Privacy Policy

This Privacy Policy is issued by Ciresta Reputation Advisory (Pty) Ltd, a Private Company (Pty) Ltd trading as Ciresta, in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). It describes how personal information is processed through the website ciresta.world in the course of the reputation management services offered by Ciresta in artificial intelligence environments and in the media. Last revised: 2026.

I. Definitions

In this Policy, unless the context indicates otherwise, "Act" or "POPIA" means the Protection of Personal Information Act 4 of 2013 and its regulations; "Personal Information" means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, as defined in the Act; "Processing" means any operation concerning Personal Information, including collection, recording, storage, use, dissemination, restriction and destruction; "Responsible Party" means the party that determines the purpose and means of Processing, being Ciresta Reputation Advisory (Pty) Ltd; "Operator" means a person who processes Personal Information on behalf of the Responsible Party in terms of a contract, without coming under its direct authority; "Data Subject" means the person to whom Personal Information relates; "Information Regulator" means the regulator established under section 39 of the Act; "Services" means the reputation management, monitoring and advisory services offered by Ciresta in relation to visibility and representation in AI-generated answers and in the media; "Website" means ciresta.world; "Contact Form" means the enquiry form on the Website; and "Subscription" means the email subscription through which Ciresta sends updates and articles to subscribers; and "you" means the Data Subject.

II. Identity and Contact Details of the Responsible Party

Requests and complaints concerning Personal Information may be directed to the Information Officer of Ciresta Reputation Advisory (Pty) Ltd at the email address above, marked for the attention of the Information Officer.

III. Personal Information Collected

Personal Information reaches Ciresta through two channels on the Website. First, when you complete the Contact Form, we collect the name, email address and, where you supply it, telephone number and company name that you enter, together with the content of your message, which will ordinarily describe a reputational concern, a person or organisation of interest, or a media or AI-related enquiry. You should not include special Personal Information, such as health, religious belief, criminal behaviour or children's information, unless it is necessary to your enquiry. Second, when you join the Subscription, we collect your email address and, if requested on the sign-up form, your name, together with a record of the date and time of your consent and the technical confirmation of that consent.

In addition, the servers hosting the Website automatically record technical information such as your IP address, browser type, device type, referring page, pages viewed and the time of access. Cookies and similar technologies are used as described in our Cookie Policy. We do not knowingly collect information from persons under the age of eighteen, and the Website is not directed at them.

Where, in delivering the Services to a client, we analyse publicly available media content or the outputs of AI systems that refer to named individuals, such processing is governed by the engagement terms with that client and by this Policy as applicable, and is limited to what is necessary for the agreed purpose.

IV. Purposes and Lawful Justification

Information submitted through the Contact Form is processed to respond to your enquiry, to assess whether and how the Services may assist you, to prepare proposals, and to take steps at your request prior to entering into a contract. The justification is section 11(1)(b) of POPIA (necessary to take steps at the request of the Data Subject with a view to concluding a contract) and our legitimate interests under section 11(1)(f) in conducting and administering our business.

Your email address submitted for the Subscription is processed solely to send you newsletters and updates about reputation in AI and the media. The justification is your consent under section 11(1)(a) and, in accordance with section 69 of POPIA, direct electronic marketing is sent only to persons who have consented or who are existing clients receiving communications about similar services, each of whom may opt out at any time. Every message contains an unsubscribe link. Consent may be withdrawn without affecting the lawfulness of prior processing.

Technical data is processed to secure and operate the Website, prevent abuse, and, where you have consented, to measure and improve its performance. We also process information where required to comply with law, to establish, exercise or defend legal claims, and to maintain accounting records. We do not subject you to decisions based solely on automated processing which produce legal effects concerning you.

V. Processing Limitation and Minimality

We collect only the information that is adequate, relevant and not excessive for the purposes stated. Information is collected directly from you, save where you have authorised otherwise or where it derives from public records. Personal Information is not used for any purpose incompatible with those stated above without a fresh basis or your consent.

VI. Disclosure to Operators and Third Parties

We do not sell Personal Information. We may share it with Operators engaged under written agreements requiring them to secure and process it only on our instructions, namely our web hosting and infrastructure provider, our email delivery and subscription management provider, our email and productivity suite provider, and, where you consent, analytics providers. We may also disclose information to professional advisers, auditors and insurers under duties of confidentiality, and to public bodies or courts where required by law.

VII. Cross-Border Transfers

Some of our Operators may store or process information outside the Republic of South Africa. Under section 72 of POPIA, we transfer Personal Information abroad only where the recipient is subject to law, binding corporate rules or a binding agreement providing an adequate level of protection substantially similar to the Act, or where you consent, or where the transfer is necessary for the performance of a contract with you or at your request.

VIII. Retention

Contact Form enquiries that do not lead to an engagement are retained for up to twenty-four months from the last communication and are then deleted or de-identified. Where an engagement follows, records are retained for the duration of the contract and thereafter for the periods required by tax, company and other legislation, generally five years or longer where the law demands. Subscription data is retained until you unsubscribe, after which only a minimal suppression record, consisting of your email address and the date of opt-out, is kept so that we do not write to you again. Server logs are retained for a short operational period, ordinarily not exceeding twelve months. Records may be retained longer where necessary for a legal claim.

IX. Security Safeguards

In accordance with sections 19 to 22 of POPIA, we maintain reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction, and unlawful access to Personal Information, including encrypted transmission (HTTPS), access controls limited to personnel who need the information, and agreements with Operators. If there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected Data Subjects as soon as reasonably possible, as the Act requires.

X. Cookies

The Website uses cookies in the categories of necessary, analytics and marketing. Necessary cookies are always active. Analytics and marketing cookies are placed only after you have given consent through the cookie banner, which you may change at any time. Details appear in our Cookie Policy.

XI. Your Rights

Under POPIA you have the right to be notified that Personal Information is being collected; to establish whether we hold Personal Information about you and to request access to it; to request the correction or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained; to request the destruction or deletion of a record we are no longer authorised to retain; to object, on reasonable grounds, to Processing based on legitimate interest, and at any time to Processing for direct marketing; to withdraw consent; and to submit a complaint to the Information Regulator.

To exercise any right, write to [email protected] or to 412 Lois Avenue, Menlyn, 0181 Pretoria, South Africa, giving your name and sufficient detail for us to identify the information concerned. We may ask you to verify your identity before acting. We will respond within a reasonable time, and generally within thirty days. Access requests are handled in line with our manual prepared under the Promotion of Access to Information Act 2 of 2000, and a prescribed fee may apply where the law permits.

XII. Complaints to the Regulator

If you consider that your Personal Information has been processed unlawfully, we invite you to contact us first so that we may resolve the matter. You are nevertheless entitled at any time to lodge a complaint with the Information Regulator (South Africa), whose current contact details are published at inform.gov.za, with complaints lodged by email to the address published there for POPIA complaints.

XIII. Links to Other Websites

The Website may contain links to third-party sites, including media publications and AI platforms. We are not responsible for their privacy practices and encourage you to read their policies.

XIV. Amendments

We may amend this Policy from time to time to reflect changes in law or in our practices. The revised version will be published on the Website with its revision date, and where a change materially affects your rights, we will take reasonable steps to notify subscribers.