Privacy Policy
Last updated: 25 September 2026
This policy explains what personal information Bam Cloud AI (Pty) Ltd collects, why, who it goes to, how long it is kept, and what you can do about it. It is written to meet section 18 of the Protection of Personal Information Act 4 of 2013 (POPIA) and section 43 of the Electronic Communications and Transactions Act 25 of 2002 (ECTA). Our PAIA Manual (Promotion of Access to Information Act 2 of 2000) sets out how to request records we hold.
1. Who is responsible for your information
The responsible party is Bam Cloud AI (Pty) Ltd, registration number 2026/578688/07, a private company incorporated in South Africa. Our Information Officer is Gustav Bam, sole director.
- Email: gustav@bamcloudai.com
- Telephone: 081 025 3722
- Physical address (also our address for service of legal documents): 2 Eike Street, Wellway Park, Durbanville, 7550, South Africa
- Website: bamcloudai.com
2. What we collect, and where it comes from
We collect personal information directly from you, and only what we need for the purpose described. We do not buy contact lists.
| Where | What we collect |
|---|---|
| Enquiry form (Tell Us What You Need) | First and last name, email address, telephone number, company, company website, job title, the type of enquiry and topic, audience type, number of attendees, preferred format, timeframe, time zone, a description of your current environment, your goals and any notes you add. |
| AI Readiness Assessment | First and last name, email address, telephone number, company, company website, job title, company type and size, current Microsoft licensing, intended rollout scope, urgency, your biggest concern, the outcomes you expect, the people who should join a follow-up call, your preferred next step and any notes you add. |
| Email, calls and bookings | Your name, email address, telephone number if you give it, and what you tell us. Calls are booked through Microsoft Bookings. |
| Payments | Payer name, email address, amount and payment reference. Card and bank details are entered on PayFast's or Payoneer's own pages. We never see or store your card details. |
| Training delivery | Delegate names and email addresses, attendance, and course evaluation responses. For courses that include an exam voucher, the delegate's name and email address are used to issue the voucher. |
| Contracts and invoicing | Company details, billing contact, purchase-order and invoice details. |
| Visiting the website | Technical data such as your IP address and browser type, processed by our hosting provider and by the services listed in section 9. We do not use advertising or tracking cookies. |
3. Why we use it, and on what legal basis
- To respond to your enquiry and prepare a proposal: steps you asked us to take before a contract (POPIA s11(1)(b)).
- To deliver the training or consulting you bought, and to invoice for it: performance of a contract (s11(1)(b)).
- To keep accounting and tax records: legal obligation (s11(1)(c)) under the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011.
- To record training deliveries and course evaluations, which the Microsoft Certified Trainer (MCT) programme requires: our legitimate interest (s11(1)(f)).
- To send you news or offers by email: only if you have agreed to it, or you are an existing client and the message concerns similar services (s69). Every such message carries an opt-out.
We will not use your information for a purpose that is incompatible with the reason you gave it to us.
4. Is giving us information compulsory?
No. It is voluntary. Fields marked as required on our forms are the minimum we need to reply to you. If you leave them out, we may not be able to respond or deliver the service. No law requires you to give us information through the website. Certain records are required by law once you become a client (for example, invoices under tax legislation).
5. Who we share it with
We never sell your information. We share it only with the service providers (operators, in POPIA terms) that we use to run the business, and only as far as each one needs it:
| Provider | What it does for us | Where it processes data |
|---|---|---|
| HubSpot, Inc. | Receives our website form submissions; our contact database (CRM) | HubSpot's European Union data centre. HubSpot is a US company. |
| Microsoft | Email, calendar, Bookings, Teams and file storage (Microsoft 365) | Microsoft data centres, which may be inside or outside South Africa |
| Cloudflare, Inc. | Website hosting and security | Global network, including the United States |
| PayFast (Network Investment Holdings) | Local card and EFT payments | South Africa |
| Payoneer | International payments | United States and other countries |
| Pearson VUE | Issuing Microsoft exam vouchers | United States and other countries |
| Explorance (Metrics That Matter) | Course evaluation surveys required by the Microsoft Certified Trainer programme | Outside South Africa |
| Google (Google Fonts) | Serves the website's typeface. Your browser sends your IP address to Google when a page loads. | United States and other countries |
| ExchangeRate-API | Converts prices to your local currency on pricing pages. Your browser sends your IP address when it looks up a rate. | Outside South Africa |
We may also disclose information to our accountant, to the South African Revenue Service, or where a law or court order requires it.
Business English for IT sessions booked through iTalki or Preply are covered by those platforms' own privacy policies.
6. Sending information outside South Africa
Several of the providers above process information outside South Africa. Section 72 of POPIA allows this where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is needed to carry out a contract with you. We rely on each provider's data-processing terms. Information held in HubSpot's EU data centre is also protected by the EU General Data Protection Regulation (GDPR).
7. How long we keep it
- Enquiries that do not become work: deleted within 24 months of our last contact with you, or sooner if you ask.
- Client, contract and financial records: kept for seven years, as the Companies Act requires. The Tax Administration Act separately requires tax records to be kept for at least five years.
- Training delivery and evaluation records: kept for as long as the Microsoft Certified Trainer programme requires.
8. How we protect it
The website runs only over encrypted connections (HTTPS). Only the director has access to our business accounts, and the providers we use hold recognised security certifications. Payment details are handled entirely by PayFast and Payoneer. If we have reason to believe your information has been accessed without authorisation, we will notify you and the Information Regulator as section 22 of POPIA requires.
9. Cookies and local storage
We do not use advertising, tracking or analytics cookies. Pricing pages store one setting, the country you choose for currency display, in your own browser's local storage. It never leaves your device, and you can clear it in your browser settings. Our hosting provider may compile aggregate, cookie-free visit statistics.
10. Your rights
Under POPIA you may:
- ask whether we hold information about you, and for a copy of it (s23);
- ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained (s24);
- object to our use of your information on legitimate-interest grounds (s11(3));
- withdraw your consent, or opt out of direct marketing, at any time;
- complain to the Information Regulator.
Email gustav@bamcloudai.com to exercise any of these rights. We will reply within 30 days. Requests for access to other records are handled under our PAIA Manual.
11. The Information Regulator
If you are not satisfied with how we have handled your information, you may lodge a complaint with the Information Regulator (South Africa):
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Email: enquiries@inforegulator.org.za · Toll-free: 0800 017 160
- Website: inforegulator.org.za
12. Changes to this policy
We will update this policy whenever our processing changes. The date at the top of this page shows the latest revision.