Privacy policy

Kamb Trading (Pty) Ltd, trading as Assay House, is the responsible party for the personal information described in this policy, as defined in the Protection of Personal Information Act 4 of 2013 (POPIA).

Enquiries about this policy, and requests under it, may be addressed to the Information Officer at hello@assayhouse.co.za or at the registered address above.

We collect:

• information you submit through the enquiry form: your name and email address, and optionally your telephone number, business name, website, area of interest, budget range and message;
• technical information submitted with it: the page of origin, the referring site, any campaign parameters in the link you arrived on, and your browser user agent. Your IP address is stored only as a one-way hash, for rate limiting;
• website usage statistics through Google Analytics, which sets a cookie to distinguish one browser from another. It does not receive your name, email address or the contents of any form;
• information you submit when you apply for the Commercial Foundation or a teardown: your name, email address and telephone number, your business name and website, and your answers to the application questions;
• your name and email address if you sign up to receive a playbook or other publication from us;
• if you ask for a one-page read after the Brand Stage Map: your first name, email address and website, your role, whether the business has paying customers, what it is about to spend on, and your answers to the check, kept together so we can write and send the read. Answers to the check that you do not send us never leave your browser;
• if you take part in Commercial Foundation work as a client, a client's customer or a research participant: what you tell us in interviews and calls, our notes of it, and, where you agree, a recording of the call;
• where you agree to appear in content we publish: your image, voice, name, job title and words, as set out in the release you sign.

We do not operate advertising cookies, retargeting pixels or any third-party marketing tracking on this website.

When we interview a client's customers as part of the Commercial Foundation, we do so on behalf of that client, who introduces each participant with their agreement. Participants are told the purpose before the interview and choose separately whether it may be recorded and whether their words may be quoted without their name. In our working notes participants are identified by number, not by name. Interview recordings are used only to make accurate notes; they are never published and are not given to the client.

Calls with clients and prospective clients are recorded only where every person on the call agrees, in writing beforehand and again at the start of the recording. Anyone may decline or ask us to stop recording, and the call continues without it. A recording is published only where the client has signed a documentation release, the client has approved the specific piece, and each person shown or heard has signed a likeness release. A sales call with someone who does not become a client is never published.

Participants must be 18 or older.

Enquiry information is processed to respond to your enquiry and to scope the work you have asked about. The lawful basis is that the processing is necessary to take steps at your request prior to entering into a contract.

A request for a one-page read is processed to write and send it to you, a step taken at your request. Applications are processed to assess whether the work is a good fit and to arrange it, which is likewise a step taken at your request before a contract. Research interviews, call recordings and the use of a person's image, voice, name or words in our content are processed on the basis of your consent, which may be withdrawn at any time. Playbook sign-ups are processed on the basis of your consent to receive that publication.

We send electronic marketing only to people who have ticked a separate box asking for it, or to existing clients about similar services, as section 69 of POPIA allows. Taking part in research, signing a release, applying or signing up for a playbook does not on its own mean we may send you marketing. Consent may be withdrawn at any time, by the unsubscribe link in any such message or by writing to us.

Usage statistics are processed for the legitimate purpose of operating and improving this website.

We use the following service providers. Each processes personal information as an operator on our instructions and for no other purpose.

• Xneelo hosts this website and our email, in South Africa.
• Supabase provides the database for enquiries, applications, sign-ups and the client portal, in the United Kingdom.
• n8n moves information between our systems and sends portal notifications, in Germany.
• Google sends portal notification emails, provides Google Meet for video calls and their recordings, and provides Google Analytics as described above, in the United States and other countries.
• Microsoft OneDrive stores our working files, including interview notes, recordings and signed forms, in South Africa, the United States and other countries.
• OpenAI turns call recordings into text, in the United States.
• Anthropic provides software we use to analyse research notes and draft written work, in the United States.
• PandaDoc is used to sign agreements and release forms, in the United States.

If you become a client, your information is held in the same system that provides your client portal, subject to your engagement terms.

We do not sell personal information and we do not disclose it to third parties for their own marketing. We disclose information where the law requires it.

Personal information you provide is not used to train any artificial intelligence model.

Several of the providers above hold information outside South Africa. We use only providers bound by law, binding corporate rules or a written agreement that give your information protection substantially similar to POPIA, as section 72 requires. Where that is not the case for a particular use, we ask for your consent first.

Where a client connects a Facebook Page or Instagram business account so that we can publish to it and report on its performance, we hold the authorisation token for that connection, the page and account statistics the platform provides, and the content published on the client's behalf.

We do not receive or hold your Facebook or Instagram password. The connection is authorised through Meta's own permission screen and may be revoked at any time from your Meta business settings, with immediate effect. We do not access personal profiles, friend lists or private messages, and we do not use this information for advertising. To have the connection and the information obtained through it removed, see data deletion.

An enquiry or application that does not result in an engagement is retained for 24 months and then deleted. An application that is started but not submitted is deleted 120 days after it was started.

Research interview recordings are deleted 90 days after the version of the work they inform is approved. Interview notes are kept, without participants' names, with the client's approved work. Recordings of client calls not used in published content are deleted 12 months after the work is handed over; recordings of sales calls are deleted 12 months after the call. Content approved for publication is kept while it is published and for five years after.

Consent records and signed releases are kept for five years, so that what was agreed can be shown. Playbook sign-ups are kept until you unsubscribe; after that we keep only your email address on a suppression list, so that you are not contacted again.

Records relating to an engagement, including invoices and accounting records, are retained for seven years, as required by the Companies Act 71 of 2008, or longer where the Tax Administration Act 28 of 2011 requires it. Information may be retained for a shorter period on request, subject to those obligations.

This website is served over HTTPS and enquiries are transmitted encrypted. The database in which they are held is access-controlled and is not publicly readable. Where a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

Under POPIA you have the right to:

• be told what personal information we hold about you;
• have inaccurate or incomplete information corrected;
• have information deleted or destroyed where we have no lawful basis to keep it;
• object to processing on reasonable grounds; and
• withdraw consent previously given.

Requests may be sent to hello@assayhouse.co.za and are actioned free of charge. Deletion requests are dealt with under our data deletion procedure.

How to request access to a record, and the records we hold, are set out in our PAIA manual.

A complaint about our handling of your personal information may be made to us in the first instance. You are also entitled to lodge a complaint with the Information Regulator of South Africa, at inforegulator.org.za.

This policy may be amended from time to time. The date of the current version is stated above. Amendments apply prospectively.