Privacy Policy

Last updated: 17 July 2026

OmniStack (Pty) Ltd (“OmniStack”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what personal information we collect through omnistack.co.za (the “Website”), why we collect it, how we use, store, and protect it, and what rights you have — in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

By using the Website or submitting your information to us (for example, via our enquiry form), you acknowledge that you have read and understood this Privacy Policy.

1. Scope

This Policy applies to personal information we collect:

• through the enquiry / “Book a free intro call” form on the Website;
• if you email us directly (e.g. info@omnistack.co.za, hello@omnistack.co.za, jarrod@omnistack.co.za);
• in the course of a client engagement (audits, automation builds, and ongoing retainer services), which is governed both by this Policy and by the specific terms of your engagement with us.

It does not apply to third-party websites we may link to, which have their own privacy practices.

2. Who we are — the Responsible Party

Under POPIA, OmniStack (Pty) Ltd is the “responsible party” for the personal information described in this Policy.

3. What personal information we collect

We collect the minimum information needed to respond to you and, where you become a client, to deliver our services.

3.1 Through the Website enquiry form

• Name (required)
• Email address (required)
• Company name (optional)
• Message — details of what you’re looking to automate or discuss (optional)

We do not collect payment details, ID numbers, physical addresses, or any special personal information (as defined by POPIA — e.g. health, biometric, or similarly sensitive data) through the Website enquiry form.

3.2 If you email or call us directly — whatever information you choose to share in that correspondence (e.g. your name, contact details, and the content of your message).

3.3 If you become a client— once we’re engaged to deliver an audit, a build, or a retainer, we may collect further information directly relevant to that engagement — for example, business financial data, operational workflows, and (where an automation genuinely requires it) limited personal information about your staff or customers that passes through the systems we build for you. This is governed by your specific engagement letter/contract, in addition to this Policy.

3.4 What we do NOT currently collect — we do not use cookies, web analytics, tracking pixels, or any similar tracking technology on the Website at this time. If this changes, this Policy will be updated first, and a cookie banner/consent mechanism will be implemented as required by law. We also do not knowingly collect personal information from children (under 18) through the Website — it is a business-to-business marketing site not directed at children.

4. Who is responsible for your information — our Information Officer

Under POPIA, every responsible party must have an Information Officer accountable for compliance. OmniStack’s Information Officer is Jarrod Govender, the company’s sole director, reachable at jarrod@omnistack.co.za.

Formal registration of the Information Officer with the Information Regulator (via inforegulator.org.za) is in progress and will be completed as OmniStack’s client engagements scale.

5. Why we collect and use your information

• Responding to your enquiry — to contact you about your free intro call, a paid Money-Admin Audit, or any other enquiry you raise, and to arrange a meeting.
• Delivering our services — if you become a client, to scope, build, deliver, and maintain the automations, dashboards, and related services you engage us for.
• Internal record-keeping — to keep a record of enquiries and client relationships so we can follow up appropriately and maintain continuity of service.
• Legal & compliance obligations — where we are required to retain or disclose information by law (e.g. tax, accounting, or regulatory requirements).
• Direct marketing(only with your consent — see §10) — to occasionally share relevant updates, content, or offers, but only where you’ve opted in.
• Protecting our systems — to detect and prevent spam or abuse of the enquiry form (for example, unusually rapid or repeated submissions).

We will not use your information for any purpose beyond what it was collected for, without either your consent or another lawful basis under POPIA.

6. Our lawful basis for processing

• Consent— where you’ve voluntarily submitted your details via our form, or opted in to marketing communications.
• Performance of a contract— where processing is necessary to deliver services you’ve engaged us for.
• Legitimate interests— where processing (e.g. responding to a business enquiry) serves a legitimate business interest of ours or yours, and doesn’t unreasonably intrude on your privacy.
• Legal obligation— where we’re required by law to process or retain certain information (e.g. financial/tax records).

7. Is providing your information voluntary?

Yes. Providing your information through our enquiry form is entirely voluntary. However, if you choose not to provide your name and email address, we won’t be able to respond to your enquiry or book your free intro call — those two fields are the minimum needed to get back to you. Where you become a client, certain information will be necessary (not optional) for us to perform the specific services in your engagement — this will be made clear in your engagement documentation.

8. Who we share your information with

We do not sell, rent, or trade your personal information. We only share it with:

8.1 Service providers (“operators” under POPIA)

Each of these providers processes information only for the purpose we’ve instructed, is contractually/technically restricted from using it for their own purposes, and is required to maintain appropriate security. (See §9 for where these providers may process data outside South Africa.)

