Privacy Policy

1. Information We Collect

We may collect the following categories of Personal Information, depending on your interaction with us:

• Identifying information: full name, identity or company registration number, job title, and physical or postal address;
• Contact information: email address, telephone number, and social media handles;
• Business information: company name, industry, VAT number, and billing and banking details necessary for invoicing;
• Technical information: IP address, browser type and version, device information, operating system, and browsing behaviour on our Website, collected via cookies and similar technologies (see clause 4 below);
• Marketing preferences: your preferences regarding receipt of newsletters, promotional communications, and marketing content from us;
• Project-related content: briefs, brand assets, content, images, and other materials you provide to us in connection with the Services, which may incidentally include Personal Information relating to your own employees, customers, or other third parties; and
• Correspondence: records of emails, calls, meeting notes, and other communications between you and Aerion.

1.1 We collect Personal Information directly from you (for example, when you complete a contact form, request a quotation, or engage our Services), automatically through your use of our Website (for example, via cookies), and, in limited circumstances, from publicly available sources or third parties (for example, business directories or referral partners).

1.2 We do not knowingly collect Personal Information from children, and our Services are not directed at children. Should we become aware that we have inadvertently collected Personal Information from a child without the necessary parental or guardian consent, we will take reasonable steps to delete such information.

2. Purpose of Processing

We process Personal Information for the following purposes:

• to assess and respond to enquiries and requests for quotations;
• to negotiate, conclude, and perform our contractual obligations under a Client Service Agreement, including delivering the Services, invoicing, and collecting payment;
• to communicate with you regarding your project, account, and our ongoing business relationship;
• to comply with our legal, tax, and regulatory obligations, including under the Companies Act 71 of 2008 and applicable tax legislation;
• to send you direct marketing communications regarding Aerion's services, where you have consented to receive such communications or where we otherwise have a lawful basis to do so (see clause 8 below);
• to maintain the security, functionality, and performance of our Website and internal systems;
• to protect our legal rights, including the establishment, exercise, or defence of legal claims; and
• for recruitment purposes, where you apply for a position with Aerion.

3. Lawful Basis for Processing

In accordance with section 11 of POPIA, we process your Personal Information on one or more of the following lawful bases:

3.1 Consent: where you have given your clear, voluntary, and informed consent to the processing (for example, opting in to receive our newsletter);

3.2 Contractual necessity: where processing is necessary to conclude or perform a contract to which you are a party (for example, delivering the Services under a Client Service Agreement);

3.3 Legal obligation: where processing is necessary to comply with an obligation imposed on us by law (for example, retaining invoices for tax purposes);

3.4 Legitimate interest: where processing is necessary to pursue our legitimate business interests (for example, maintaining Website security, or direct marketing to existing clients regarding similar services in accordance with section 69(3) of POPIA), provided that such interest is not overridden by your own interests, rights, or freedoms; and

3.5 Public record or law: where the Personal Information appears in, or is derived from, a public record, or you have deliberately made it public.

4. Cookies and Similar Technologies

4.1 Our Website uses cookies and similar tracking technologies to enhance your browsing experience, analyse Website traffic, and, where applicable, deliver targeted advertising.

4.2 We use the following categories of cookies: (a) strictly necessary cookies, required for the Website to function correctly; (b) analytics/performance cookies, which help us understand how visitors interact with our Website (for example, via Google Analytics); and (c) marketing/advertising cookies, which are used to deliver relevant advertising and measure campaign performance (for example, via Meta Pixel or Google Ads tracking).

4.3 Where required by applicable law, we will request your consent before placing non-essential cookies on your device via a cookie consent banner on our Website. You may withdraw your consent, or manage your cookie preferences, at any time through your browser settings or our cookie preference tool (where available), although disabling certain cookies may affect the functionality of our Website.

5. Third-Party Service Providers and Sharing

5.1 We may share your Personal Information with trusted third-party service providers who assist us in operating our business and delivering the Services, including: hosting and cloud storage providers; email and communication platforms; accounting and invoicing software providers; project management and proofing tools; advertising platforms (including Meta and Google), where relevant to marketing Services provided to or on behalf of you; and professional advisors (including our auditors, attorneys, and insurers).

5.2 We require all third-party service providers to implement appropriate security measures and to process Personal Information only for the purposes for which it was shared, in accordance with POPIA.

