Adaptavist South Africa Privacy Policy

Gravity Works Consulting (Pty) Ltd ( "we", "us" or "our") is committed to preserving your privacy.

Gravity Works Consulting (Pty) Ltd would like to inform you about the way in which it collects, processes, uses, shares, controls and protects the information that you provide to us, including your Personal Data. If you do not agree with this Privacy Policy (“Privacy Policy”), do not access or use our websites, products and services or interact with any other aspect of our business. By submitting information to us in any way, or by using our websites, systems, services, or by interacting with us via email, phone, messaging service, in-person meeting or any other means ("Interactions"), you consent to the collection, use, processing and transfer of your information under the terms of this policy.

We may update this Privacy Policy from time to time. Amendments to these terms will be effective upon posting, and operate as a condition of your continued engagement with Gravity Works Consulting (Pty) Ltd, or continued use of our websites, software or services. It is your responsibility to check this page periodically for any updates to this Privacy Policy. We encourage you to review our Privacy Policy whenever you use our services to stay informed about our information practices and the ways you can help protect your privacy.

Gravity Works Consulting (Pty) Ltd is part of The Adaptavist Group and a Data Controller pursuant to this Privacy Policy. The Adaptavist Group is a multinational group of companies operating worldwide.

Information and contact details of Gravity Works Consulting (Pty) Ltd and The Adaptavist Group entities can be found in the Legal Notice.

The terms below shall have the following meanings:

2.1 "Personal Data Breach," "Controller," "Processor", "Data Subject", "Personal Data", "Processing," "Special Category Data". "Profiling" "Pseudonymisation" "Consent:", and "appropriate technical and organisational measures” as used in this Policy shall have the meanings given in the GDPR irrespective of whether GDPR, UK GDPR, or U.S. Data Protection Law applies.

2.2. "Data Protection Law" means European Data Protection Law including GDPR, UK - GDPR, POPIA and U.S. Data Protection Law that are applicable to the processing of Personal Data under this Policy.

2.3. "European Data Protection Law" means any data protection and privacy laws of Europe applicable to the Personal Data in question, including where applicable.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)(""GDPR""); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; (iii) any applicable national implementations of (i) and (ii); (iv) the Swiss Federal Data Protection Act of 2023 (“FADP”) and its Ordinance; and (v) in respect of the United Kingdom, the Data Protection Act 2018, UK GDPR and any applicable national legislation that replaces or converts in domestic law the GDPR or any other law relating to data and privacy as a consequence of the United Kingdom leaving the European Union; in each case as may be amended, superseded or replaced from time to time;

2.4 “POPIA” means the South African Protection of Personal Information Act 2013;

2.5 “U.S. Data Protection Law” means data protection or privacy laws applicable to Personal Data in force within the United States, including the California Consumer Privacy Act (“CCPA”)."

As part of the requirements of the data protection law, Gravity Works Consulting (Pty) Ltd and its affiliates have registered with the supervisory authority.

Gravity Works Consulting (Pty) Ltd has registered with the Information Regulator (South Africa). You can contact the Information Regulator (South Africa) using the following contact details:

JD House, 27 Stiemens Street, Braamfontein, Johannesburg

P.O Box 31533, Braamfontein, Johannesburg, 2017

Tel.: 010 023 5200

Email: enquiries@inforegulator.org.za

Web: https://eservices.inforegulator.org.za/contact.aspx

We may make certain software available for download on our websites and may link to software on other, third party websites. This software may be created by Gravity Works Consulting (Pty) Ltd, its affiliates or by third party vendors. The software may be programmed to access our servers and/or third party servers in order for the software to operate and in order to check for program upgrades or enhancements. From time to time, new files may be added to your computer in order to upgrade the software or add new functionality to it. These changes may occur without notice to you. Use of such software will be governed by any associated or referenced terms and conditions, and instructions on uninstalling such software will similarly accompany or be referenced. In the event that such software is a product of The Adaptavist Group, use of the product will be governed by a separate Adaptavist End User License Agreement (“EULA”).

