Privacy Policy

Introduction & Scope

At GQ Beyond Holdings (Pty) Ltd, trading as GQ Beyond Consulting and operating the GQ Beyond Agentic AI division, we approach the protection of your personal information with the same standard of excellence that we apply to our technological frameworks and professional services.

This Privacy Policy governs the manner in which we collect, utilise, maintain, and disclose personal data gathered from clients, website visitors, enquiry form respondents, and business partners. This document is strictly aligned with the legislative framework of the Republic of South Africa, specifically the Protection of Personal Information Act, 4 of 2013 (POPIA).

By accessing our website at gqbeyond.co.za, submitting an enquiry, or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

Information We Collect

In delivering our professional consulting, agentic AI, and community development services, we may collect the following categories of personal information:

• Identity and Contact Data: Full names, professional titles, email addresses, physical addresses, and telephone numbers — gathered when you complete an enquiry form, contact us directly, or enter into a service agreement.
• Technical and Usage Data: IP addresses, browser types, device identifiers, and interaction metrics collected when you use our website, AI agents, automated workflows, or digital tools.
• Financial and Transaction Data: Billing details and payment information necessary for the execution of service agreements, invoicing, and infrastructure provisioning.
• Communication Data: Records of correspondence including email, WhatsApp, and other communication channels used in the course of a business relationship.
• WhatsApp Enquiry Data: Information you voluntarily submit through our WhatsApp-redirect enquiry forms, including your name, email address, phone number, and the nature of your enquiry.

We collect only the minimum information necessary to fulfil the specific purpose for which it is gathered.

Purpose & Use of Information

Your personal information is processed strictly for legitimate business purposes in accordance with POPIA's lawfulness conditions. We use this information to:

• Respond to enquiries and provide quotations for professional services.
• Deploy, manage, and optimise automated workflows, AI agents, and secure digital environments.
• Fulfil contractual obligations and provide dedicated technical support.
• Communicate critical system updates, service enhancements, or administrative notices.
• Comply with applicable financial, legal, and regulatory requirements under South African law.
• Improve the quality and relevance of our services through aggregate, anonymised analysis.

Data Infrastructure & Security

GQ Beyond Holdings operates its client-facing digital infrastructure — including hosting environments, domain management, and email systems — through a white-label reseller architecture managed and controlled entirely within our own technical operations under the GQ Beyond Agentic AI division.

This architecture enables us to:

• Maintain direct operational control over the environments where client data resides.
• Apply security configurations, access controls, and update policies according to our internal standards.
• Provision and decommission client environments without reliance on third-party decision-making processes.

We apply the following technical and organisational measures to protect your personal information:

• HTTPS encryption across all web properties and client portals.
• Access controls restricting data access to authorised personnel only.
• HTTP security headers including HSTS, X-Frame-Options, and Content-Security-Policy directives.
• Regular environment audits and security reviews.

Sharing of Information

We do not commercialise, trade, or rent your personal information. We will only disclose personal information under the following strictly limited circumstances:

• Legal Compliance: When unequivocally mandated by law, regulatory frameworks, or lawful requests from recognised South African legal or regulatory authorities.
• Service Delivery: Where disclosure to a specific sub-processor or technology partner is strictly necessary to deliver a service you have contracted for (for example, a third-party AI platform underpinning a deployed agent). In all such cases, appropriate data processing agreements are in place.
• With Your Consent: Where you have explicitly authorised us to share your information with a named third party.

No cross-border transfer of personal information occurs without appropriate safeguards as required under POPIA Section 72.

Your Rights Under POPIA

As a data subject within South Africa, you possess the following rights in respect of your personal information held by GQ Beyond Holdings:

• Right of Access: Request a record of the personal information we hold about you.
• Right to Rectification: Request the correction or updating of inaccurate or incomplete data.
• Right to Erasure: Request the deletion of your personal data, subject to our legal, regulatory, and operational retention requirements.
• Right to Object: Object to the processing of your personal information on reasonable grounds.
• Right to Lodge a Complaint: Submit a complaint to the Information Regulator of South Africa if you believe your rights under POPIA have been infringed.

The Information Regulator can be contacted at: www.justice.gov.za/inforeg/

To exercise any of the above rights, please contact our Information Officer using the details in Section 10.

Retention of Personal Information

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable South African law. Our general retention guidelines are:

• Client and contractual records: Retained for a minimum of 5 years from the date of last service delivery, in accordance with general South African commercial and tax law.
• Enquiry and communication data: Retained for 12 months from the date of last contact, unless a service relationship is established.
• Financial and billing records: Retained for 5 years as required by the South African Revenue Service (SARS).

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised.

Cookies & Digital Tracking

Our website uses minimal tracking technologies. Specifically:

• A session cookie is used to store your acceptance of this Privacy Policy and our Terms & Conditions during your browsing session. This cookie contains no personal information and expires when you close your browser.
• No third-party advertising, analytics, or behavioural tracking cookies are currently deployed on our website.

If this changes in the future, this Privacy Policy will be updated and visitors will be notified accordingly.

Governing Law

This Privacy Policy, and any disputes arising from or related to it, shall be governed by and construed in accordance with the laws of the Republic of South Africa. Any dispute not resolved through direct engagement with our Information Officer shall be subject to the jurisdiction of the South African courts.

Contact & Information Officer

For privacy-related enquiries, data access requests, rectification requests, or to contact our Information Officer, please reach out using the following details:

This Privacy Policy was last reviewed and updated on 28 June 2026. We reserve the right to amend this policy from time to time. Material changes will be communicated to registered clients via email.