Privacy Policy.

01Who we are

KAGO is a brand of Kutlwano Holdings ("KAGO", "we", "us" or "our"). We build custom, funding-ready business packs - business plans, financial models, branding and, where requested, company registration - for South African entrepreneurs, and we deliver them digitally.

For the purposes of POPIA, Kutlwano Holdings is the responsible party that determines why and how your personal information is processed. We are committed to processing your personal information lawfully, fairly and transparently.

Information Officer. POPIA requires every responsible party to have an Information Officer who is accountable for compliance, and that role defaults to the head of the business. Our Information Officer is the owner of KAGO (Kutlwano Holdings), contactable at [email protected]. The Information Officer is registered with the Information Regulator (or is in the course of being registered) through the Regulator's portal at inforegulator.org.za/portal. You can reach the Information Officer using the details in section 13.

02What personal information we collect, and when

We only collect the personal information we need to answer your enquiry, build your pack, take payment and deliver your files. Most of it you give us yourself, over WhatsApp, on our website enquiry form, or in the short intake step after you pay.

The identity number and address collected for company registration are more sensitive than ordinary contact details. We collect them only when you choose the registration add-on, we use them only to file your registration with CIPC, and we take extra care to keep them secure.

03Why we collect it

We collect and use your personal information for clear, specific purposes:

• To respond to your enquiry and give you a quote, sample work and advice on the right item for you.
• To build your pack - your business plan, financial model, branding and any other item you buy - in your company name and on your brand.
• To register your company at CIPC, but only if you buy the company-registration add-on.
• To take payment for your order through our payment gateway.
• To deliver your work to you by a secure link and to provide the one included revision round and any support you need.
• To keep proper records of the work we have done and to meet our legal, tax and accounting obligations.
• To keep our website and service secure and to prevent fraud and abuse.

We do not use your information for purposes that are unrelated to the service you asked for. If we ever wanted to use it for something new, we would ask you first.

04Our lawful basis for processing

POPIA requires us to have a lawful basis for processing your personal information. Depending on the situation, we rely on:

• Performance of a contract - to build and deliver the pack you have ordered, and to register your company where you have bought that add-on.
• Your consent - for example, when you tick the consent box on our enquiry form so that we may contact you about your enquiry. You can withdraw consent at any time (see section 9).
• Compliance with a legal obligation - such as keeping invoicing and tax records.
• Our legitimate interests - such as keeping our service secure and preventing fraud, provided these do not override your rights.

We do not sell your personal information, and we do not add you to unrelated marketing lists without your consent.

05Who we share it with

We share your personal information only where it is needed to deliver what you have asked for. We share it with:

• CIPC (the Companies and Intellectual Property Commission) - only if you buy company registration. We submit the director's identity number and address to CIPC to register your company, as the law requires.
• The tools we use to build and deliver your pack - the software and service providers (operators, in POPIA terms) that help us produce your documents, design your logo and host the secure delivery link. These providers act on our instructions and are bound to keep your information confidential and secure.
• Google, but only for website measurement, and only if you accept analytics on the bar that appears on your first visit. Google receives which pages were viewed and a shortened IP address. It never receives your name, email address, phone number, business name or anything you type into a form. See section 10.
• Professional advisers and authorities - such as our accountants or auditors, or a public body, where we are required to share information by law or to protect our legal rights.

We do not sell, rent or trade your personal information to anyone. Where a provider processes personal information on our behalf, we require them, by contract, to process it only for our purposes and to apply appropriate security safeguards, as POPIA requires.

06Cross-border transfers

Some of the tools and service providers we use to build, host and deliver your pack may store or process information on servers outside South Africa. Where this happens, POPIA allows the transfer only where the recipient is subject to a law, binding rules or a contract that provides an adequate level of protection comparable to POPIA, or where the transfer is necessary to perform our contract with you.

We take reasonable steps to ensure that any provider we use who processes your information abroad protects it to a standard consistent with this policy and with POPIA.

The clearest example is Google Analytics, described in section 10, which processes website measurement data on Google's servers outside South Africa. This only happens if you accept analytics, it never includes your name, contact details or anything you type, and Google acts on our instructions under its data processing terms.

