Privacy Policy

Effective date: March 17, 2026

1. Introduction

Astrium Connect ("we", "us", or "our") is a multi-channel messaging platform operated by Astrium Software Solutions CC, a close corporation registered in the Republic of South Africa. We are committed to protecting your personal information and processing it lawfully in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA").

This Privacy Policy applies to all account holders who register for and use the Astrium Connect platform. It does not apply to end-user chat participants who communicate with our account holders via WhatsApp, Telegram, or Webchat — the processing of their personal information is the responsibility of the respective account holder as the responsible party.

2. Responsible Party

The responsible party for the processing of your personal information, as defined under POPIA, is:

3. Personal Information We Collect

When you register for and use Astrium Connect, we may collect the following categories of personal information:

• Account information: your full name, email address, and password (stored in hashed form).
• Workspace details: organisation name and workspace configuration settings.
• Billing information: subscription plan selection and payment history (payment card details are processed by our third-party payment provider and are never stored on our servers).
• Channel credentials: WhatsApp Business API tokens, Telegram Bot API tokens, and related configuration data required to connect your messaging channels.
• Usage data: message volumes, feature usage statistics, and platform interaction logs used to deliver and improve the service.
• Technical data: IP address, browser type, and device information collected automatically when you access the platform.

4. Purpose of Processing

We process your personal information for the following purposes, as permitted under POPIA section 11:

• To create and manage your account and workspace.
• To provide, maintain, and improve the Astrium Connect platform and its features.
• To process subscription billing and payments.
• To communicate with you about your account, service updates, and support requests.
• To ensure the security and integrity of the platform.
• To comply with legal obligations under South African law.

5. Legal Basis for Processing

We process your personal information on the following legal grounds as provided for by POPIA:

• Consent: by accepting this Privacy Policy during registration, you consent to the processing of your personal information as described herein (POPIA section 11(1)(a)).
• Contract: processing is necessary to perform our obligations under the service agreement between you and Astrium Software Solutions CC (POPIA section 11(1)(b)).
• Legal obligation: processing is necessary to comply with applicable South African laws and regulations (POPIA section 11(1)(c)).

6. Cookies and Similar Technologies

Astrium Connect uses only essential cookies that are strictly necessary for the operation of the platform. These include:

• Authentication cookies: to keep you securely logged in to your account session.
• Security cookies: to protect against cross-site request forgery and other security threats.

We do not use any third-party analytics, advertising, or tracking cookies.

7. Third-Party Service Providers

We may share your personal information with the following categories of third-party service providers, solely to deliver the Astrium Connect service:

• Cloud hosting providers: for secure data storage and platform infrastructure.
• Payment processors: to handle subscription billing securely. Payment card details are processed directly by the payment provider and are not stored by Astrium.
• Messaging platform APIs: WhatsApp (Meta) and Telegram, as required to deliver messages on your behalf.
• AI service providers: OpenAI and Anthropic, when you enable AI bot agents. Message content is sent to these providers for processing in accordance with their respective data handling policies.

All third-party providers are contractually required to process personal information only for the purposes we specify and in accordance with applicable data protection standards.

8. Cross-Border Data Transfers

Some of our third-party service providers may process data outside of South Africa. In such cases, we ensure that adequate safeguards are in place in accordance with POPIA section 72, including confirming that the recipient country has adequate data protection legislation or that appropriate contractual protections are in place.

9. Data Retention

We retain your personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. When you close your account, we will delete or anonymise your personal information within 90 days, except where retention is required for legal, audit, or regulatory purposes.

10. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• Right of access: you may request confirmation of whether we hold your personal information and request a copy of it.
• Right to correction: you may request that we correct or update inaccurate or incomplete personal information.
• Right to deletion: you may request that we delete your personal information where it is no longer necessary for the purpose for which it was collected.
• Right to object: you may object to the processing of your personal information on reasonable grounds.
• Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at privacy@astrium.co.za. We will respond to your request within 30 days as required by POPIA.

11. Security Measures

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, destruction, or damage. These measures include encryption of data in transit and at rest, secure password hashing, role-based access controls, and regular security reviews.

12. Complaints

If you believe that we have processed your personal information in a manner that is not consistent with POPIA, you have the right to lodge a complaint with the Information Regulator (South Africa):

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a notice on the platform. The updated policy will take effect on the date stated at the top of this page. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: