POPIA Privacy Notice

1.About this notice

1. AutoHive Marketing (Pty) Ltd, registration number 2025/756077/07, is the responsible party for the personal information described in this notice. In this notice, "we", "us" and "our" mean AutoHive Marketing (Pty) Ltd.
2. This notice applies to every AutoHive property, including autohive.co.za, thinktank.co.za, glasscastleluxury.co.za, beehive.autohive.co.za, and any AutoHive division subdomain.
3. It also applies to personal information we collect offline, including at the studio, over WhatsApp, by email and by telephone.
4. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the eight conditions for lawful processing it sets out.

2.The information we collect

1. Information you give us directly:
   1. Identity and contact information: name, email address, mobile number, company or trading name, city.
   2. Booking information: dates, package selected, crew requirements, special requests.
   3. Network application information: role applied for, portfolio and website links, day rate or retainer, availability, professional registration numbers, and any document, reel or rate card you attach.
   4. Payment information: proof of payment and banking reference. We do not store full card numbers.
   5. Correspondence: the content of emails, WhatsApp messages and enquiry forms you send us.
2. Information we collect automatically:
   1. Technical information: IP address, browser type, device type, operating system, referring page, pages viewed and time spent.
   2. Cookie and similar storage information: see our separate Cookie Policy, which forms part of this notice.
3. Information created during a booking:
   1. Recorded footage and audio, including the images and voices of everyone who appears in it.
   2. Access logs and equipment condition records. No CCTV operates at the studio.

3.Where we get it

1. Directly from you, when you enquire, book, apply, subscribe or correspond with us.
2. From your device, when you visit one of our websites.
3. From a client who books you through the BeeHive Business Network, or from a Bee who works on your booking.
4. From publicly available sources, such as a portfolio or professional profile you have published.

4.Why we process it, and on what basis

POPIA requires a lawful justification for every processing activity. Ours are set out below.

5.Recordings made at the studio

1. When you book the studio, you control the recording. You decide who appears in it and what is said. You are the responsible party for the personal information in your own footage.
2. We hold that footage only to deliver it to you, and only for the period in section 10.
3. It is your responsibility to obtain consent from every person who appears in your recording, including guests, before recording begins.
4. We do not use client footage for our own marketing without separate written permission.

6.Special personal information: voices, faces and biometrics

1. Our AI cloning services create a synthetic version of a voice or likeness. Under POPIA this involves biometric information, which is special personal information.
2. We process it only with your explicit, specific and informed written consent, given for a defined purpose, under section 27(1)(a).
3. We create clones only for the registered owner of the voice or likeness. We verify identity before any clone is built. We do not clone third parties.
4. Every clone is created under one of two written agreements: a Client Self Use Agreement, where you commission a clone of your own voice or likeness for your own use, or a Talent or Artist Agreement, where royalties are payable for the licensed use of your voice or likeness. The applicable agreement records the defined purpose for which section 27(1)(a) consent is given.
5. You may withdraw consent at any time. On withdrawal, we stop creating new output and delete the voice or face model. Output already produced and published before withdrawal remains governed by the applicable agreement in clause 6.4, including any licence or royalty terms it contains, and we will tell you plainly what remains in circulation and why. [CONFIRM agreement wording with attorney]
6. We do not process any other category of special personal information listed in section 26, being religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, or criminal behaviour.

7.Children

1. Our services and the BeeHive Business Network are open only to persons aged 18 or older.
2. Age is verified against identity documentation at sign up. An application without verified age is not assessed.
3. We do not knowingly process the personal information of a child under 18. If you believe we hold a child's personal information, contact the Information Officer and we will delete it.

8.Who we share it with

1. We share personal information with operators who process it on our behalf, under written contract, and only on our instructions.

2. Where you book a certified Bee through the BeeHive Business Network, we share the information necessary for them to quote and deliver the work. That Bee is a separate responsible party for the information you then give them directly.
3. We may share information where the law requires it, or to establish, exercise or defend a legal claim.
4. We do not sell personal information.
5. If any operator notifies us of a confirmed security compromise, we act under section 11.6 of this notice. Written operator agreements are being confirmed for every operator listed. [CONFIRM signed agreements per operator]

9.Sending information outside South Africa

1. Several of our operators host data outside South Africa. Section 72 of POPIA permits this only in defined circumstances.
2. We rely on the recipient being subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection substantially similar to POPIA, as contemplated in section 72(1)(a). Our primary database is hosted in the United Kingdom (AWS eu-west-2, London), which maintains a recognised data protection regime under the UK GDPR and Data Protection Act 2018.
3. Where that cannot be established, we rely on your consent under section 72(1)(b), or on the transfer being necessary to perform a contract with you under section 72(1)(c).

10.How long we keep it

1. When a retention period ends we delete the information or de-identify it so it can no longer be linked to you.

11.How we protect it

1. Encryption in transit on every website, using HTTPS.
2. Access to client files restricted to named individuals, with two-factor authentication on the Client Portal.
3. Database access controlled by row level security, so a client can reach only their own records.
4. An audit log of access to client files, which you may request.
5. Alarm-monitored premises and off-street parking at the studio.
6. If a security compromise occurs, we notify the Information Regulator and every affected person as soon as reasonably possible, as section 22 requires.

12.Your rights

POPIA gives you the following rights. We do not charge for exercising them, except where a request is manifestly unfounded or excessive.

1. To be told what personal information we hold about you, and to receive a copy, under section 23.
2. To ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, under section 24.
3. To object to processing based on legitimate interests, under section 11(3).
4. To withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing that already happened lawfully.
5. To object to direct marketing at any time, under section 11(3)(b).
6. Not to be subject to a decision based solely on automated processing that has legal consequences for you, under section 71.
7. To complain to the Information Regulator, under section 74.

13.How to exercise a right

1. Write to the Information Officer at Buzz@autohive.co.za.
2. For access and correction requests, POPIA requires the prescribed forms. Form 2 is used for access, Form 3 for correction or deletion. We will send you the current form on request.
3. We respond within 30 days. If we need longer, we tell you why before that period ends.
4. We may ask you to verify your identity before we release information, to protect you.

14.Complaints to the Information Regulator

If you are not satisfied with how we have handled your information or your request, you may complain directly to the Regulator.

15.Direct marketing

1. We send electronic marketing only where section 69 of POPIA permits it.
2. If you are an existing customer, we may market similar services to you, and every message carries an unsubscribe link.
3. If you are not an existing customer, we ask for your consent once. If you decline or do not respond, we do not ask again.
4. You can opt out at any time by using the unsubscribe link or writing to Buzz@autohive.co.za.

16.Changes to this notice

1. We review this notice at least once a year and whenever our processing changes materially.
2. The version number and effective date at the top of this document tell you which version applies.
3. Where a change materially affects you, we tell you directly rather than relying on you noticing.

17.Contact