Privacy
Privacy notice
FLATELA (PTY) LTD 2026/291183/07
Version: 2.2 · Effective date: 2 November 2026
This notice explains how FLATELA (PTY) LTD ("Flatela", "we", "us") handles personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It replaces the notice dated September 2026.
1. Who we are (responsible party)
- Legal name: FLATELA (PTY) LTD, registration number 2026/291183/07, a private company registered in South Africa on 9 April 2026.
- Registered address: 75 Kanna Street, Northmead Ext 4, Benoni, 1501, Gauteng, South Africa.
- Information Officer: Khwezi Flatela, Director.
- Privacy and general contact: info@khemoconnect.co.za. This mailbox sits on a domain held by a related business, Khemo IT Solutions CC, and is read only by our director and Information Officer, Khwezi Flatela, for FLATELA (PTY) LTD. FLATELA (PTY) LTD alone is responsible for your information.
2. Websites this notice covers
- flatelainc.co.za
- geo.cpitu.com (free GEO snapshot)
- firms.cpitu.com (free Firm IT Risk Checklist)
- site.cpitu.com (free first-website checklist)
- fix.cpitu.com (free email and SSL domain check)
- hello.cpitu.com (our transactional email sender, hello@hello.cpitu.com; it hosts no pages)
- flatela.cpitu.com (our business outreach email addresses, such as khwezi@flatela.cpitu.com and hello@flatela.cpitu.com; it hosts no pages)
All of these are operated by FLATELA (PTY) LTD. Our offer terms are at https://flatelainc.co.za/offer-terms.
3. What we collect
If you email us: whatever you send, usually your name, email address and the content of your message.
If you sign up on one of our offer pages:
- your first name;
- your email address;
- one field linked to the offer: your business website (geo.), the number of users at your firm (firms.), your business name (site.) or your domain (fix.);
- your IP address and the time you submitted the form;
- a consent record: the page, the form version, the version of this notice, whether you ticked the marketing box, and when you clicked the confirmation link.
Technical logs: our hosting and DNS providers process standard logs (IP address, browser user agent, time of request) to serve and secure the sites.
We do not ask for ID numbers, banking details or special personal information on these pages.
4. Why we use it and our lawful basis (POPIA s11)
| Purpose | Lawful basis |
|---|---|
| Sending the free resource you asked for, and the confirmation email that comes first | You asked for it (s11(1)(b), steps at your request) and our legitimate interest in answering requests (s11(1)(f)) |
| Replying to your enquiries | Your request and our legitimate interest |
| Sending tips and offers by email | Your consent (s11(1)(a)), given by ticking the marketing box and confirming by email |
| Keeping consent and opt-out records | Our legal obligation to show consent and honour opt-outs, and our legitimate interest |
| Securing the sites and preventing abuse | Our legitimate interest |
We do not sell personal information and we do not use it for automated decision-making.
You may object to processing based on legitimate interest at any time under s11(3) by writing to info@khemoconnect.co.za. If you object, we stop unless the law allows us to continue.
5. Direct marketing (POPIA s69)
- Opt-in only. We send marketing only if you tick the marketing box (it is never ticked for you) and confirm by email. You get the free resource whether or not you tick it.
- Consent is per offer. Consent given on one page covers tips and offers about that page's services only. It is not consent for our other offers.
- Every marketing email names FLATELA (PTY) LTD, gives our contact details and tells you how to unsubscribe, either by a link or by replying STOP. We stop within 24 hours.
- One suppression list. Unsubscribes and "do not contact" requests from any of our pages or emails go on one shared suppression list. We check that list before every marketing email and before any outreach by email or phone from any part of Flatela.
5A. Business outreach
If we emailed you without you signing up, this section applies. FLATELA (PTY) LTD may email a business contact once to ask whether they want to hear from us (POPIA s69(2)).
- What we hold: your business name, the contact name and email address your business lists publicly, your business phone number and website.
- Where we got it: your business's public map listing, and in some cases public business directories or your own website. We do not buy contact lists.
- Why: to ask once whether you agree to receive emails about our services. If you don't say yes, we don't email you about them again.