8.2 Legal & regulatory disclosure — we may disclose personal information where required by law, court order, or a competent regulatory authority (e.g. SARS, the Information Regulator, or law enforcement), or to protect our legal rights.

8.3 Business transfers — if OmniStack were to undergo a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction — subject to equivalent privacy protections.

We do not otherwise share your information with any third party for their own marketing or commercial purposes.

9. International (cross-border) transfers

Some of our service providers may process or store data outside South Africa. Resend (email delivery) processes messages via infrastructure in the EU (Ireland) region. Vercel (website hosting) operates a global edge network, which may mean web requests are processed via infrastructure outside South Africa. Supabase (database) region is being finalised and will be confirmed here.

Where personal information is transferred outside South Africa, POPIA (section 72) requires that this only happen where the recipient is subject to a law, binding corporate rules, or contractual terms that provide an adequate level of protection substantially similar to POPIA — or where another lawful ground applies (e.g. the transfer is necessary to perform a contract with you, such as sending you an email response). We select service providers who are subject to recognised data protection frameworks (such as the EU’s GDPR) for this reason, and we remain accountable for your information even when it is processed by these providers.

10. Direct marketing

Submitting an enquiry through our Website does not automatically sign you up for marketing communications. We will only use your contact details to respond to your specific enquiry, unless you have separately and clearly opted in to receive further updates, content, or marketing from us.

If, in future, we send you direct marketing:

• We will only do so with your consent (opt-in), in line with POPIA section 69, or where a narrow “existing customer” exception applies and strict conditions are met.
• Every marketing communication will clearly identify OmniStack as the sender and provide a straightforward way to opt out at any time.
• You can withdraw consent or unsubscribe at any time by emailing jarrod@omnistack.co.za — once you opt out, we will not contact you again for marketing purposes.

11. How long we keep your information

• Enquiries that don’t become a client relationship: retained for a reasonable period to allow follow-up (typically up to 12 months), after which they are deleted or anonymised, unless you ask us to delete them sooner.
• Client information: retained for the duration of the engagement, plus any period required by law (e.g. South African tax/accounting record-keeping requirements, generally 5 years from the relevant transaction).
• You may request earlier deletion at any time, subject to §13 (your rights) and any legal obligation we have to retain certain records.

12. How we protect your information

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, alteration, or disclosure, including:

• Access control: enquiry data is stored with Row-Level Security enabled and no public access — only accessible via a secured, server-side key that never reaches the browser.
• Encryption in transit: the Website is served exclusively over HTTPS (TLS-encrypted connections).
• Least-privilege access: only OmniStack personnel who need access to respond to enquiries or deliver services have it.
• Reputable infrastructure providers: our hosting, database, and email providers (Vercel, Supabase, Resend) maintain their own industry-standard security certifications and practices.

No system is 100% secure, but we continuously review our practices as OmniStack grows. In the event of a data breach that creates a real risk of harm to you, POPIA requires us to notify both the Information Regulator and affected data subjects as soon as reasonably possible. We are committed to meeting this obligation.

13. Your rights under POPIA

As a data subject, you have the right to:

• Be informed — know what personal information we hold about you and why.
• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct or update inaccurate, incomplete, or outdated information.
• Deletion — request that we delete or destroy personal information we no longer have a lawful basis to hold.
• Object — object to our processing of your personal information on reasonable grounds, including for direct marketing (see §10).
• Withdraw consent— where processing is based on your consent, withdraw it at any time (this doesn’t affect the lawfulness of processing before withdrawal).
• Not be subject to solely automated decision-making that significantly affects you, without the opportunity for human input.
• Complain — lodge a complaint with the Information Regulator (see §14) or, in certain circumstances, institute civil proceedings for breach of POPIA.

To exercise any of these rights, contact us at jarrod@omnistack.co.za. We will respond within a reasonable time and in accordance with POPIA’s requirements. We may need to verify your identity before actioning a request.

14. Lodging a complaint with the Information Regulator

If you believe we have not handled your personal information in accordance with POPIA, you have the right to lodge a complaint directly with South Africa’s Information Regulator:

We would, however, appreciate the opportunity to address your concern directly first — please reach out to us at jarrod@omnistack.co.za before escalating, if you’re comfortable doing so.

15. Changes to this Policy

We may update this Privacy Policy from time to time — for example, as OmniStack’s services grow, or if we introduce new tools (such as website analytics) that change what we collect. The “Last updated” date at the top will always reflect the most recent version. Material changes will be highlighted on the Website.

16. Contact us

Questions, requests, or concerns about this Privacy Policy or how we handle your information?

• jarrod@omnistack.co.za (privacy enquiries)
• info@omnistack.co.za (general enquiries)
• https://omnistack.co.za