Our websites may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we are not responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Privacy Policy. We recommend that you review the privacy policy of any third-party website you visit to understand how your personal data will be handled.

If you are aged 18 or under, please get your parent/guardian’s permission beforehand whenever you provide personal information to our websites. Users without this consent are not allowed to provide us with personal information.

Should any pages on any of our systems allow posting of comments, your username may be associated with any comments (except in areas where anonymous comments are permitted, your post and username will be displayed alongside those comments to anyone who has access to see them).

We reserve the right to remove content and to remove any user’s access to its Services for content which is offensive, abusive, provocative or for discriminatory language posted on or sent through our Services, at our sole discretion.

When you use our services or interact with us, we may collect data about you, your use of the services and interactions. This information can be categorised generally as follows:

- Access data and log files

- Cookies and Pixels

- Interaction data (data generated through interactions with us on phone, via email, via the website, or other means)

- Transactional and Commerce Data (data generated through an actual order or sale of a product or service)

- Product Data (data generated through use of our products in various forms)

Further information on all these categories and the legal basis for data processing can be found below.

This data (which may include Personal Data) can be described in more detail as:

- Identification information, which may include name, email address, billing or shipping addresses, telephone numbers, screen names, user IDs (potentially with password). This might also include IP addresses;

- Commercial information, which may include payment or financial information which would be appropriately handled (for example through a third party payment platform);

- Technical platform information, which relates to the technical means by which you interact with us, such as operating system, web server type, browser type, or other information regarding your device;

- Web related information, including items such as referring domain;

- Activities related to your use of Services, including website use and records of actions and activities, including search, and communication preferences;

- Educational information, which includes your education history; grades

- Professional information, such as employer or organisational affiliation for a customer or partner; the contents of your resume;

- Geolocation data, which might be extrapolated from other data;

- Communication information, which may include audio, electronic, visual information, as well as any data in any files uploaded, emailed or otherwise provided, and the contents of your communications with us via email, social media, telephone or voice calls, or via whatever Interaction you participated in.

We do not knowingly Process any Special Category Data (as defined under the European Data Protection Law) or Special Personal Information (as defined under POPIA) under this Privacy Policy.

We collect personal data from the following sources, including but not limited to:

You may provide information to us via one of our Services or via Interactions. This may be unstructured information (such as that in an email) or a response to a survey, web-form, or other data gathering mechanism.This includes Personal Data (including for example, names and Email addresses) provided by you or your users or (if applicable) your customers using the Gravity Works Consulting (Pty) Ltd services.

We may collect information from you in the course of you using our Services or us providing Services to you (indirectly via your use). For example, We may observe your actions on one of our websites.

We may be provided, or collect, information from various third parties with whom We may contract, or share an integrated service, in connection with our Services. For example:

- third party vendors that help us build or supplement contact lists or information, for example webinar platforms or market intelligence providers; and

- third parties that help us verify records or enrich information We capture about you; and

- third party providers of services (such as online recruiting services) whereby information is sent to us automatically or via request; and transactional information from third parties, including information regarding your purchases or evaluations of any of our Services. This may include data from companies such as Atlassian (via Atlassian Marketplace or other means).

- third party organisers of events we sponsor or attend, provided you also attend the event and (a) you have consented to such data to be shared with us or (b) such data is shared with us for legitimate purposes.

Automated tracking technologies, such as information automatically collected about your interaction with our Services and websites using various technologies such as cookies and web logs.

Personal data is used for the purposes for which it was collected. To the extent permitted by law, We will use data provided, including Personal Data, to:

- Provide our Services, including their administration, operation and support, communications related to the Services, and commercial related aspects such as purchasing;

- Meet our legal and regulatory obligations, such as in the area of security;

- Carry out marketing including advertising of our Services, which may include passing your information to external social media platforms (see Marketing Providers) for profiling & deriving new target audiences to whom We may advertise on those platforms.

