Privacy Policy

Effective date: 16 October 2026

1. Introduction

Kypaa (Pty) Ltd (“Kypaa”, “we”, “us”, or “our”) is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you visit our website (kypaagroup.com), contact us, or use our services.

We comply with applicable data protection laws, including:

  • The Protection of Personal Information Act (POPIA) of South Africa

  • The UK General Data Protection Regulation (UK GDPR)

  • The EU General Data Protection Regulation (EU GDPR)

  • The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

  • The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada

By using our website, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

Depending on how you interact with us, we may collect:

  • Full name

  • Company name

  • Email address

  • Telephone number

  • Industry or business information

  • Information submitted through our contact forms

  • Communications between you and Kypaa

  • Technical information such as IP address, browser type, device information, and website usage data

We only collect personal information that is reasonably necessary for the purposes described in this Privacy Policy.

3. How We Use Your Information

We may use your personal information to:

  • Respond to enquiries

  • Provide our services

  • Prepare proposals and quotations

  • Communicate with you regarding our services

  • Improve our website and user experience

  • Administer our business operations

  • Comply with legal or regulatory obligations

  • Protect our legal rights and legitimate business interests

We will only process personal information where we have a lawful basis for doing so.

4. Lawful Bases for Processing

Under GDPR and UK GDPR, we rely on the following lawful bases:

  • Contract — to provide services you have requested

  • Legitimate interests — to run and improve our business

  • Consent — where you have specifically agreed (e.g., marketing)

  • Legal obligation — where required by law

Under POPIA, we process personal information in accordance with the conditions set out in the Act.

5. Marketing Communications

Where permitted by law, we may send you information about our services, insights, or business updates.

You may opt out of receiving marketing communications at any time by contacting us or following the unsubscribe instructions included in our communications.

6. Sharing Your Information

We do not sell your personal information.

We may disclose your personal information where necessary to:

  • Service providers who assist us in operating our business

  • Professional advisers

  • Technology providers supporting our services

  • Regulatory authorities where required by law

  • Other parties where disclosure is authorised or required by applicable law

Where appropriate, we take reasonable steps to ensure that third parties protect personal information in accordance with applicable privacy laws.

7. International Transfers

Some of the technology platforms and service providers we use may process or store information outside your country of residence.

Where personal information is transferred internationally, we take reasonable steps to ensure appropriate safeguards are implemented in accordance with applicable law — including the use of standard contractual clauses or equivalent transfer mechanisms where required.

8. Information Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

While we take reasonable precautions, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

9. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and protect our legitimate business interests.

10. Your Rights

Subject to applicable law, you may have the right to:

  • Request access to your personal information

  • Request correction of inaccurate information

  • Request deletion of personal information where appropriate

  • Object to certain processing activities

  • Request restriction of processing

  • Withdraw consent where processing is based on consent

  • Lodge a complaint with the relevant supervisory authority

Specific jurisdiction rights:

  • South Africa (POPIA): You may lodge a complaint with the Information Regulator of South Africa.

  • UK: You may lodge a complaint with the Information Commissioner’s Office (ICO).

  • EU: You may lodge a complaint with your local data protection authority.

  • California (CCPA/CPRA): You have the right to know what personal information is collected, to request its deletion, and to opt out of the sale of personal information. We do not sell personal information.

  • Canada (PIPEDA): You may lodge a complaint with the Office of the Privacy Commissioner of Canada.

We will respond to applicable requests within a reasonable period and in accordance with applicable law.

11. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of external websites, and we encourage you to review their respective privacy policies before providing personal information.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, legal obligations, or website functionality. The latest version will always be published on this page together with its effective date.

13. Contact Us

If you have any questions regarding this Privacy Policy, please contact us at info@kypaagroup.com.

Kypaa (Pty) Ltd

Registration Number: 2026/633005/07

Kypaa (Pty) Ltd | Registration Number: 2026/633005/07