, and its text sets no paid-plan condition. We have switched off Granola's use of our data to improve its models. |
| Fathom (Fathom Video Inc.) | United States. The company is in San Francisco and stores all data in the United States. | Records and transcribes a call, only when we record one with your agreement. | Its Data Processing Agreement, which its Terms of Service incorporate by reference where an applicable law requires one. Fathom says it complies with the EU-U.S. Data Privacy Framework, and that for transfers outside the European Economic Area it ensures safeguards such as standard contractual clauses or the Data Privacy Frameworks. |
Calls take place on Google Meet, through our Google Workspace account, or on Microsoft Teams when the other party hosts the call on its own account.
A Data Processing Addendum, the EU-U.S. Data Privacy Framework and standard contractual clauses are the arrangements that require a provider to protect personal information when it crosses a border.
Apart from the research on prospective clients described above, we send personal information to a provider abroad under section 72 of POPIA only on one of these grounds:
- A binding agreement that requires the provider to protect the information to a standard substantially similar to POPIA, including when it passes the information on (section 72(1)(a)). We rely on this for Google (Gmail, Google Workspace, Google Meet and NotebookLM, through our Google Workspace account), Cal.com, Netlify, Pinecone and Granola, each under its own data processing agreement or addendum, as the safeguard column shows.
- Your consent (section 72(1)(b)). If you are a client or you join one of our calls, we ask for your consent at the start of each call, and in our proposals and engagement agreements. We tell you that a note-taking service and our AI assistant, hosted in the United States, help us take notes and follow up. We record a call with Fathom only with your agreement.
- A booking or request you made (section 72(1)(c)), such as taking your booking.
The safeguard column shows which applies to each provider. We do not put personal information about clients or call attendees into any tool that meets none of these.
How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for. Then we delete it.
| What | How long |
|---|---|
| People we messaged once who did not reply | We delete their details 6 months after our message. We keep only their email address and the date of our message, on a do-not-contact list, so that we never ask a second time (section 69(2)). |
| Leads who replied but did not meet us | 12 months from our last contact |
| Leads and prospects in an active conversation | While we are in conversation, plus 12 months after our last contact |
| Booking details and enquiries by email or phone | While the enquiry is open, plus 12 months |
| Call recordings (Fathom, when we record a call with your agreement) | 12 months from the call |
| Meeting transcripts | 12 months from the meeting |
| Client diagnostic notes | As the client's contract says |
| Client engagement records | While we work together, plus 5 years after the engagement ends |
| Invoices, receipts, bank statements and other financial records | 5 years from the date the related tax return is submitted (Tax Administration Act 28 of 2011, section 29) |
| Session summaries in our business knowledge store | Until we delete them. We delete personal information in them on a verified request |
| Proof that you agreed to receive our marketing | While we market to you, and 3 years after you withdraw your consent (it is our proof that the earlier messages were lawful) |
If you ask us to delete your information, we act within 30 days and confirm in writing. Where the law requires us to keep a record, we say so in our reply.
Your rights
You have the right to:
- Ask for the personal information we hold about you. To ask for access to a record, see our PAIA manual.
- Ask us to correct or delete your personal information.
- Object to our processing of your personal information (section 11(3)).
- Withdraw your consent at any time, where we rely on it.
- Complain to the Information Regulator.
How to exercise your rights
Email shane@prosynthsystem.com with the subject "POPIA Request". We will respond within 30 days. To stop outreach messages, reply "unsubscribe" to any of them.
Complaints to the Regulator
Information Regulator (South Africa)
- Website: inforegulator.org.za
- Email for complaints about personal information: POPIAComplaints@inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za, toll free 0800 017 160
- Address: 54 Maxwell Drive, Woodmead, Johannesburg, 2191
If you are in the United Kingdom
This section is for people in the United Kingdom. It adds to the rest of this notice. We market our services to businesses in the United Kingdom, so UK data protection law (the UK GDPR and the Data Protection Act 2018) applies to some of what we do with your information.
Who is responsible
ProSynth, a sole proprietorship owned by Shane Aucamp, decides how your information is used. We are based in South Africa and have no office in the United Kingdom.
- Address: 7 Fernwood Crescent, Vergelegen, Somerset West, 7130, South Africa
- Email: shane@prosynthsystem.com
Why we use your information and the legal basis
| Purpose | Information | Legal basis under the UK GDPR |
|---|---|---|
| Finding a business contact and sending you one message asking whether you want to hear from us | Name, work email, job title, employer, LinkedIn address, taken from public profiles, business websites or a referral | Legitimate interests: telling businesses about a service that may help them. We write once, to a company work address, and stop if you object |
| Marketing to you after you say yes | Your contact details and your reply | Your consent. You can withdraw it at any time |
| Remembering that we already wrote to you, or that you objected | Your email address and the date of our message | Legitimate interests: making sure we never contact you again |
| Booking a Strike Audit and answering enquiries | Name, email address, time zone, what you write | Steps you ask for before a contract, or our legitimate interests in answering you |
| Notes of calls, and recordings when we make one | What is said on the call | Your consent, which we ask for at the start of the call |
| Doing the work for a client | Contact details, meeting notes, diagnostic notes | A contract with you, or, if you work for our client, our legitimate interests in doing the work they asked for |
| Invoices and financial records | Names, work contact details, payment details | Our legitimate interests in keeping accurate accounts and meeting South African tax rules |
If you object to marketing, we stop for good. You do not need to give a reason.
Where we get your information
For business contacts we use public professional profiles such as LinkedIn, business websites and referrals. Our first message tells you which source we used.
Who receives your information and where it goes
Your information goes to the providers listed under "Who receives your information" and "Transfers outside South Africa" above. Sending your information from us in South Africa to a provider in the United States is an international transfer under UK law. UK law needs a safeguard for each one. These are ours:
| Provider | Safeguard for UK personal information |
|---|---|
| Google (Gmail, Google Workspace, Google Meet, NotebookLM) | Google LLC takes part in the UK Extension to the EU-U.S. Data Privacy Framework, which the UK government recognises as giving adequate protection (the "UK data bridge"). Google's Cloud Data Processing Addendum also covers UK data protection law |
| Cal.com | Cal.com, Inc takes part in the UK Extension to the EU-U.S. Data Privacy Framework |
| Netlify | Netlify, Inc takes part in the UK Extension to the EU-U.S. Data Privacy Framework |
| Fathom | Fathom takes part in the UK Extension to the EU-U.S. Data Privacy Framework |
| Granola | Its data processing addendum includes the standard contractual clauses for UK transfers |
| Pinecone | Its data processing addendum includes the standard contractual clauses and the UK Addendum |
| OpenRouter | Its data processing agreement, which forms part of its Terms of Service, includes the UK Addendum to the standard contractual clauses |
We do not put the personal information of people in the United Kingdom into our individual ChatGPT plan, because we have no data processing agreement with OpenAI for it and so no UK transfer safeguard. To get a copy of any safeguard, email us.
How long we keep it
As in "How long we keep it" above. The same periods apply to UK personal information.
Your rights
Under UK law you have the right to:
- ask for a copy of the personal information we hold about you;
- have inaccurate information corrected;
- have your information deleted, in some cases;
- ask us to restrict how we use it, in some cases;
- receive information you gave us in a portable form, where we use it on the basis of your consent or a contract;
- object to our use of your information, and object to marketing at any time without giving a reason; and
- withdraw your consent at any time, where we rely on it.
Email shane@prosynthsystem.com with the subject "UK request". We reply within one month. If your request is complex we may extend that by up to two further months, and we will tell you why within the first month.
Complaints
You can complain to us first. Email shane@prosynthsystem.com with the subject "UK complaint". We acknowledge it within 30 days, look into it, keep you informed and tell you the outcome.
You can also complain to the UK regulator, the Information Commission (which works as the Information Commissioner's Office, the ICO):
- Website: ico.org.uk. Data protection complaints: ico.org.uk/make-a-complaint/data-protection-complaints/
- Helpline: 0303 123 1113
- Address: Information Commission's Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL
Updates to this notice
We will post changes on this page and change the date at the top.