Privacy Policy

Pomodor (Pty) Ltd (“Pomodor”, “we”, “us”, or “our”) is committed to protecting the privacy and personal information of every person who visits our website at pomodor.com (the “Site”) or otherwise engages with us. This Privacy Policy explains what personal information we collect, how we use it, the lawful basis on which we process it, and the rights you have in respect of that information.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and, where applicable, other relevant data protection laws. By using the Site, you acknowledge that you have read and understood this Privacy Policy.

Responsible Party (as defined in POPIA)

We collect personal information directly from you, automatically through your use of the Site, and from third-party service providers acting on our behalf.

2.1 Information you provide directly

• Contact details: name, email address, company name, and any information you choose to include when you complete our contact form or email us at hello@pomodor.com.
• Careers applications: your name, email address, LinkedIn profile, area of interest, short note, and CV when you introduce yourself for recruitment. Please include only information relevant to a potential working relationship.
• Marketing subscriptions: your email address and related preferences where you subscribe to our newsletter or marketing communications.
• Engagement information: information shared with us during scoping calls, proposals, or the course of a paid engagement (governed additionally by a separate Master Services Agreement).

2.2 Information collected automatically

• Usage and device data: our hosting provider may automatically process limited technical data such as your IP address, browser type, operating system, referring URL, requested pages, and similar diagnostic data needed to operate and secure the Site.
• Cookies and analytics: we use a first-party cookie to remember your cookie choice. We do not currently operate third-party analytics tracking on the Site. See Section 7 (Cookies) below.

2.3 Information from third parties

We may receive information from hosting and infrastructure providers and communications platforms that we use to operate the Site and our business. If optional analytics are introduced, we may also receive information from the analytics provider after you have consented.

We do not knowingly collect personal information from children under the age of 18. If you believe a child has provided us with personal information, please contact us so we can delete it.

We process your personal information for the following purposes and on the lawful bases indicated:

We will not use your personal information for purposes that are incompatible with those listed above without first obtaining your consent or otherwise being permitted to do so by law.

We do not sell your personal information. We may share it with:

• Operators (service providers) who process information on our behalf, including hosting, analytics, email, and customer-relationship platforms, under written agreements requiring them to protect your information.
• Our approved CRM, internal email, and internal Slack communications destinations when you submit a contact form, so the relevant team can respond to your enquiry.
• Authorised recruitment recipients receive careers applications through Resend, our email provider. CVs remain in private Replit App Storage and are shared only through short-lived signed access links.
• Professional advisers, including legal, accounting, and insurance advisers, where necessary.
• Regulators, law enforcement, or other authorities where required by law or to protect our rights.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

Some of our service providers may store or process personal information outside the Republic of South Africa. Where we transfer personal information across borders, we do so only where the recipient is subject to laws, binding corporate rules, or agreements that provide an adequate level of protection substantially similar to POPIA, or where another lawful basis under Section 72 of POPIA applies.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. When personal information is no longer required, we will securely delete or de-identify it.

Careers application details and CVs are scheduled for deletion 90 days after submission, unless we need to retain them longer with your agreement or to meet a legal obligation.

The Site uses a strictly necessary first-party cookie to remember the cookie choice you make in our consent banner. We do not currently use third-party analytics or advertising cookies.

• Consent cookie: remembers whether you accepted or rejected non-essential cookies. It expires after one year.
• Optional analytics cookies: if we introduce analytics in the future, we will ask for your affirmative consent before placing them.

You can control or delete cookies through your browser settings. If you choose to reject non-essential cookies, we will remember that preference and will not place optional analytics cookies. Where required by law, we will request your consent before placing non-essential cookies.

We maintain appropriate, reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and misuse. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Subject to POPIA, you have the right to:

• Request access to the personal information we hold about you.
• Request correction or deletion of your personal information.
• Object to the processing of your personal information.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the Information Regulator (South Africa).

To exercise any of these rights, contact us at hello@pomodor.com. We may need to verify your identity before responding.

Information Regulator (South Africa)

Website: inforegulator.org.za
Email: complaints.IR@inforegulator.org.za

The Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be brought to your attention where required by law. Your continued use of the Site after any changes constitutes acceptance of the revised Policy.

For any questions about this Privacy Policy or our processing of your personal information, contact: