POPIA Notice

This notice explains how virtualverselabs (Pty) Ltd, trading as kholect, processes personal information under the Protection of Personal Information Act, 2013 (POPIA).

Information Officer

Fundo Thabethe is our Information Officer. Direct any POPIA request, question, or complaint to fundo@virtualverselabs.com.

What counts as personal information here

Two categories: (1) account data belonging to people who sign up for kholect, and (2) lead data — business names, contact details, and public business signals that our customers' workspaces discover or add, about businesses those customers want to contact.

Lawful basis for processing lead data

Every lead record in kholect carries one of two documented consent bases:

• Legitimate interest (B2B) — recorded automatically when a lead is sourced from a public business listing (Google Places or OpenStreetMap). This is the standard basis for B2B outreach to publicly-listed business contact information.
• Manual consent — recorded when a customer marks a lead as explicitly opted in.

A suppression list is checked before every send and overrides both bases — once someone unsubscribes, bounces, or complains, no further email goes to them regardless of consent basis. Workspaces sending cold outreach from South Africa get an automatic footer disclosure and a reduced daily send cap, per POPIA's requirements for direct marketing.

Audit trail

Every send decision — allowed, blocked, or suppressed — is written to an append-only audit log, reviewable in-app by the workspace it belongs to. This is what lets a customer demonstrate, after the fact, exactly why a given message was or wasn't sent to a given lead.

Your rights as a data subject

If your business appears as a lead in a kholect workspace, you can ask us to:

• confirm whether we (or a customer's workspace) hold information about you;
• correct inaccurate information;
• delete your information or stop further contact;
• object to processing based on legitimate interest.

Send requests to our Information Officer above. You can also lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

Cross-border processing

Some processing (hosting, AI scoring) happens through service providers outside South Africa. We only use providers contractually bound to protect personal information to a standard consistent with POPIA.