Privacy Policy

This Privacy Policy explains how Elastic Bean Software ("Elastic Bean", "we", "us" or "our") collects, uses, shares and protects personal information when you visit elasticbean.com, www.elasticbean.com or any related sub-domain (the "Website"), or when you contact us or request early access to our products.

We are committed to protecting your privacy and to processing your personal information lawfully, fairly and transparently. Because our Website is available to and used by visitors in Europe, this Policy is designed to meet the requirements of both the Protection of Personal Information Act 4 of 2013 ("POPIA") of South Africa and the EU/UK General Data Protection Regulation ("GDPR").

1. Who we are (Responsible Party)

For the purposes of POPIA, Elastic Bean is the Responsible Party. For the purposes of the GDPR, we are the Data Controller.

Our Information Officer is registered with the Information Regulator of South Africa and is responsible for ensuring our compliance with POPIA.

1.1 Our EU establishment

Elastic Bean Software is also established in the European Union. Our EU entity acts as the controller for personal information of individuals in the EU/UK and can be contacted on all data-protection matters:

2. The personal information we collect

We aim to collect the minimum personal information necessary for the purpose at hand. Depending on how you interact with us, we may collect:

2.1 Information you give us directly

• —Early-access requests: your name, work email address, company or organisation name, job title or role, and any message or context you choose to provide.
• —Contact form submissions: your name, email address, the subject of your enquiry and the content of your message.
• —Email correspondence: any information you include when you email us directly.

2.2 Information we collect automatically

When you visit the Website, we and our service providers may collect:

• —Technical and usage data: your IP address, browser type and version, device and operating system, referring pages, the pages you view, and the dates and times of your visits. This is collected through Microsoft Azure Application Insights for performance monitoring, diagnostics and security.
• —Anti-abuse data: when you submit a form, Cloudflare Turnstile processes limited technical signals to distinguish genuine visitors from automated abuse. We do not use this for tracking or advertising.

We do not intentionally collect special categories of personal information (such as health, religious or biometric data) or the personal information of children through this Website. Please do not submit such information to us.

3. How and why we use your personal information

We process your personal information for the following purposes, on the following lawful bases:

We will only use your personal information for the purpose for which it was collected, unless we reasonably consider that we need to use it for a related and compatible purpose. We do not sell your personal information, and we do not use it for third-party advertising.

4. Who we share your personal information with

We share personal information only with trusted service providers (in POPIA terms, Operators) who process it on our behalf under contractual confidentiality and security obligations. These currently include:

• —Microsoft Azure — hosting, serverless functions (including our own email-sending function) and application monitoring.
• —Email hosting / SMTP provider — delivery of outbound email. We do not use a third-party email-marketing platform; emails are sent by our own application code through our email provider's mail servers.
• —Cloudflare — bot protection and CAPTCHA (Turnstile).

We may also disclose personal information where required to do so by law, by a competent regulator or court, or to protect our rights, property or safety, or those of others.

We do not otherwise disclose your personal information to third parties for their own purposes.

5. Cross-border transfers

Because we operate from South Africa and serve visitors in Europe, your personal information may be transferred to, stored in, or processed in a country other than the one in which you are located — including South Africa, the European Union, and (in the case of certain global service providers such as Cloudflare and Microsoft Azure) other jurisdictions.

Where we transfer personal information:

• —out of South Africa, we comply with Section 72 of POPIA; and
• —out of the European Economic Area (EEA) or the United Kingdom, we ensure that an appropriate safeguard is in place — such as an adequacy decision, the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement / Addendum, or another lawful transfer mechanism.

If you would like more information about the safeguards we use, or a copy of the relevant mechanism, please contact us at privacy@elasticbean.com.

6. How long we keep your information

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including to satisfy any legal, accounting or reporting requirements.

• —Early-access requests are retained until our products launch and you are onboarded or notified, or until you ask us to remove your details — whichever is sooner.
• —Contact enquiries are retained for as long as needed to handle your request and for a reasonable period afterwards for our records.
• —Technical and log data is retained for a limited period for security and diagnostic purposes.

When personal information is no longer needed, we will securely delete or de-identify it.

7. How we protect your information

We maintain appropriate, reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration or disclosure. These include encrypted connections (HTTPS), managed secret storage (Azure Key Vault), access controls and continuous monitoring.

While we take security seriously, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

If a data breach affecting your personal information occurs, we will notify the Information Regulator and affected data subjects as required by law.

8. Your rights

Subject to applicable law, you have the right to:

• —Access the personal information we hold about you;
• —Correct or update inaccurate or incomplete information;
• —Request deletion of your information where there is no legal basis to retain it;
• —Object to the processing of your information in certain circumstances;
• —Withdraw consent at any time, where processing is based on consent;
• —Lodge a complaint with a supervisory authority (see Section 11).

Under the GDPR, you may also have the right to restrict processing and to data portability.

To exercise any of these rights, please contact us at privacy@elasticbean.com. We will respond within the timeframes required by law. We may need to verify your identity before acting on your request.

9. Cookies and similar technologies

The Website uses a limited number of cookies and similar technologies that are necessary for it to function securely and to help us understand how it is used. These include:

• —Strictly necessary cookies and signals required for security, abuse prevention (Cloudflare Turnstile) and core functionality.
• —Performance and diagnostic signals collected via Azure Application Insights to monitor reliability and improve the Website.

We do not use advertising or cross-site tracking cookies. You can control or delete cookies through your browser settings; disabling necessary cookies may affect how the Website works.

10. Children's privacy

The Website is intended for business users and is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

11. Complaints

If you have a concern about how we handle your personal information, please contact our Information Officer first at privacy@elasticbean.com so we can try to resolve it.

You also have the right to complain to the relevant supervisory authority:

If you are located in the EU/UK, you may instead contact your local data protection authority.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology or legal requirements. The "Last updated" date at the top indicates when it was last revised. Material changes will be communicated through the Website. We encourage you to review this Policy periodically.

13. Contact us

For any questions about this Policy or your personal information:

This document is a template provided for convenience and does not constitute legal advice. We recommend that it be reviewed by a qualified South African legal practitioner before publication.