Information Manual

1. Details of the Responsible Party

2. Information Officer

In terms of Section 55 of POPIA, the head of a private body is deemed to be the Information Officer. GlowSend AI's Information Officer is:

3. Categories of Personal Information Processed

3.1 Website visitors and waitlist registrants

3.2 Special personal information

GlowSend AI does not intentionally collect any special personal information as defined under Section 26 of POPIA, including but not limited to: religious or philosophical beliefs, race or ethnic origin, trade union membership, political opinion, health or sex life, biometric information, or criminal behaviour.

3.3 Children's information

GlowSend AI does not knowingly collect personal information relating to children (persons under 18 years of age). Our services are directed exclusively at business professionals.

4. Purpose of Processing

5. Lawful Basis for Processing

GlowSend AI processes personal information on the following grounds as provided for in Section 11 of POPIA:

6. Sources of Personal Information

• Directly from data subjects — via the waitlist form, WhatsApp group gate, and newsletter signup on glowsendai.com
• Automatically from devices — browser, device, and behavioural data collected when visiting the website
• Third-party analytics tools — Google Analytics 4 and Microsoft Clarity collect anonymised usage data

7. Recipients of Personal Information

GlowSend AI does not sell, rent, or trade personal information. We share information only with the following operators who process data on our behalf:

We may also disclose personal information to government authorities, law enforcement, or regulatory bodies where required by applicable law.

8. Cross-Border Transfers

In terms of Section 72 of POPIA, personal information may only be transferred to a foreign country if that country has adequate data protection laws, or if the data subject consents, or if appropriate contractual safeguards are in place.

GlowSend AI transfers personal information to the United States via Google and Microsoft. These transfers are governed by Standard Contractual Clauses and the respective data processing agreements with these providers, which we have determined provide adequate protection equivalent to POPIA requirements.

9. Retention and Destruction of Records

Upon expiry of the retention period, or upon a valid erasure request, personal information will be permanently deleted. No backups containing personal information will be retained beyond the stated periods.

10. Security Safeguards

In terms of Section 19 of POPIA, GlowSend AI implements appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, or unlawful access to personal information. These include:

Technical measures

• HTTPS/TLS encryption for all data in transit via SSL certificate
• Access-controlled Google Sheets with restricted permissions — accessible only to authorised personnel
• Honeypot fields and timing-based bot detection on all forms to prevent automated spam submissions
• Math-based CAPTCHA verification on all submission forms
• No storage of payment information, government IDs, or sensitive special personal information

Organisational measures

• Access to personal information is limited to authorised personnel on a need-to-know basis
• Third-party operators are vetted and bound by data processing agreements
• This POPIA manual and our Privacy Policy are reviewed annually or upon material changes

Breach notification

In the event of a security compromise that may result in unlawful access to personal information, GlowSend AI will notify the Information Regulator and affected data subjects as soon as reasonably possible in accordance with Section 22 of POPIA.

11. Rights of Data Subjects

In terms of POPIA, data subjects have the following rights with respect to their personal information:

12. How to Submit an Access Request

Data subjects may submit a request to access, correct, or delete their personal information by contacting the Information Officer as follows:

Step 1 — Submit your request

Email hello@glowsendai.com with the subject line "POPIA Access Request". Please include:

• Your full name
• Your email address (as submitted to us)
• The nature of your request (access, correction, deletion, or objection)
• Any relevant details to help us locate your record

Step 2 — Verification

We may ask you to verify your identity before processing the request to protect against unauthorised access to your information.

Step 3 — Response

We will respond to your request within 30 days of receipt. If we are unable to comply with your request, we will inform you of the reasons in writing.

13. Objection to Processing

You may object to the processing of your personal information at any time by:

• Clicking the unsubscribe link in any email communication from us
• Emailing hello@glowsendai.com with the subject line "Unsubscribe" or "Opt Out"
• Submitting a formal objection under Section 11(3) of POPIA via email as described in Section 12 above

Upon receipt of a valid objection or withdrawal of consent, we will cease processing your personal information for the stated purpose as soon as reasonably possible and within 30 days.

14. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information or your request, you have the right to lodge a complaint with the Information Regulator of South Africa:

15. Updates to This Manual

This manual will be reviewed and updated at least annually, or whenever there are material changes to how GlowSend AI processes personal information. The version number and effective date at the top of this document will be updated accordingly.

The current version of this manual is available at glowsendai.com/popia.html at all times.