Privacy Policy.
This Privacy Policy explains how Exsensic (Pty) Ltd ("Exsensic", "we", "us", "our") collects, uses, stores, shares and protects personal information, and the rights you have in relation to it. It applies to exsensic.com, our social media pages, our Facebook, Instagram, LinkedIn and Google ads and lead forms, and any message, form or enquiry you send us.
SEE Exsensic Privacy Policy and PAIA Manual.pdf
1. Who we are
| Responsible party | Exsensic (Pty) Ltd, registration number 2025/198393/07 |
| What we do | Digital marketing agency: social media management, website design and development, brand identity, paid advertising, performance reporting and analytics, and content shoots |
| Registered address | 16 Aristata Avenue, Florida Glen, Roodepoort, Gauteng, 1709 |
| Operating from | Cape Town, Western Cape |
| Information Officer | Jean Stemmet, jean@exsensic.com, 082 764 7760 |
When we process personal information for our own purposes we are the responsible party. When we run an ad account, social media page or campaign on a client's instructions, our client is the responsible party and we act as its operator under sections 20 and 21 of POPIA (see section 11).
2. What personal information we collect
| Who you are | What we may collect | Where it comes from |
|---|---|---|
| Website visitors | IP address, device and browser type, pages visited, referral source, approximate location, cookie and pixel identifiers, interactions with forms and buttons | Automatically through cookies, Google Analytics, the Meta Pixel and similar tags (see our Cookie Policy) |
| Leads and enquiries | Name, company name, job title, email address, phone and WhatsApp number, the service you are interested in, budget indication, and anything you write to us | Directly from you via website forms, Facebook and Instagram lead forms, Messenger, WhatsApp, LinkedIn, email, phone or in person |
| Facebook and Instagram lead forms | The answers you give in the form, together with the public profile name and any pre-filled details Meta shares with us when you submit it | From Meta, when you submit a lead form in one of our ads |
| Clients and their staff | Contact and billing details, company registration and VAT numbers, bank details for reconciliation, access you grant us to platforms we manage, briefs, brand assets and correspondence | From you during onboarding and throughout the engagement |
| Client audiences (operator role) | Customer and lead lists, follower and engagement data, pixel and conversion data, ad platform audience data | From the client or the platforms the client has authorised us to operate |
| Suppliers and freelancers | Name, contact details, bank details, invoices, identity or registration numbers where legally required | Directly from you |
| Job applicants | CV, qualifications, work history, references, contact details, portfolio | Directly from you or your referees |
| People featured in content | Photographs, video, voice, name and role when you appear in a content shoot | Captured with your consent and recorded on a release form |
We do not intentionally collect special personal information (race, ethnic origin, religious beliefs, health, sexual life, biometric or criminal information) and ask that you do not send it to us. We do not knowingly collect information from children under 18 without the consent of a parent or guardian.
3. Why we use it and on what legal basis
| Purpose | Examples | Legal basis under POPIA |
|---|---|---|
| Responding to you | Answering enquiries, quoting, booking a discovery call | Steps before entering a contract; our legitimate interest |
| Delivering our services | Managing accounts, building websites, running ads, reporting, invoicing, support | Performance of a contract with you or your employer |
| Our own marketing | Email newsletters, retargeting people who visited our site, lookalike audiences, LinkedIn outreach, WhatsApp follow-ups | Your consent, or for existing clients our legitimate interest in marketing similar services with an opt-out (section 69) |
| Measuring and improving | Website analytics, ad performance, testing which content works | Our legitimate interest in running an effective business |
| Showcasing our work | Case studies, portfolio pieces, testimonials | Your written consent before publication |
| Legal and financial compliance | Tax and accounting records, resolving disputes, responding to lawful requests | Legal obligation |
| Security | Protecting our systems, client accounts and data from unauthorised access | Our legitimate interest and legal obligation (section 19) |
4. Direct marketing and advertising
- Unsolicited electronic marketing needs consent. We only send marketing by email, SMS, WhatsApp or automated calls to people who have opted in, or who are existing clients and were offered an opt-out when their details were collected (section 69 of POPIA). We may approach you once to ask for consent and will not ask again if you decline.
- Every message has an opt-out. Every marketing email, SMS or WhatsApp broadcast includes a free and simple way to unsubscribe. We action unsubscribes within 48 hours and keep a suppression list so you are not re-added.
- Lead forms. When you submit a Facebook, Instagram, LinkedIn or Google lead form, the details you submit are governed by this policy. We use them to respond to your enquiry. We only add you to marketing lists if you tick the marketing consent box in the form.
- Targeted advertising. We advertise on Meta (Facebook and Instagram), Google and LinkedIn. Interest and behaviour targeting uses data those platforms hold under their own policies. Custom audiences built from our own lists only include people who consented to marketing from us; the list is hashed before it is matched. Retargeting relies on cookies and pixels, which you can control as described in section 5.
- Purchased or scraped lists. We do not buy contact lists or scrape personal data for marketing, and we do not run campaigns on lists a client cannot show were lawfully collected.
- Networking and in-person contacts. Business cards and details collected in person are used only to follow up on the conversation you had with us, and are added to marketing lists only if you agree.
5. Cookies, pixels and tracking
Our website uses cookies and similar technologies, including Google Analytics, Google Tag Manager, the Meta Pixel and Conversions API, and the LinkedIn Insight Tag. Meta and other third parties use these technologies to measure how our ads perform and to show you relevant ads on their platforms. The cookie banner lets you accept or decline non-essential cookies, and you can change your choice at any time. Full details, including retention periods, are in our Cookie Policy.
