Website: www.interactaoe.co.za
Operator: iNteract (Pty) Ltd
Effective date: 28 October 2026
Status: Draft — pending verification and approval
iNteract ("we", "us", "our") respects your privacy and is committed to handling personal information responsibly and transparently in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African laws.
This policy describes how personal information may be collected, used, stored, shared and protected through our corporate website, business communications and the iNteract Adaptive Offering Engine ("iNteract AOE") where this policy applies.
iNteract AOE provides QR-enabled shopper assistance, AI-powered product guidance through ARI, and retail engagement and decision intelligence services.
This policy applies to website visitors, business contacts, authorised platform users and shoppers interacting with applicable iNteract-powered experiences.
Retailer-specific notices and arrangements may also apply to a particular shopper experience.
Simply visiting our website does not, by itself, constitute consent to every form of processing described in this policy.
iNteract (Pty) Ltd is responsible for personal information processed for its own corporate website, enquiries, business relationships and internal operations, to the extent that it determines the purposes and means of that processing.
For retailer-operated platform activities, the allocation of responsibilities depends on the particular processing activity and the applicable contractual arrangement.
A retailer may determine certain purposes and means of shopper processing, with iNteract providing technical processing services on its behalf. iNteract may separately determine the purposes of certain platform administration, security or business operations.
The relevant responsibilities must be established in applicable agreements and privacy notices.
Registered company number: [Verify and insert]
Registered or business address: [Verify and insert]
Information Officer: Registered Information Officer of iNteract
Email: johan@interactaoe.co.za
Depending on how you interact with us, information may include:
Your name, business email address, telephone number, organisation and job title.
Information included in contact forms, enquiries and business correspondence.
Information you voluntarily provide when requesting a demonstration, participating in a business discussion or subscribing to communications.
Technical information associated with website access, potentially including IP addresses, browser type, device characteristics, access times and diagnostic records.
Cookie, analytics or similar information where the relevant technologies are deployed.
Information may include:
Account and authentication identifiers.
Business contact details.
Retailer or organisational association.
Assigned role, permissions and authorised access scope.
Administrative actions, audit references, security events and service usage records.
When a shopper scans an iNteract-enabled QR code or uses a connected experience, the platform may process:
QR, activation, retailer, campaign and relevant product identifiers.
Scan, interaction and event timestamps.
Session identifiers and associated service records.
Product enquiries, selections, comparisons and relevant interaction events.
Technical and security information required for service operation.
Basket or checkout-handoff information where those capabilities are enabled.
Shoppers ordinarily do not need to create an account or download an application to access QR-enabled assistance.
However, not requiring registration does not necessarily mean that all information processed is anonymous under POPIA. Session identifiers, technical records and combinations of interaction data may constitute personal information where they relate to an identifiable person.
When you use ARI, the service may process the questions or instructions you enter, relevant product context and information necessary to generate a response.
The platform incorporates measures intended to minimise unnecessary personal information before requests are submitted to the AI service.
You should avoid entering identity numbers, payment-card details, passwords, medical information or other unnecessary sensitive information into ARI.
Some processing may be necessary to deliver your requested AI assistance or maintain essential service and security records.
Additional retention or use of AI interaction content for behavioural analytics is subject to the applicable purpose-specific consent controls where required.
The platform may produce retailer-scoped operational reports, interaction measurements and aggregated insights.
Retail media measurement may involve campaign, brand, presentation and interaction information.
Aggregated or pseudonymised information is not automatically outside POPIA if individuals remain reasonably identifiable.
Any additional use, linkage or disclosure for retailer or brand purposes must have an appropriate legal justification and comply with applicable restrictions.
Controlled demonstration environments may process authorised participant details, session information and demonstration interaction records.
Where simulated or synthetic information is used, we distinguish it from genuine shopper information.
Specific participant notices and access conditions may apply to restricted demonstrations.
Depending on the activity, personal information may be processed to:
Respond to enquiries and arrange demonstrations.
Manage business relationships and communications.
Provide access to authorised retailer and platform accounts.
Deliver QR-enabled shopping assistance and ARI functionality.
Maintain service integrity, security and operational accountability.
Support authorised retailer reporting and decision intelligence.
Operate agreed demonstration or pilot activities.
Manage support, contractual and regulatory obligations.
Perform authorised retail media measurement where legally permitted.
Send direct marketing communications where POPIA permits.
We seek to limit personal information to what is reasonably necessary for the relevant, explicitly defined purpose.
Information will not be treated as available for unrelated secondary purposes merely because it was collected through the platform.
Under section 11 of POPIA, processing requires an applicable lawful justification.
Depending on the specific activity and circumstances, this may include:
Consent given by the data subject or, where legally applicable, a competent person.
Processing necessary to conclude or perform a contract with the data subject.
Processing required by an obligation imposed by law.
Processing necessary to protect a legitimate interest of the data subject.
Processing necessary for the proper performance of a public-law duty, where applicable.
Processing necessary for pursuing a legitimate interest of the responsible party or a third party, subject to POPIA's requirements.
The lawful justification must be assessed for the relevant processing activity; no single justification is assumed to apply to every website, shopper, analytics or marketing activity.
Where processing relies on consent, that consent must meet the applicable legal requirements and may be withdrawn, subject to lawful limitations.
The iNteract platform distinguishes providing shopper assistance from optional behavioural analytics retention.
Where the shopper experience offers a behavioural analytics consent control, you may choose whether to grant that permission and may withdraw it through the available mechanism.
Declining optional retention does not necessarily prevent the processing of information needed to provide the requested service, meet applicable legal obligations or maintain justified security records.
