Privacy Policy

This Privacy Policy applies to every person whose personal information is processed by Brunavo Reputation Advisory (Pty) Ltd, trading as Brunavo, through the website brunavo.digital, including visitors who use the contact form and persons who subscribe to the email subscription. It is issued in terms of the Protection of Personal Information Act 4 of 2013 (POPIA) and takes effect on 1 January 2026.

Effective date: 1 January 2026

1. Scope and Application

1.1 This Policy governs the processing of personal information by Brunavo Reputation Advisory (Pty) Ltd ("Brunavo", "we", "us") in connection with its services, being the monitoring, management and improvement of the reputation of persons and organisations in artificial intelligence systems and in the media, together with the related advisory services offered through brunavo.digital.

1.2 This Policy applies to personal information collected through two channels on the website: (a) the contact form; and (b) the email subscription. It also applies to technical information collected automatically when the website is visited.

1.3 By submitting information through the website, the data subject acknowledges that he or she has read this Policy. Where consent is required by law, it is requested separately at the point of collection.

2. Responsible Party and Information Officer

2.1 The responsible party, as defined in POPIA, is Brunavo Reputation Advisory (Pty) Ltd ((Pty) Ltd), registration number 8498533496, of 14 Lagoon Drive, Umhlanga Rocks, 4320 Durban, South Africa.

2.2 Enquiries, requests and complaints relating to this Policy may be directed to the Information Officer at [email protected] or on +27 31 458 6629.

3. Personal Information Collected

3.1 Contact form. When a person completes the contact form to enquire about reputation services, we collect the name, email address, telephone number (where supplied), company or organisation name (where supplied), and the content of the message. A message may describe a reputational concern, and the sender is requested not to include special personal information, such as health, religious belief, or criminal behaviour data, unless it is necessary for the enquiry.

3.2 Email subscription. When a person subscribes to our email updates, we collect the email address and, where requested, the name. We also record the date and time of subscription, the confirmation of the subscription, and later interaction data such as unsubscribe actions and, where enabled, whether messages were opened.

3.3 Technical information. Our servers and the cookies described in our Cookie Policy record IP address, browser type, device type, pages visited and referring page.

3.4 Providing information is voluntary. Without the information marked as required, however, we cannot respond to an enquiry or deliver the subscription.

4. Purposes and Lawful Justification

4.1 Contact form information is processed to respond to the enquiry, to prepare proposals, and to take steps at the request of the data subject before concluding a contract. The justification is section 11(1)(b) of POPIA (necessary for contractual steps) and our legitimate interests under section 11(1)(f).

4.2 Email subscription information is processed to send newsletters and updates on reputation in AI and media. The justification is the consent of the data subject under section 11(1)(a) and section 69 of POPIA governing direct electronic marketing. Consent may be withdrawn at any time.

4.3 Technical information is processed to secure and operate the website and, where the data subject has consented to analytics cookies, to understand and improve its use.

4.4 Information is also processed where necessary to comply with legal obligations, such as tax and record-keeping duties, and to establish, exercise or defend legal claims.

4.5 Personal information is not used for purposes incompatible with those stated above, and is not sold.

5. Direct Marketing

5.1 We send electronic marketing only to persons who have subscribed, or to existing customers in respect of similar services, who were given an opportunity to object when the information was collected.

5.2 Every email contains a working unsubscribe link. An unsubscribe request is effected promptly, and the address is thereafter kept on a suppression list to prevent further messages.

6. Disclosure to Operators and Third Parties

6.1 We engage operators to process information on our behalf under written agreements requiring confidentiality and appropriate security safeguards, as required by sections 20 and 21 of POPIA. These include website hosting providers, email delivery and newsletter platforms, and email and office productivity providers.

6.2 Information is disclosed to professional advisers, or to regulators and courts, only where required by law or necessary to protect legal rights.

7. Hosting and Cross-Border Transfers

7.1 The website and associated systems may be hosted, and email services may be provided, by operators with servers outside South Africa.

7.2 Information is transferred outside South Africa only in accordance with section 72 of POPIA, namely where the recipient is subject to law, binding rules or an agreement providing substantially similar protection, where the data subject consents, or where the transfer is otherwise permitted by that section.

8. Cookies

8.1 The website uses cookies in three categories: necessary, analytics and marketing. Necessary cookies are always active. Analytics and marketing cookies are set only after consent is given through the cookie banner. Details are set out in our Cookie Policy.

9. Security Safeguards

9.1 We maintain reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, and unlawful access to personal information, including encrypted connections (HTTPS), access controls, and confidentiality obligations on personnel.

9.2 If reasonable grounds exist to believe that personal information has been accessed or acquired by an unauthorised person, we shall notify the Information Regulator and the affected data subjects as soon as reasonably possible, as required by section 22 of POPIA.

10. Retention

10.1 Personal information is kept only for as long as necessary to achieve the purpose for which it was collected, unless a longer period is required or authorised by law or consented to by the data subject. Thereafter it is deleted or de-identified.

10.2 The following periods apply:

11. Rights of Data Subjects

11.1 Under POPIA, a data subject has the right to: (a) be notified that personal information is being collected; (b) request confirmation of whether we hold information about him or her, and access to that information (section 23); (c) request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24); (d) object to processing on reasonable grounds (section 11(3)); (e) object at any time to processing for direct marketing (section 11(3)(b)); (f) withdraw consent, without affecting processing already done; and (g) not be subject to a decision based solely on automated processing which has legal consequences for him or her (section 71).

11.2 To exercise a right, a request must be sent to [email protected] with sufficient detail and proof of identity. We respond within a reasonable time, and in any event within thirty days where practicable. A prescribed fee may be charged for access requests where the law permits.

12. Complaints

12.1 A data subject who is dissatisfied with our handling of personal information is requested first to contact us so that the matter may be resolved.

12.2 A data subject may also lodge a complaint with the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email: [email protected]; website: www.inforegulator.org.za.

13. Children

13.1 The website and services are directed at adults and businesses. We do not knowingly collect personal information of children (persons under 18) without the consent of a competent person.

14. Changes to this Policy

14.1 We may amend this Policy from time to time. The amended version is published on brunavo.digital with a revised effective date, and material changes affecting subscribers will be communicated where required.

Contact Details