Call our Sales Team NOW! on +27 60 019 5060

Privacy Policy

Last Updated: 2026-09

1. Who we are

· Legal/trading name: "Ellulo" is a trading name and is not a registered company or close corporation.

· Registration number: Not applicable: sole proprietorship.

· Contact: [email protected] (general enquiries and complaints) / [email protected] (billing and payment queries) / +27 60 019 5060

This Policy describes what Ellulo collects and does with personal information in connection with our marketing and business-automation platform ("the Service"), and explains your rights under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It should be read together with our [Terms and Conditions](https://ellulo.com/terms-and-conditions), and with our shorter [POPIA Compliance](https://ellulo.com/popia-compliance) summary.

2. Two roles this Policy Covers

2.1 Where Ellulo is the "responsible party". If you are the business that signs up for and holds an Ellulo account ("Customer," "you"), Ellulo determines why and how your personal information is processed: your name, contact details, business details, billing information, and usage data. Sections 4, 6, and 9–16 of this Policy set out how we handle your information in this capacity.

2.2 Where Ellulo is an "operator" (processor). When you use the Service to run a website, capture leads, run marketing campaigns, or interact with your own customers (including through AI Employee/Conversational AI features), personal information about those leads and customers passes through Ellulo's systems on your behalf. In that relationship, you, not Ellulo, decide why that information is processed, and are the responsible party for it. Ellulo acts only as an "operator" under POPIA: we process it solely on your instructions, to provide the Service, and we:

· don't decide why or how your leads'/customers' information is processed; you do;

· don't use it for any purpose of our own (including our own marketing);

· keep it confidential and secure, and process it only under a lawful basis established by our agreement with you, consistent with sections 20 and 21 of POPIA;

· only share it with the sub-processors listed in Section 8, to the extent needed to provide the Service.

If you are a lead or customer of one of our Customers and have a question about how your information is used, your first point of contact is that Customer; they are the responsible party for your data and can direct you to Ellulo as needed. Section 5 below sets out what Ellulo does with this category of data.

3. Definitions

· "Personal information" means information relating to an identifiable, living natural person or existing juristic person, as defined in POPIA. It includes names, contact details, identifying numbers, financial information, and online identifiers.

· "Processing" means anything done with personal information: collecting, storing, using, sharing, or deleting it.

· "Responsible party" means the party that decides why and how personal information is processed.

· "Operator" means a party that processes personal information on behalf of, and only on the instructions of, a responsible party.

· "Special personal information" means sensitive categories under POPIA (religious/philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric data, or criminal behaviour). Ellulo doesn't intentionally collect special personal information as part of the Service. Where a caller or lead volunteers this kind of information to an AI Employee/Conversational AI feature or through a form, it's handled under the same safeguards as any other data your Customer submits, and you (as responsible party for your own leads' data) are responsible for having a lawful basis to collect it.

4. Information we collect about our Customers (as responsible party)

At registration, we ask for your email address and basic business details. Everything else is generated as you set up and use the Service:

Category	Examples	When/how we get it
Account details	Name, email, business name, phone number	Provided by you at sign-up
Onboarding information	Business details, branding, content/assets you provide for your build (clause 3, Terms)	Provided by you during onboarding
Billing information	Subscription status and billing history	Generated as you use and pay for the Service
Payment provider credentials	Your Paystack/PayFast details, where applicable to your plan	Provided by you if you connect a payment gateway
Usage data	How you use the Platform, including AI Employee/Conversational AI usage volumes (clause 4.2, Terms)	Generated automatically as you use the Service
Support and communications	Records of support requests and correspondence	Whenever you contact us

We do not collect or store your full card or bank account number. Payment happens directly via Paystack/PayFast's own hosted flows.

5. Information we process on behalf of Customers (as operator)

When your leads or customers interact with your website, forms, campaigns, or AI Employee/Conversational AI features, the following categories of personal information may pass through our systems, on your instruction, solely to provide the Service to you:

· Name and contact details of your leads/customers (as captured via your forms, calls, or campaigns);

· The content of enquiries, messages, or conversations they have with your business through the Service, including with AI Employee/Conversational AI features;

· Interaction and engagement data (for example, that a review request was sent, or a call was missed and a text sent back).

Ellulo retains this data only for as long as needed to provide the Service to you, and to meet any legal/accounting retention obligation; see Section 10. We don't use it for our own marketing or analytics, and we don't sell it or license it to any third party.