Personal data is used for the purposes for which it was collected, unless (a) otherwise required by law or (b) if we reasonably consider we need to use it for another reason, to the extent that reason is compatible with the original purpose. We rely on the following lawful basis for processing of Personal Data:

- Consent: you have given your express consent to the processing of your Personal Data (e.g. by subscribing to a newsletter or filling out a form)

- The Personal Data processing is necessary for the performance of a contract, including their administration, operation and support, communications related to the Services, and commercial related aspects such as purchasing.

- Legal and regulatory obligations: the data processing is necessary for compliance with a legal obligation, such as in the area of security.

- Legitimate interest: the Personal Data processing is necessary for the purposes of our legitimate interests. Depending on how you interact with us, the Processing of your personal data for our legitimate interests may varied, we may use your personal data for the following purposes:

- Administrative and operational activities in connection with our business, such as the preparation of offers. This processing is necessary to safeguard our legitimate interests in optimising the presentation of our offer and ourselves and to respond to your enquiries in line with your expectations.

- Developing and improving our new and existing products and services, e.g. inviting you to participate in surveys to optimise our websites or personalise your experience of our services.

- The processing is necessary for the purposes of providing you with marketing or promotional communications that we believe may be of interest to you.

Please note:

• All marketing email communications from Gravity Works Consulting (Pty) Ltd shall provide the option to unsubscribe at any time.

With regards specifically to Personal Data, We will keep and process your Personal Data only for as long as is necessary for the purposes for which it was collected, unless We have a legal obligation to retain the data for a longer period. The criteria used to determine the retention period for your personal data include the nature of the data, the purposes for which it was collected, and any legal or regulatory requirements. We periodically review our retention periods to ensure that personal data is not kept longer than necessary.

When We disclose Personal Data to third parties who act as an independent Controller, this data will be retained by the third party in accordance with their own data privacy policy, and in accordance with the data protection laws under which the third party is regulated.

When we disclose Personal Data to third parties who act as a Processor, this data will be retained by the third party in accordance with our specific requirements.

In general, there are various people within Gravity Works Consulting (Pty) Ltd who may need access to the information that you provide us. They may need this for technical, commercial or compliance reasons, and this will be done in accordance with Gravity Works Consulting (Pty) Ltd ’s internal access control policy. Your personal data will be shared with affiliates within Gravity Works Consulting (Pty) Ltd if:

- you have given us your express consent,

- this is legally permissible and necessary for the fulfilment of contractual relationships with you;

- we have a legitimate interest in transmitting your Personal Data within Adaptavist Group for internal administrative purposes;

- disclosure is necessary for the enforcement, exercise or defence of legal claims and there is no reason to assume that you have an prevailing interest worthy of protection in the non-disclosure of your data,

- in the event that there is a legal obligation to disclose the data.

The information you provide to us will be held on our computers and may be accessed by or given to our staff, affiliates or subcontractors. You should be aware that the administrator of the Services may be able to:

- access information in and about your account;

- disclose, restrict, or access information that you have provided or that is made available to you when using your account, and;

- control how your account may be accessed or deleted.

Clients who purchase goods or services from Us may be referenced in our promotional material and websites. We may identify you by name, trade name, logo and trademark. Should you not want to be listed, please contact us at here.

We may use information you provide, including Personal Data, in conjunction with third parties, who may act as Processor of such data. See Gravity Works Consulting (Pty) Ltd Third Parties (below) for more information.

Finally, if our business negotiates to enter or enters into a joint venture with or is acquired by or merged with another business entity, your information may be disclosed to our possible or new business partners or owners.

Sharing your Personal Data with our affiliates, third parties, processors or as otherwise detailed in this section 9 may involve transferring and processing your data outside of South Africa. Whenever we transfer your personal data outside of South Africa, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We collaborate with third parties that help us operate, provide, improve, integrate, customise, and support our

Services.

You warrant that you have familiarised yourself with and agree to be bound by any applicable third party terms relevant to the Services, including The Adaptavist Group software. The information We receive when you link or integrate our services with a third-party service depends on the settings, permissions and privacy policy controlled by that third-party service. You should always check the privacy settings and notices in these third-party services to understand what data may be disclosed to us or shared with our services.

We work with third-party service providers to supply websites and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing, analysis and other services for Us, which may require them to access or use information about you that you supply. This may include Personal Data; for details of service providers involved in the processing of personal data please see the Data Processing Addendum, which is included as part of this Privacy Policy.

StreamYard is used for events to live stream sessions. Use of StreamYard is covered by its privacy policy at StreamYard privacy policy and https://hopin.com/hopin-events/legal/privacy.

Use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy at https://developers.google.com/terms/api-services-user-data-policy, including the Limited Use requirements.

We work with third-party service providers to enable us to further market and advertise our Services, with the legal basis being legitimate interest. In order to do this, We may provide them with Personal Data which will be processed in a manner compliant with the appropriate Data Protection Law. Marketing Providers may establish a profile of potential people to whom We might advertise, based on data We provide them.

By visiting our page on the platform of our marketing providers, your data may be automatically collected and stored for market research and advertising purposes. This data is used to create so-called user profiles using pseudonyms. Cookies are usually stored on your end device for this purpose.

If you have given your consent to data processing in the platform of the respective marketing provider, the legal basis for processing your data is consent. If the social media platforms mentioned are based in the USA, an adequate level of data protection is guaranteed by an adequacy decision of the EU Commission. You can find the adequacy decision here.

Marketing Providers may include, but are not limited to the following and any further third parties listed in section "Cookies and Pixels:"

10.3.1 Facebook. Refer to privacy policy at https://www.facebook.com/privacy/explanation

10.3.2 LinkedIn. Refer to privacy policy at https://www.linkedin.com/legal/privacy-policy

10.3.3 Zoominfo. Refer to privacy policy at https://www.zoominfo.com/about-zoominfo/privacy-policy

By visiting our website, certain Personal Data of yours will be Processed even if you do not provide it to us directly. For example, each time you visit our website, the web server automatically saves a so-called server log file for technically necessary reasons, which contains personal data such as your IP address, date and time of the enquiry etc. (together ""access data"") and documents your visit. The collection of access data essentially only means that we obtain factual knowledge about your access to our website.

When you visit my website, the following data in particular is collected, which is technically necessary for you to view the website:

- IP address (network address)

- Address of the website from which you have accessed it

- Address of the accessed files (access address "URL")

- Date and time of access

- the operating system and browser version of your end device

The access data is processed for the following purposes:

- to ensure the error-free functioning of the website

- to provide and optimise our offer

- to ensure a comfortable use of the website

- to ensure system security and stability

- to evaluate statistics.

The access data is collected for the above-mentioned purposes. This is necessary to protect our legitimate interests in the proper presentation of our website, which are overriding in the context of a balancing of interests.

For the avoidance of doubt, this section does not apply to Personal Data collected as part of the use of products of The Adaptavist Group.

We use cookies and pixels for various purposes, including to optimise our websites, to make it easier to browse the website and to analyse website traffic.

Cookies are text files placed on your computer to collect visitor behaviour information. When you visit our websites, or download our products, We collect information on usage from you automatically through cookies. First-party and third-party cookies are used to improve your online experience. Cookies allow you to log in to our systems, connecting various page views together into a session. When you use our products and services you may be asked to provide certain information about yourself, including your name and contact details. We may also collect information about your usage, as well as information you provide during such usage. This includes using our websites, products and services, as well as any correspondence or communication you send.

A pixel is a block of code placed within a website’s or product’s code that allows measurement of the effectiveness of advertising. When you visit our website and take an action, the pixel collects the data from your behavior and reports the action. Gravity Works Consulting (Pty) Ltd and our third-party partners use cookies and pixels to provide functionality and to recognize you across different services and devices. We collect this information from you automatically through pixels.

