Privacy policy.
This policy explains what personal information we collect, why we collect it, how long we keep it and what your rights are under the Protection of Personal Information Act 4 of 2013 (POPIA).
Who we are
Xee Works is a trading name of Xee Holdings (Pty) Ltd (registration 2021/435618/07), the responsible party for personal information collected through this website, the client portal and our invoicing. Our information officer is Xien Singh. Reach the information officer through our contact page, marking your message "Privacy", or by post at 160 Belmont Road, Durban North, 4051.
What we collect, and why
| Information | Why we collect it | Lawful basis (POPIA s11) | How long we keep it |
|---|---|---|---|
| Name, email, phone, company, rough budget and message from the contact form | To answer your enquiry | Our legitimate interest in answering you | 24 months after the conversation closes, unless you become a client |
| Client contact details (name, email, phone, role) | To run our contract with your company: invoices, sign-offs, support | Contract | 7 years after your company's last invoice |
| Portal account (name, email, sign-in records, passkeys) | To let you sign in securely | Contract | Until the account is closed, then 30 days |
| Sign-off evidence: the name you type, the statement you agree to, the time, your IP address and the fingerprint of what you approved | Evidence of what was agreed | Contract | 7 years |
| Electronic document signatures (the same evidence) | Evidence of what was signed | Contract | 7 years |
| Support conversations | To help you and keep a record of what was done | Legitimate interest | 24 months after the conversation closes |
| Payment notifications from Payfast (payer name, email, amount, the sending address) | To match your payment to your invoice | Contract | 90 days |
| Records of emails we send you, including their content | Proof that we sent invoices and notices | Legitimate interest | 12 months; password-reset and invitation links are never stored |
| Web server logs (IP address, page requested, time, browser) | Security and fixing faults | Legitimate interest | 90 days |
| Backups of the database | To recover from a failure | Legitimate interest | 14 days, then overwritten |
We do not collect special personal information or information about children, and we do not buy or sell personal information. We do not send marketing email.
Cookies
We use only cookies the site needs to work, so there is nothing to opt in to:
- Sign-in (
xw.auth): keeps you signed in to the portal or back office. Ends when you sign out or after a period without use. - Two-step sign-in (
.AspNetCore.Identity.TwoFactorUserId): remembers, for a few minutes, that you got your password right while you enter your one-time code. - Form protection (
xw.af): protects forms against forgery from other sites. - Messages (
.AspNetCore.Mvc.CookieTempDataProvider): carries a one-line message such as "Saved" from one page to the next, then is deleted.
We use no advertising, analytics or tracking cookies.
Who processes information for us (operators, POPIA s20 and s21)
- HostAfrica, in South Africa, hosts the server that runs the website, the portal and their database.
- Our email server (xeeholdings.co.za) sends invoices, notices and replies.
- Payfast processes card and instant-EFT payments. We never see or store your card details.
- Anthropic, an AI provider in the United States, for three things only: drafting replies to messages people send us, the weekly summary of business figures the partners send each other, and a writing helper partners use to tighten their own text. A partner reads, edits and sends every reply; nothing is sent automatically. We never send special personal information or information about children.
Each operator is bound by a written agreement to keep the information confidential and secure and to use it only for what we ask.
Information sent outside South Africa (POPIA s72)
When a partner uses the drafting or writing tools above, the text involved, which may include a name and the message, is sent to Anthropic in the United States. We do this under s72(1)(a): Anthropic is bound by a binding agreement that gives an adequate level of protection, upholding principles for reasonable processing that are substantially similar to POPIA's conditions, including not using what we send to train its models, and that has provisions substantially similar to POPIA's on further transfers to third countries.
How we protect it
Access to the back office needs a passkey or a password with a one-time code. Everything travels over HTTPS. Files are checked when they are uploaded and fingerprinted so that any change can be detected. Backups are encrypted. We record who did what in an audit log that holds no personal values. If we believe personal information has been accessed without authority, we will tell the Information Regulator and the people affected as soon as reasonably possible (POPIA s22).
Your rights
You may ask whether we hold personal information about you and what it is, ask us to correct or delete it, object to us processing it, or withdraw consent where consent was the basis. Contact the information officer through the contact page. You may use the Information Regulator's forms if you prefer: Form 1 to object to processing and Form 2 to ask for correction or deletion (POPIA regulations). We will answer within 30 days.
If you are not satisfied, you may complain to the Information Regulator using its Form 5: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; inforegulator.org.za; complaints: POPIAComplaints@inforegulator.org.za; general enquiries: enquiries@inforegulator.org.za, 010 023 5200.
Changes
We will update the date below when this policy changes. Last updated 14 November 2026.