6. Why we process personal information, and our lawful basis

Purpose	Category of information	Lawful basis (POPIA s11)
Creating and administering your account	Account/contact/billing information	Necessary to perform our contract with you
Billing and processing Subscription Fees	Billing/subscription information	Necessary to perform our contract with you
Onboarding and building your Services	Onboarding information	Necessary to perform our contract with you
Providing your website, campaigns, and AI Employee/Conversational AI features to your leads/customers	End-lead/customer data (Section 5)	Necessary to perform your contract with your own customer, carried out under your instruction as operator
Customer support	Support/communications records	Necessary to perform our contract with you; our legitimate interest in resolving issues
Improving and securing the Service	Usage/technical information	Our legitimate interest in maintaining a secure, functioning platform
Fraud and security monitoring	Account, billing, and usage information	Our legitimate interest in preventing fraud and abuse; compliance with legal obligations
Sending service and billing communications	Contact information	Necessary to perform our contract with you
Sending marketing communications	Contact information	Your consent, or the existing-customer exception in POPIA s69(3); see Section 13
Analytics and marketing measurement via cookies/pixels	Usage/behavioural data (Section 7)	Your consent, given via the cookie-consent banner
Complying with tax, accounting, and other legal obligations	Billing/account information	Compliance with a legal obligation

7. Cookies and tracking technologies

This site uses cookies and similar tracking technologies. We use:

· Essential cookies: needed for the site to function (for example, remembering your cookie preferences, keeping you logged in, and other session/security purposes). These can't be switched off, and may include functional cookies set automatically by our software platform provider (Section 8) as part of how the site and any forms or booking/chat tools on it work, not just cookies we set directly.

· Google Analytics: measures site usage and traffic (for example, which pages are visited and how visitors found us).

· Meta (Facebook/Instagram) Pixel: measures ad conversions and lets us build retargeting audiences for our own Meta ad campaigns.

When you first visit the site, a cookie banner lets you choose "Accept All" (allow Google Analytics and Meta Pixel), "Accept Essential" (allow only essential cookies), or "Customize" (choose exactly which non-essential cookies to allow, confirmed via "OK"), before any non-essential cookie loads. Declining non-essential cookies doesn't affect your ability to use the site; only essential cookies remain active. If you change your mind after choosing, clearing your cookies for this site and revisiting will show the banner again.

We don't use cookies or tracking technology to identify you individually beyond what's needed for the above purposes, and we don't sell data collected via cookies to third parties.

8. Who we share information with

We do not sell personal information. We share it only as follows. Each sub-processor below processes personal information only on our instruction, for the purpose stated, under a data processing agreement or equivalent contractual terms:

Provider	Role	What they process
Our software platform provider	Powers the underlying Platform the Service runs on	All categories described in Sections 4–5, as processed through the Platform
Paystack/PayFast	Payment service provider (where applicable to your plan)	Payment/card details, transaction data (collected directly by them, not by Ellulo)
AI and voice-processing service providers (hosted outside South Africa; see Section 9)	Power AI Employee/Conversational AI features	The content of enquiries/conversations handled by those features (Section 5)
Our email/SMS delivery provider	Sends service, billing, and (where opted in) marketing communications	Contact details, and the content of those communications
A cloud infrastructure provider	Hosts the Ellulo platform and database	All categories described in Sections 4–5, as stored/hosted
Google Analytics	Site usage/traffic analytics (Section 7)	Usage/behavioural data collected via cookies, where you've consented
Meta (Facebook/Instagram) Pixel	Ad conversion tracking and retargeting for our own campaigns (Section 7)	Usage/behavioural data collected via cookies, where you've consented

We share personal information with no one else, except: where required by law, regulation, or a valid order of a court, regulator, or law enforcement body; to protect the rights, property, or safety of Ellulo, our Customers, or others, including investigating suspected fraud; in connection with a merger, acquisition, or sale of business assets, subject to the recipient being bound by equivalent privacy commitments; or with your explicit consent, for any purpose not covered above.

9. Cross-border transfers of personal information

Some of the service providers we use, including our software platform provider, may store or process personal information outside South Africa. Our AI and voice-processing providers, which power AI Employee/Conversational AI features, are hosted outside South Africa. Personal information may more generally be processed or stored outside South Africa by Ellulo or by third-party service providers whose infrastructure sits outside our direct control. Where personal information is transferred outside South Africa, we take steps required by section 72 of POPIA to ensure it remains adequately protected, including only transferring to recipients bound by contractual terms that impose data protection obligations substantially similar to POPIA, or otherwise transferring on a lawful basis recognised by POPIA (for example, your consent, or because the transfer is necessary to perform our contract with you).

10. How long we keep personal information

We keep personal information only for as long as necessary for the purpose it was collected for, consistent with POPIA's retention limitation (section 14). Retention periods differ depending on the category of information and why we hold it:

Financial and billing records: retained for a minimum of 5 years (a legal requirement, not our choice). Invoices, payment confirmations, and transaction amounts/dates are retained for a minimum of 5 years from the end of the tax year in which the relevant transaction occurred, per section 29 of the Tax Administration Act 28 of 2011. Where a record becomes subject to a SARS audit, investigation, or dispute, we retain it for as long as that process remains open, even beyond 5 years.

Account and billing data Ellulo holds directly: retained for 12 months after cancellation, then deleted. Account details, business/billing information, and support correspondence that Ellulo holds in its own systems (separate from the Platform itself) are retained for as long as your subscription is active, and for 12 months after cancellation, to allow you to export your data or reactivate. After that, they're deleted or anonymised, unless a longer period is needed to resolve an ongoing dispute or complaint, or is otherwise required by law.

Content hosted on the Platform (including your website, campaigns, automations, and your leads'/customers' data processed as operator, Section 5) follows our software platform provider's own retention and deletion timelines, not the 12-month period above. Our software platform provider retains this content for a limited window after cancellation (currently up to 90 days) to allow reactivation, after which it's permanently and irretrievably deleted by that provider, without backup. This is outside Ellulo's control once it happens. Phone numbers and their associated registrations are deleted on a materially shorter timeline (currently around 14 days after cancellation), and billing for an active number may continue during that short window. If you want to keep this content, export or back it up yourself before cancelling, or during the reactivation window described above; don't rely on Ellulo or the Platform to preserve it indefinitely.

Marketing consent/opt-out records, if applicable, are retained even after you opt out, so that we can honour your opt-out and demonstrate compliance with section 69 of POPIA.

You can ask us to delete your data sooner than these periods at any time, by cancelling and contacting us (Section 15).

11. Security safeguards

We take reasonable technical and organisational measures, as required by section 19 of POPIA, to protect personal information against loss, unauthorised access, interference, or disclosure. All traffic to and from the Service is encrypted in transit (HTTPS/TLS), and sensitive credentials are encrypted at rest. We security-check our code and lock down interactions with the Platform as much as possible for it to function, and run external testing periodically to check for security issues. We restrict access to personal information to staff and service providers who need it to perform their role, and require our sub-processors (Section 8) to maintain equivalent security standards under contract.

No system is completely secure, and we cannot guarantee absolute security of information transmitted over the internet. If a security compromise occurs, we will respond in accordance with Section 14 below.

12. Your rights as a data subject

Under POPIA, you have the right to:

1. Be told what personal information we hold about you and why (this Policy, and on request);

2. Access the personal information we hold about you;

3. Request correction of personal information that is inaccurate, outdated, incomplete, or misleading;

4. Request deletion or destruction of personal information we no longer have authority to hold, subject to our legal retention obligations (Section 10);

5. Object, on reasonable grounds, to the processing of your personal information, including for direct marketing purposes;

6. Withdraw consent at any time, where processing is based on consent (this doesn't affect the lawfulness of processing before withdrawal);

7. Not be subject to a decision based solely on automated processing (including profiling) that would significantly affect you, without an opportunity to make representations. Ellulo does not itself make any such automated decisions about Customers. Where a Customer configures their own AI Employee/Conversational AI feature to make this kind of significant automated decision about one of their own leads or customers, that Customer, not Ellulo, is responsible for complying with this requirement in respect of that decision, consistent with their role as responsible party for their own leads'/customers' data (Section 2.2).

8. Complain to the Information Regulator if you believe your information has been processed unlawfully (contact details in Section 16).

To exercise any of these rights, contact us using the details in Section 17. We will respond within a reasonable time and, in any event, within the timeframes required by POPIA. We may need to verify your identity before acting on a request.

If you are a lead or customer of one of our Customers (Section 2.2 / Section 5), please direct data subject requests to that Customer in the first instance, as they are the responsible party for your information.

13. Direct marketing

Where we send you direct marketing by electronic means (email, SMS, or similar), we do so only in accordance with section 69 of POPIA: either because you have given prior opt-in consent, or because you are an existing Customer and the marketing relates to similar products or services, in which case every message will give you a clear, free way to opt out.

· SMS opt-out: reply "STOP" to any marketing SMS.

· Email opt-out: click "unsubscribe" in any marketing email.

Opting out of marketing communications doesn't affect service, billing, or account-related communications, which we send as part of performing our contract with you.

14. Data breach notification

If we become aware that personal information we're responsible for has been accessed or acquired by an unauthorised person, we will, in accordance with section 22 of POPIA: notify the Information Regulator as soon as reasonably possible after discovering the compromise; notify affected data subjects as soon as reasonably possible, in writing, with sufficient information to allow them to protect themselves against potential consequences; and, where a Customer's own lead/customer data is affected (Section 5), notify the affected Customer promptly so that they, as responsible party, can meet their own notification obligations.

15. Children's personal information

Ellulo's Service is intended for use by businesses and their authorised adult representatives, not by children. We do not knowingly collect personal information from children. Under POPIA, processing a child's personal information is generally prohibited unless a specific exception applies. If we become aware that we hold personal information about a child without an applicable lawful basis, we will delete it.

16. Information Officer and how to complain

Our Information Officer, as required by sections 55–56 of POPIA, is:

Ian Parker

Email: [email protected]

Phone: +27 60 019 5060

If you believe your personal information has been processed unlawfully, you may lodge a complaint with:

The Information Regulator (South Africa)

Email: [email protected]

Website: inforegulator.org.za

We'd appreciate the chance to resolve any concern directly first; contact us using the details in Section 17.

17. PAIA manual

Section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended by POPIA) requires every responsible party to make available a manual describing the categories of records it holds and how to request access to them. Ellulo's PAIA manual is being prepared and will be made available here once complete. In the meantime, you can request information about the records we hold using the contact details below.

18. Changes to this policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. We'll update the "Last updated" date above, and where a change is material, we'll take reasonable steps to notify Customers before it takes effect.