You can also control personalised advertising directly with the platforms: Facebook Ad Preferences, Google Ads Settings, LinkedIn Ad Settings, and the industry opt-out at aboutads.info.
6. Who we share personal information with
We do not sell personal information. We share it only as described here, and only as much as is needed for the purpose.
| Recipient | What and why |
|---|---|
| Advertising and social platforms | Meta (Facebook, Instagram, WhatsApp Business), Google, LinkedIn and TikTok: pixel data, conversion events, hashed customer lists for audience matching, and the data needed to serve and measure ads. Where we and Meta both determine how lead form data is used, we and Meta share responsibility for that processing. |
| Operators and service providers | Website hosting and domain providers, email and CRM platforms, cloud storage, design and content tools, video and AI production tools, accounting and invoicing software, electronic signature and scheduling tools. Each is bound by terms that require them to secure the data and use it only on our instructions (section 21). |
| Our clients | Where we generate leads or run campaigns for a client, the leads and campaign data belong to the client and are shared with them. |
| Freelancers and contractors | Designers, developers, videographers and editors who work on our projects under confidentiality obligations, and only the information needed for the job. |
| Professional advisers and authorities | Accountants, auditors, attorneys, banks, SARS, CIPC, the Information Regulator, courts or law enforcement where required by law or to protect our rights. |
| A buyer of our business | If Exsensic is sold or merged, personal information may transfer to the new owner on the same terms as this policy. |
7. Information sent outside South Africa
Most of the platforms and tools we use store data outside South Africa, typically in the United States, the European Union or the United Kingdom. Section 72 of POPIA allows this where the recipient is bound by a law, binding corporate rules or a contract that provides substantially similar protection, where you consent, or where the transfer is necessary to perform a contract with you. We rely on the platforms' data processing terms and standard contractual clauses.
8. How we protect personal information
- Unique credentials and two-factor authentication on every ad account, social profile, email account and cloud service we control or are given access to.
- Client platform access through Business Manager, partner access or delegated roles rather than shared passwords, revoked within 7 days of an engagement ending.
- Encrypted storage and transmission (HTTPS, encrypted cloud drives, encrypted devices).
- Access on a need-to-know basis; contractors receive only what their task requires and sign confidentiality undertakings.
- Regular software updates, device security and backups, and a documented breach response procedure.
9. How long we keep it
| Information | Retention period |
|---|---|
| Enquiries and leads that do not become clients | 12 months from last contact, then deleted or anonymised |
| Client records, contracts and correspondence | 5 years after the engagement ends |
| Invoices, accounting and tax records | 5 years from submission of the relevant tax return |
| Marketing consent and opt-out records | For as long as we market to you, plus 3 years |
| Website analytics and pixel data | 14 months (analytics), 13 months (advertising) |
| Content shoot footage and releases | Duration of the licence in the release form |
| Job applications | 6 months after the role is filled unless you ask us to keep it |
| Client audience data (operator role) | As instructed by the client; returned or deleted within 30 days of the engagement ending |
10. Security compromises
If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible, as section 22 of POPIA requires. Where we act as operator we notify the client immediately so that they can notify their data subjects.
11. When we act as an operator for clients
Clients remain responsible for the personal information in their ad accounts, CRMs and customer lists. When we operate those systems for them we process the data only on the client's documented instructions, keep it confidential and secure, never use it for our own marketing or add it to Exsensic's own lists, require the client to confirm its data was lawfully collected, and return or delete the data when the engagement ends.
12. Your rights
| Right | What it means | How to use it |
|---|---|---|
| Access | Confirm whether we hold your personal information and receive a copy | Email jean@exsensic.com. We respond within 30 days. The request procedure in our PAIA Manual applies and a prescribed fee may be charged for copies |
| Correction and deletion | Have inaccurate, out of date, excessive or unlawfully obtained information corrected or deleted | Email us with the detail to be changed; we confirm the outcome in writing |
| Object | Object to processing based on our legitimate interests | Email us with your reasons; we stop unless we can show compelling legitimate grounds |
| Opt out of marketing | Stop receiving direct marketing at any time | Use the unsubscribe link, reply STOP, or email us. Actioned within 48 hours |
| Withdraw consent | Withdraw any consent you gave, without affecting processing already done | Email us or use the cookie banner |
| Complain | Lodge a complaint with the Information Regulator if you are unhappy with our response | POPIAComplaints@inforegulator.org.za or 010 023 5200 |
We may ask you to prove your identity before acting on a request. We will not charge for exercising these rights except where PAIA allows a fee for access to records.
13. Legal requests
We disclose personal information to courts, regulators or law enforcement only where a law, court order or lawful request requires it, and only the information required. Where the law allows, we tell the affected person before or after the disclosure.
14. Changes to this policy
We review this policy at least once a year and whenever we adopt a new tool, platform or type of processing. The current version is always at exsensic.com/privacy-policy. Material changes are announced on this page and, where appropriate, by email to clients. The version number and effective date at the top of this page tell you which version applies.
15. Contact
| Information Officer | Jean Stemmet |
| jean@exsensic.com | |
| Telephone | 082 764 7760 |
| Post | 16 Aristata Avenue, Florida Glen, Roodepoort, Gauteng, 1709 |
| Website | exsensic.com |