5.3 We do not sell your Personal Information to third parties for their own independent marketing purposes.

5.4 We may disclose Personal Information where required to do so by law, regulation, court order, or a competent regulatory authority (including the Information Regulator), or where necessary to protect our rights, property, or safety, or that of our clients or the public.

5.5 Some of our third-party service providers may process Personal Information on servers located outside South Africa. Where this occurs, we take reasonable steps to ensure that such cross-border transfers comply with section 72 of POPIA, including by ensuring that the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA.

6. Data Retention

6.1 We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

6.2 As a general guideline: (a) client account and project records are retained for the duration of the business relationship and for five (5) years thereafter, in line with our obligations under applicable tax and companies legislation; (b) marketing consent records are retained until you withdraw consent or opt out, plus a reasonable period thereafter for compliance purposes; and (c) Website analytics data is retained in accordance with the retention settings of the relevant analytics provider, typically not exceeding twenty-six (26) months.

6.3 Where Personal Information is no longer required, we will securely delete, destroy, or de-identify it in accordance with our internal data retention and disposal procedures.

7. Data Security

7.1 We implement appropriate technical and organisational measures, as required by section 19 of POPIA, to safeguard Personal Information against loss, unauthorised access, interference, modification, destruction, or disclosure, including access controls, encryption of data in transit where applicable, secure password practices, restricted employee access on a need-to-know basis, and the use of reputable, security-conscious third-party service providers.

7.2 While we take reasonable steps to protect Personal Information, no method of electronic transmission or storage is entirely secure, and we cannot guarantee absolute security. Should you have reason to believe your interaction with us is no longer secure, please contact us immediately using the details in clause 9 below.

7.3 In the event of a security compromise that has, or is reasonably suspected to have, resulted in unauthorised access to or acquisition of Personal Information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with section 22 of POPIA.

8. Your Rights as a Data Subject

Subject to POPIA and any applicable exemptions, you have the right to:

• be notified that Personal Information about you is being collected, and for what purpose;
• access the Personal Information we hold about you, and request details of any third parties who have had access to it;
• request correction, updating, or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully;
• object, on reasonable grounds, to the processing of your Personal Information, including for direct marketing purposes;
• withdraw any consent you have previously given, at any time (without affecting the lawfulness of processing carried out prior to withdrawal);
• not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects for you, save in circumstances permitted under POPIA; and
• lodge a complaint with the Information Regulator if you believe your Personal Information has been processed in breach of POPIA.

8.1 To exercise any of the above rights, please contact us using the details set out in clause 9 below. We will respond to your request within a reasonable time and, where required, in accordance with the timeframes prescribed by POPIA.

8.2 We may need to verify your identity before actioning a request in order to protect your Personal Information from unauthorised access.

8.3 The Information Regulator (South Africa) may be contacted as follows, should you wish to lodge a complaint: Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; Email: complaints.IR@justice.gov.za; Website: www.justice.gov.za/inforeg/.

9. Direct Marketing

9.1 Where you have consented to receive direct marketing communications from us (for example, newsletters, promotional offers, or updates regarding our services), we will process your Personal Information for this purpose in accordance with section 69 of POPIA.

9.2 If you are an existing client, we may, in reliance on section 69(3) of POPIA, send you direct marketing communications regarding our own similar products or services, provided that we give you a reasonable opportunity to object, free of charge and in a manner free of unnecessary formality, to such use of your Personal Information at the time it was collected and on each subsequent communication.

9.3 You may opt out of direct marketing communications at any time by clicking the “unsubscribe” link in any marketing email, or by contacting us directly using the details in clause 9 below (renumbered as clause 10.4 for contact purposes). Opting out of marketing communications will not affect our ability to send you transactional or service-related communications necessary for the performance of our Services.

10. Contact Details

10.1 If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your Personal Information, please contact our Information Officer at:

Information Officer: Aerion Information Officer

Email: info@aerionbranding.com

Telephone: +27 61 278 4392

Postal / Physical Address: Cape Wagtail St, Spartan, Kempton Park, 1619, Gauteng, South Africa

11. Updates to this Privacy Policy

11.1 We may update this Privacy Policy from time to time to reflect changes in our processing practices, our Services, or applicable law. The updated version will be published on our Website at https://aerionbranding.com/privacy.html with a revised effective date.

11.2 Where a change materially affects how we process your Personal Information, we will take reasonable steps to notify you, which may include a notice on our Website or direct communication where appropriate.

11.3 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your Personal Information.