- How long we keep it: if you don't agree, we keep only your email address on our do-not-contact list, so we never email you again. Other details are deleted within 30 days.
- Your choices: reply STOP, or email the sending address with the subject STOP. You can also use the rights in section 10.
6. Double opt-in and how long we keep information
- When you submit a form we email you a confirmation link from hello@hello.cpitu.com. Nothing else is sent until you click it.
- Unconfirmed sign-ups (you never click the link) are deleted 30 days after submission.
- Confirmed sign-ups without marketing consent are deleted 12 months after we deliver the free resource.
- Confirmed sign-ups with marketing consent are kept while you remain subscribed. If you unsubscribe, we delete your lead details and keep only what the suppression list needs.
- Consent records are kept for at least 12 months.
- Suppression records (your email address and the date you opted out) are kept for as long as we need them to honour your opt-out.
- Email enquiries are kept only as long as needed for the conversation and our ordinary business records.
- Technical logs are kept for the hosting provider's standard log period, which depends on our plan, and are not used for marketing.
7. Who processes information for us (operators, POPIA s20 and s21)
| Operator | Role | Where |
|---|---|---|
| Vercel | Website hosting and form handling | Offer-page forms: EU, Frankfurt (fra1). flatelainc.co.za functions: USA, Washington DC (iad1). Static pages served from Vercel's global network |
| Supabase | Database for leads, consent and suppression records | EU, Frankfurt (eu-central-1) |
| Resend | Confirmation and delivery emails | EU, Ireland (eu-west-1) |
| ResellersPanel | DNS for cpitu.com and flatelainc.co.za, and mailboxes for our outreach email addresses | Provider's network, which may be outside South Africa |
| Pipedrive | CRM (prospect and client records) | United Kingdom (London), with some support and security services in the USA and Switzerland |
Each operator processes information only on our instructions, under its data processing terms, which require it to keep the information confidential and secure and to tell us about any breach. We share information otherwise only where the law requires it.
8. Information sent outside South Africa (POPIA s72)
Some operators above store or process information outside South Africa, in the European Union, the United Kingdom, the United States of America, Switzerland or on their global networks. We transfer information outside South Africa only where (a) the recipient is bound by law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA (for example the EU General Data Protection Regulation or the UK General Data Protection Regulation, or the operator's data processing terms including standard contractual clauses), or (b) the transfer is necessary to carry out your request or to answer your enquiry. Our offer-page forms and lead database are kept in the European Union, and our customer relationship management (CRM) records in the United Kingdom.
9. Security (POPIA s19) and breaches (s22)
We use reasonable technical and organisational measures: HTTPS on all pages, access to the database limited to people who need it, encryption in transit, and providers with recognised security practices. If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA s22 requires.
10. Your rights (POPIA s23 to s25)
You may ask us, free of charge, whether we hold personal information about you and what it is, and ask us to correct or delete it. You may object to processing (s11(3)) and withdraw marketing consent at any time. Write to info@khemoconnect.co.za. We may need to confirm your identity first.
If you are not happy with our response, you may complain to the Information Regulator (South Africa): complaints.IR@inforegulator.org.za, www.inforegulator.org.za.
11. Cookies and tracking
We use only strictly necessary cookies, needed for the sites and forms to work. We use no analytics tags, advertising cookies or tracking pixels. If we add any in future, they will load only after you agree and will be listed in this notice first.
12. The fix.cpitu.com domain check
The checker reads only public DNS records (SPF, DKIM and DMARC) and the public SSL certificate of the domain you enter. It does not log in to, scan or test anything else on your systems.
13. Children
Our sites and services are aimed at businesses and are not aimed at anyone under 18. We do not knowingly collect information from children.
14. PAIA manual
Our manual under the Promotion of Access to Information Act 2 of 2000 is available on request from info@khemoconnect.co.za.
15. Changes
We will post any update here with a new version number and effective date. Consent records note which version you saw.
FLATELA (PTY) LTD 2026/291183/07 · 75 Kanna Street, Northmead Ext 4, Benoni, 1501, Gauteng · Offer terms: https://flatelainc.co.za/offer-terms