Privacy Policy & Data Protection Notice

1. Introduction & Commitment to POPIA

Grace Pump Services (Pty) Ltd (Registration No: in process, hereinafter referred to as "Grace Pumps", "we", "us", or "our") respects your privacy and is committed to protecting personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") and the Promotion of Access to Information Act, No. 2 of 2000 ("PAIA").

This Privacy Policy explains how we collect, store, process, transfer, and protect personal and commercial information collected via our website, interactive AI diagnostic intake, email correspondence, WhatsApp communication channels, and commercial engineering service agreements.

2. Designation of Information Officer

In accordance with Section 55(1) of POPIA, Grace Pump Services (Pty) Ltd has designated an Information Officer responsible for overseeing compliance with South African data privacy legislation:

3. Categories of Information We Collect

We process personal and corporate information strictly necessary for commercial pump procurement, maintenance engineering, and emergency breakdown dispatch:

• Contact & Identification Data: Full name, corporate title, company name, VAT/registration numbers, business email address, physical delivery address, and direct telephone/WhatsApp numbers.
• Technical Engineering Data: Fluid characteristics (viscosity, specific gravity, pH levels, slurry concentration), operating flow rates (m³/h), total dynamic head (metres), motor voltage requirements (380V / 400V / 525V), and existing pump nameplate specifications.
• Site & Geolocation Data: Mining site, agricultural farm, municipal plant, or factory physical coordinates required for technician field dispatch.
• Digital Telemetry, Analytics & Advertising Identifiers: Anonymised IP addresses, browser types, operating systems, session timestamps, device identifiers, referral URLs, interaction telemetry (such as pump sizing steps completed, quotation requests, vCard downloads, and WhatsApp button clicks), and advertising identifiers tracked via Google Analytics 4, Meta Pixel, and Microsoft Clarity.

4. Lawful Basis and Purpose for Processing

Under Section 11 of POPIA, we process information strictly under the following lawful grounds:

1. Performance of a Contract / Request for Quotation (RFQ): Processing technical and contact details to generate validated pump quotations, supply equipment, and perform laser alignment or pump overhaul SLAs.
2. Emergency Field Breakdown Assistance: Facilitating rapid mobile dispatch of field engineering teams to prevent industrial flooding, mine pit stoppage, or plant downtime.
3. Statutory Tax Compliance: Fulfilling our 5-year commercial invoice and audit record obligations under the South African Tax Administration Act and Companies Act.
4. Legitimate Commercial Interests & Network Security: Ensuring cybersecurity, monitoring digital infrastructure uptime, preventing fraudulent quote submissions, and maintaining system integrity.
5. Marketing Telemetry, Analytics & Ad Measurement: Measuring the performance of commercial advertising campaigns, evaluating return on ad spend (ROAS), analysing industrial procurement trends, and delivering relevant engineering solutions to business decision-makers.

5. AI Diagnostic Intake & WhatsApp Handshake Protocol

Our website features an interactive AI Diagnostic Intake Engine and a 3-Step Smart Pump Sizing Wizard. When you interact with these tools:

• Technical prompt data is processed in real time to generate pump recommendations and preliminary sizing calculations.
• When you opt to "Transfer to WhatsApp", the preliminary diagnostic summary is formatted into a pre-filled message sent directly to our official business WhatsApp line (+27 64 537 2381) or Managing Director line (+27 61 504 4117).
• This action represents an affirmative, user-consented inbound enquiry under Section 69 of POPIA. We do not engage in unsolicited electronic direct marketing or automated spam.

6. Information Security & Data Safeguards

Grace Pump Services (Pty) Ltd implements military-grade organisational and technical measures in compliance with Section 19 of POPIA:

• Transport Layer Security (TLS/HTTPS): All web sessions, AI API requests, and web form submissions are encrypted using 256-bit SSL/TLS encryption.
• Grade A+ HTTP Security Headers: Strict Content Security Policy (CSP), anti-clickjacking X-Frame-Options: DENY, and Strict-Transport-Security (HSTS) are enforced at the edge network.
• Access Control: Only authorised engineering and administrative personnel with role-based access permissions handle client procurement records.

7. Cross-Border Data Transfers

Our web infrastructure utilises edge hosting CDNs (Netlify/Cloudflare) and serverless AI processing providers. In accordance with Section 72 of POPIA, all cross-border infrastructure partners adhere to rigorous international data protection standards (GDPR / ISO 27001) that offer an adequate level of data protection substantially similar to POPIA.

8. Your Rights as a Data Subject

Under Chapter 3 of POPIA, you hold the following statutory rights regarding your personal information:

• Right of Access (Section 23): You may request confirmation of whether we hold personal information regarding you or your organisation, and receive a copy thereof.
• Right to Rectification & Deletion (Section 24): You may request the correction, updating, or deletion of inaccurate, irrelevant, excessive, or unlawfully retained personal data.
• Right to Object (Section 11(3)): You may object at any time to the processing of your personal information on reasonable grounds relating to your particular situation.
• Right to Lodge a Complaint: If you believe your data protection rights have been infringed, you have the right to lodge a formal complaint with the South African Information Regulator:

  The Information Regulator (South Africa)

  JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

  Email: complaints.IR@justice.gov.za / inforeg@justice.gov.za

  Website: https://inforegulator.org.za

9. Cookies, Analytics & Advertising Telemetry (Google Analytics, Meta Pixel & Microsoft Clarity)

To continuously optimise our digital infrastructure, deliver tailored industrial engineering solutions, and understand client procurement behaviour, Grace Pump Services (Pty) Ltd deploys first-party and authorised third-party telemetry tools:

• Google Analytics 4 (GA4 — Google LLC): We utilise Google Analytics to collect aggregated, anonymised telemetry on website traffic volume, visitor geographical regions (e.g., Gauteng, Mpumalanga, Free State), high-demand pump categories, page loading speeds, and user navigation journeys. This data enables us to optimise infrastructure performance and streamline quotation workflows. IP anonymisation is enforced by default.
• Meta Pixel (Meta Platforms Ireland Ltd / Meta Platforms Inc.): We utilise the Meta Pixel to track conversion events (such as completed pump sizer consultations, quotation submissions, and direct WhatsApp enquiries) originating from commercial advertisements on Meta platforms (Facebook, Instagram). This allows us to measure campaign efficacy, assess return on advertising spend (ROAS), build custom audience cohorts of industrial engineers and procurement managers, and deliver relevant engineering equipment updates to qualified business audiences.
• Microsoft Clarity (Microsoft Corporation): We utilise Microsoft Clarity to capture behavioural metrics, visual click/tap heatmaps, scrolling depth, and session replay telemetry. This telemetry helps us diagnose user interface bottlenecks, verify mobile responsiveness across field devices, and enhance the usability of our pump sizing tools. Clarity masks all sensitive input fields to safeguard personal privacy.
• Cookie Preferences & Opt-Out Mechanisms:

  You retain complete control over your telemetry preferences:

  • Browser Settings: You may configure your web browser to block, delete, or alert you to third-party cookies. Disabling cookies will not affect your ability to request pump sizing or contact our engineering team.
  • Google Analytics Opt-Out: You may install the official Google Analytics Opt-Out Browser Add-on.
  • Meta Ad Preferences: You can manage how your data is used for advertising personalisation via your Meta Ad Settings.
  • Industry Opt-Out Portals: You may opt out of participating behavioural advertising networks via the Digital Advertising Alliance (DAA) or Your Online Choices.

10. Revisions to this Privacy Policy

Grace Pump Services (Pty) Ltd reserves the right to amend this Privacy Policy to reflect changes in legal, regulatory, or technical operating standards. Any updates will be published on this page with an amended effective date.