Functionality cookies enable us to monitor the performance of our websites and to enhance your browsing experience. For example, if you set your language or location, We use cookies to save your preferences. For more information about the Cookies used to run our websites, see:

• Squarespace Cookies policy

We use cookies and pixels to collect data on our users’ behaviour to better understand our visitors’ needs and to personalise the content on our websites. These could include collecting information about which pages you visit to help us present more relevant information.

We send data collected through these cookies to a variety of tools and providers that help us improve our products and services. These tools include but are not limited to the following list. For further details, please see individual privacy policies for each tool or provider:

• Segment (see here)

• Hubspot (see here)

• Orgcharthub (see here)

• Google Tag Manager (Tag Manager terms of service are here)

• Google Analytics (Google’s privacy policy is here)

• Hotjar (Hotjar’s privacy policy is here)

• Sprig (privacy policy is here)

• Our data storage solution providers such as Amazon S3 (Amazon’s privacy policy here and Redshift.

Cookies and pixels allow Gravity Works Consulting (Pty) Ltd to collect information that enables us to personalise and measure the effectiveness of advertising on our site, in our products and on other websites. For example, We may serve you a personalised ad based on the pages you visit on our websites. Our company might share some limited aspects of this strictly anonymised data with third parties for advertising purposes. Advertising cookies on this site include:

• Facebook Pixel (privacy policy is available here)

• LinkedIn (privacy policy is here)

• Twitter (privacy policy is here)

• Reddit ( privacy policy is here)

• Quora (privacy policy is here)

• Bing (Bing’s privacy policy is here)

• Google Ads (see here)

• Capterra (privacy policy is here)

Essential cookies are necessary for a website, or for our products, to function as intended. These could include us storing your website data collection preferences so we can honour them if you return to our websites. You cannot opt-out of the essential cookies and doing so would render some of the websites and/or product functionality unusable.

Essential cookies are required in particular to enable the functionality of this website. The processing of data is therefore based on our legitimate interest in the functional presentation of our website. If the cookies are not essential cookies, the legal basis for the processing of personal data is your consent.

You can often allow or disallow certain types of cookies. Accepting cookies is usually the best way to ensure you get the most from a website. You can normally change your browser settings to restrict, block or delete cookies if you want. Each browser is different, so check the ‘Help’ menu of your particular browser to learn how to change your cookie preferences. Many browsers have universal privacy settings for you to choose from. Get more help about how cookies work with specific browsers. Please note, these instructions may change from time to time.

Our website cookie consent management tool allows you to manage your preferences for Cookie categories. The tool will also provide an overview of all Cookies used. For additional information about Cookies and/or to change your Cookie consent preferences, please visit the preference center .

We collect personal data if you provide it voluntarily when you contact us (data that arises from interactions with us on the phone, by email, via the website or in other ways). This includes, but is not limited to, any information you may provide us through our website(s), through any communications you may have with any of the Adaptavist Group employee in the course of their employment, or through any social media platform. You warrant not to provide Gravity Works Consulting (Pty) Ltd with any Special Category Data through such Interactions.

We use the Personal Data you provide to process your enquiries. The legal basis for data processing is the fulfilment of our legitimate interest in the proper processing of contact enquiries. The provision of personal data is necessary in order to be able to properly allocate enquiries. If you contact us in connection with an existing or upcoming contract with you (data generated by an actual order or sale of a product or service), data processing is necessary for the fulfilment of a contract or to take steps at your request prior to entering into a contract with you.

Data regarding any orders / purchases for use of our Services is referred to as Transactional and Commerce Data. This includes (but is not limited to) orders / purchases of:

- licenses to use our software (including products) in whatever form,

- licenses to use 3rd party software, or services, sold through Gravity Works Consulting (Pty) Ltd.

Transactional and Commerce Data may be provided to us via your placing an order on the phone, via our own online marketplace facilities, via 3rd party marketplace facilities such as the Atlassian Marketplace, our website, officially authorised 3rd party partners or representatives, or other sources.

When placing orders / making purchases, it is important to note and agree to any terms and conditions imposed by third parties, such as Service Providers with whom we may be working to facilitate the order or purchase.

We process the data to protect our legitimate interests in an optimised presentation of our offer and effective communication with you and interested parties, which prevail in the context of a balancing of interests. If you purchase a Gravity Works Consulting (Pty) Ltd product that is integrated with third-party products, we process the data in order to fulfil the contract with you or to take steps at the request of the data subject prior to entering into the contract.

You can subscribe to our newsletter ("AdaptaNews") on a voluntary basis. After confirming your registration for the newsletter, you will receive interesting information about our services and products, etc., at the e-mail address you have provided. You can unsubscribe from the newsletter by contacting us. You can find the contact details in the Legal Notice.

The Adaptnews contain so-called tracking pixels. A tracking pixel is a thumbnail image embedded in emails sent in HTML format to enable log file recording and analysis. This facilitates a statistical evaluation of the success or failure of online marketing campaigns. Using the embedded pixel code, we can recognize whether and when an email was opened by a data subject and which links in the email were clicked by the data subject.

Such personal data collected via the tracking pixels contained in the newsletters are stored and evaluated by the data controller in order to optimise the newsletter subscription and to adapt the content of future newsletters even better to the interests of the data subject.

Depending on your location and subject to applicable laws, you, as a data subject, may have certain data protection rights. If you are a resident of the EEA, UK or South Africa, you have the following rights:

- You have the right to request information about your personal data processed by us pursuant to this Privacy Policy;

- You have the right to request the rectification of incorrect or incomplete personal data stored by us.

- You have the right to request the erasure of your personal data stored by us, unless further processing is required for:

- exercising the right of freedom of expression and information,

- the fulfilment by us of a legal obligation,

- reasons of public interest, or

- the establishment, exercise or defence of legal claims.

- You have the right to request in some cases the restriction of the processing of your personal data.

- You have the right to object to the processing of your Personal Data.

- You have the right to withdraw your consent for the Processing of your Personal Data, as further detailed in section 18 Right of Withdrawal below;

- You have the right to receive your personal data that you have provided to us and we store in our systems, in a structured, commonly used and machine-readable format.

You can exercise the rights mentioned above by sending an email at contractuals@adaptavist.com or a letter to the contact details in the Legal Notice. In your request, please include your full name and the electronic or physical address where you wish to receive the reply.

- You have the right to submit a complaint to a supervisory authority. You can also contact the supervisory authority of your usual place of residence or workplace or the location of our company headquarters. Please see earlier section 3 of this Privacy Policy for details of the supervisory authorities.

Insofar as we process personal data in any of the above-described manners in order to protect our legitimate interests that are overriding in the process of balancing of interests, you can object to this processing with effect for the future. If the data is processed for direct marketing purposes, you can exercise this right at any time and without any conditions as described above. If the processing takes place for other purposes, you are only entitled to a right of withdrawal as far as it is justified for reasons arising from your particular situation.

After exercising your right of withdrawal, we will not process your personal data for these purposes anymore, unless we can provide and prove compelling legitimate reasons that the processing must proceed, which outweigh your interests, rights and freedoms, or if the processing serves to establish, exercise or defend legal claims. This does not apply if the processing has taken place for direct marketing purposes. In this case, we will cease to process your personal data for this purpose.

For user research (including survey) activities We will collect the data, including personal data, which is described in a research or survey description or its accompanying user research activity information document, for the purposes as set out in that same document.

You have the right to request and obtain a copy of all your personal data and any data derived from it. You can find the contact details in the Legal Notice.

We are the data controller for your personal data collected and processed as part of this research, and you agree that We may process your personal data based on your consent. We will use your personal data within Gravity Works Consulting (Pty) Ltd and its affiliates only for research and informational purposes and to comply with applicable data protection laws. We will try to anonymize your data to the extent that this is feasible. No special category data (as defined in GDPR) is collected as part of this research. We will erase your data on your written request to us.

We use data processors for user research, which will be described in research or survey description or its accompanying user research activity information document, and each of which will have their own privacy policy.