Withdrawal of consent does not automatically make earlier lawful processing unlawful. Where applicable, requests concerning previously retained information may be directed to the Information Officer or the responsible retailer.
Our website and platform may use cookies, session storage or comparable browser technologies for purposes such as:
Supporting website or platform functionality.
Managing sessions and permitted user preferences.
Maintaining security and preventing misuse.
Understanding website performance where analytics technologies are enabled.
Some shopper interaction commands and session information may be stored temporarily in the browser.
Browser storage, cookies and server-side records are distinct, and clearing one does not necessarily remove the others.
You may manage available browser settings, although restricting certain technologies may affect functionality.
Further details of specific cookies, analytics providers, purposes and retention will be made available in the relevant cookie or collection notice where applicable.
Where necessary and legally permitted, information may be disclosed to:
Authorised iNteract personnel or service providers.
The relevant retailer and its authorised users, according to applicable roles and restrictions.
Cloud hosting, database, authentication and infrastructure service providers.
AI service providers where necessary to process an authorised request.
Support and professional advisers where appropriately authorised.
Regulatory authorities or other recipients where disclosure is required or permitted by law.
Retail media participants only where the relevant purposes, recipient arrangements and safeguards authorise such sharing.
Our technical environment includes Google/Firebase-related services and Gemini-related AI functionality, while our corporate website uses separate hosting arrangements.
The exact contractual terms, recipients, processing locations and supplier responsibilities are subject to the relevant service configuration and agreement.
We do not authorise unrelated use or resale of personal information merely because a party provides a service to iNteract.
Some infrastructure or service providers may process information outside South Africa.
Where a transfer of personal information to a recipient in another country takes place, the responsible party must ensure that an applicable condition under section 72 of POPIA is satisfied.
Depending on the circumstances, this may involve appropriate legal or contractual protections, valid consent or another statutory transfer condition.
The location of a cloud service's configuration does not, by itself, establish every location where personal information is processed or accessed.
We aim to limit retention of personal information to the period reasonably necessary for its authorised purpose or for a period required or permitted by applicable law.
Different retention requirements may apply to:
Website enquiries and business correspondence.
Retailer accounts and access records.
QR sessions and interaction events.
AI assistance and any consent-authorised retained content.
Basket and checkout-handoff records.
Audit, security and operational logs.
Legal, contractual or regulatory records.
Retention, deletion, backup and lawful-hold requirements may differ between these categories.
Where a deletion request is made, we assess the applicable legal obligations, the nature of the information, the identity or authority of the requester and the systems in which relevant records may be held.
A session or operational record reaching its expiry time does not necessarily mean every associated record has already been permanently deleted.
iNteract uses technical and organisational safeguards designed to protect information against unauthorised access, loss, alteration or unlawful processing.
Depending on the relevant system, these include:
Authentication and role-based access restrictions.
Retailer-specific access and tenant boundaries.
Server-side authorisation and purpose-specific controls.
AI input minimisation and controlled interaction processing.
Security logging and operational accountability measures.
Defined incident management and escalation procedures.
Security risks cannot be eliminated completely. Safeguards, infrastructure settings and operating effectiveness must be reviewed and maintained as the platform develops.
Where a security compromise triggers POPIA's notification requirements, the appropriate responsible party must assess and carry out the required notifications in accordance with section 22.
Subject to the applicable requirements and limitations, you may have the right to:
Ask whether we hold personal information about you.
Request access to relevant personal information.
Request correction or deletion where legally justified.
Object to particular processing where POPIA permits.
Withdraw consent where processing relies on consent.
Object to or opt out of qualifying direct marketing.
Lodge a complaint with the Information Regulator.
Requests may be submitted to johan@interactaoe.co.za with the subject line Privacy Request.
We may request proportionate verification before releasing or modifying personal information.
Where a retailer is responsible for the relevant processing, a request may need to be referred to or coordinated with that retailer.
For shoppers using sessions without registered identities, we may not always be able to identify a particular individual from an anonymous or pseudonymous session reference alone. We will assess what can reasonably and lawfully be verified and acted upon.
Business enquiries, service communications and optional marketing communications serve different purposes.
Where we send direct marketing by electronic means, we will apply the relevant requirements of POPIA, including section 69.
Where consent is required, we will obtain it through an appropriate mechanism rather than assuming consent from ordinary website use.
You may request that qualifying marketing communications stop by using the available unsubscribe method or contacting the Information Officer.
iNteract's business website and enterprise platform are not specifically directed at children.
However, QR experiences may be accessible in physical retail environments.
Processing personal information relating to children requires the protections prescribed by POPIA, including an applicable exception or consent from a competent person where required.
Users should not submit unnecessary information about children through ARI or other services.
If you believe information about a child has been processed inappropriately, contact the Information Officer so the circumstances can be assessed.
Our website or platform may link to external websites, retailer resources or third-party services.
Those services may operate under their own privacy notices and terms. We encourage users to review the applicable notices before providing information to third parties.
For questions about this policy or requests concerning personal information processed by iNteract:
iNteract (Pty) Ltd
Information Officer
Email: johan@interactaoe.co.za
Website: www.interactaoe.co.za
You may also contact the South African Information Regulator:
Information Regulator (South Africa)
Website: https://inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200
Where your request concerns records under the Promotion of Access to Information Act (PAIA), the applicable PAIA request procedure and manual govern access to those records.
We may amend this Privacy Policy to reflect changes in our services, legal requirements, suppliers or processing activities.
The effective date displayed above will be updated when a revised version is published.
Where a change requires additional notification or a new lawful justification, we will address those requirements rather than relying solely on continued website use as acceptance.