07How we protect your information

We take the security of your personal information seriously and apply reasonable technical and organisational measures to protect it against loss, unauthorised access, and misuse. These include:

• Delivering your finished files by a secure link rather than by open email attachments.
• Collecting only the information needed to respond to your enquiry, confirm your order and deliver your pack.
• Limiting access to your information to the people and providers who need it to do the work.
• Applying extra care to more sensitive data, such as a director's identity number collected for company registration.

No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security. If a security compromise ever affected your personal information, we would act to contain it and would notify you and the Information Regulator where POPIA requires us to.

08How long we keep it

We keep your personal information only for as long as we need it for the purposes set out in this policy, and then for as long as the law requires us to keep certain records.

• Enquiry information - kept for a reasonable period so we can follow up on your enquiry, then deleted if it does not become an order.
• Order and delivery records - kept for the duration of the project and afterwards so we can support you and honour the work.
• Invoicing and financial records - kept for 5 years, in line with South African tax and company law requirements.
• Company-registration data - kept only as long as needed to complete and evidence the CIPC filing, and as the law requires.

09Your rights under POPIA

As a data subject, POPIA gives you the following rights over your personal information. You can exercise any of these by contacting us using the details in section 13:

• Access - to ask what personal information we hold about you and to request a copy of it.
• Correction - to ask us to correct information that is inaccurate, out of date or incomplete.
• Deletion - to ask us to delete or destroy information we no longer have a lawful reason to keep.
• Objection - to object, on reasonable grounds, to our processing of your information.
• Withdraw consent - to withdraw consent you previously gave, without affecting processing already carried out.
• Complain - to lodge a complaint with the Information Regulator (see section 13) if you believe we have not handled your information properly.

We will respond to your request as required by POPIA. We may need to verify your identity before acting on a request, to protect your information.

10Cookies and analytics

We want to know which pages on this website are actually useful to business owners, so we can write more of what helps and stop wasting your data on what does not. To do that we use Google Analytics 4, a measurement tool run by Google. It is the only analytics tool on this site, and there is no advertising or tracking tool of any other kind.

Nothing happens until you say yes

Where analytics is switched on, a small bar appears at the bottom of the screen on your first visit, asking whether we may count your visit. Until you press Accept, nothing is loaded from Google, no analytics cookie is placed on your device, and nothing about your visit is sent anywhere. If you press No thanks, or simply ignore the bar, that stays true. We remember your answer on your own device so we do not ask again.

If you change your mind later, clear this site's data in your browser settings and the question will be asked again.

What Google Analytics sees, if you accept

• Which pages you looked at, and in what order.
• Roughly where in the world you are, your device type and your browser. Your IP address is shortened before it is stored, so it does not point at you.
• Four simple actions, recorded as a count with no other information attached: opening our price menu, starting the enquiry form, sending the enquiry form, and tapping a WhatsApp link.

What it never sees

We never send your name, email address, phone number, business name, or anything you type into a form to Google Analytics. Not in a page view, not in an action, not in any form. The enquiry you send us goes to KAGO and to nobody else. The actions above are counted as bare numbers, so Analytics can tell us "eleven people started the form on this page" but can never tell us, or Google, who they were.

We have also switched off Google Signals and ads personalisation, so your activity on this site is not linked to your Google account and is not used to advertise to you anywhere.

Your control

Most browsers also let you control or block cookies through their settings, and you can install Google's own Analytics opt-out add-on. Blocking analytics does not affect any part of this website, and it does not affect a pack you have bought.

11Children

Our service is intended for business owners and is not directed at children. We do not knowingly collect the personal information of a child without the consent of a competent person. If you believe a child has given us personal information, please contact us and we will take appropriate steps to delete it.

12Changes to this policy

We may update this policy from time to time to reflect changes in our service, our providers or the law. When we do, we will change the "last updated" date at the top of this page. Where the change is significant, we will take reasonable steps to bring it to your attention.

13How to contact us, and the Information Regulator

If you have any questions about this policy, or you want to exercise any of your rights, please contact us:

The Information Regulator (South Africa)

You also have the right to complain to the Information Regulator, which oversees POPIA. We would appreciate the chance to address your concern first, but you may contact the Regulator directly at any time:

This policy reflects how KAGO handles your personal information under the Protection of Personal Information Act, 2013 (POPIA), and is written in plain language. The only item still to be filled in is the registered address, marked Dobsonville, Soweto, Gauteng, South Africa.