Effective date: 1 January 2026
Last updated: 27 August 2026
1. About this Privacy Policy
This Privacy Policy explains how personal information is collected, used, stored, shared, and protected by:
Divblox (Pty) Ltd
Registration number: 2021/927569/07
Divblox provides the Divblox software product, subscriptions, licences, hosted environments, product support, and related add-ons.
Stratusolve (Pty) Ltd
Registration number: 2014/176066/07
Stratusolve provides professional services, including software development, implementation, configuration, migration, integration, consulting, and training.
Both companies operate from:
39 Sovereign Drive
Route 21 Corporate Park
Irene, 0178
South Africa
In this Privacy Policy:
- “Divblox” means Divblox (Pty) Ltd;
- “Stratusolve” means Stratusolve (Pty) Ltd;
- “we”, “us” or “our” means Divblox or Stratusolve, depending on which company collects or processes the relevant personal information;
- “customer” means a person or organisation using or purchasing a Divblox product or Stratusolve service;
- “user” means a person who accesses a website, account, product, project, deployment, or service covered by this Policy; and
- “personal information” has the meaning given to it under the Protection of Personal Information Act, 2013 (“POPIA”).
This Policy applies to our websites, customer accounts, software products, hosted environments, support channels, business communications, and professional-services engagements.
2. Our roles under POPIA
Our role depends on why and how personal information is processed.
2.1 When we are responsible parties
Divblox or Stratusolve acts as a responsible party when it determines why and how personal information is processed. This generally includes personal information used for:
- account creation and administration;
- subscriptions and product delivery;
- quotations, contracts, and professional-services engagements;
- invoicing and payment administration;
- customer support;
- security, fraud prevention, and abuse detection;
- legal and regulatory compliance;
- product and service improvement; and
- marketing our own products or services where permitted.
The company identified on the applicable website, account, quotation, Order Form, invoice, or statement of work will ordinarily be the responsible party.
2.2 When we process information for customers
A customer may place personal information in a Divblox project, application, database, hosted environment, support request, or professional-services engagement.
Where the customer determines why and how that personal information is processed, the customer is ordinarily the responsible party and Divblox or Stratusolve acts as an operator on the customer’s behalf.
In that situation, we will process the personal information:
- in accordance with the customer’s lawful instructions;
- to provide and secure the contracted product or service;
- subject to confidentiality obligations;
- in accordance with the applicable agreement; and
- as otherwise required by law.
The customer is responsible for ensuring that it has a lawful basis for collecting and using personal information placed in its projects or provided to us for processing.
Requests relating to personal information controlled by a customer should ordinarily be directed to that customer. We will reasonably assist the customer in responding where required by law or the applicable agreement.
3. Personal information we collect
Depending on how you interact with us, we may collect the following categories of personal information.
3.1 Identity and contact information
This may include:
- name and surname;
- username;
- job title or role;
- employer or organisation;
- email address;
- telephone number;
- physical or postal address; and
- account or customer identifiers.
3.2 Account information
This may include:
- login credentials in protected form;
- authentication information;
- account preferences;
- subscription or licence details;
- organisation and team membership;
- permissions and access roles;
- project membership; and
- account activity.
You are responsible for keeping your credentials confidential and notifying us if you suspect unauthorised access to your account.
3.3 Billing and transaction information
This may include:
- billing name and address;
- company and tax information;
- quotations, Order Forms, and invoices;
- payment status;
- transaction references;
- subscription and purchase history; and
- information required to prevent fraud or reconcile payments.
Where payment is processed by a third-party payment provider, that provider may collect payment-card or banking details directly. We may receive limited transaction information, such as the payment status, amount, date, and transaction reference.
3.4 Product and technical information
When you use a Divblox website, product, hosted environment, or deployment, we may collect:
- IP address;
- device and browser type;
- operating system;
- language and time-zone settings;
- session and authentication events;
- pages and features accessed;
- dates, times, and duration of activity;
- error reports and diagnostic information;
- deployment and environment metadata;
- system performance information;
- API activity;
- security events; and
- audit and activity logs.
3.5 Project and customer data
Customers may submit, generate, store, or process information through Divblox projects, applications, databases, components, integrations, and hosted environments.
This information may include personal information relating to the customer’s employees, contractors, users, clients, suppliers, or other individuals.
The customer determines what information is placed in its projects and is responsible for ensuring that this is lawful, appropriate, and adequately disclosed to affected persons.
We do not use customer-controlled project data for our own unrelated marketing purposes.
3.6 Support and communications information
When you contact us, we may collect:
- the content of support requests;
- emails and other correspondence;
- call or meeting details;
- attachments, screenshots, and diagnostic files;
- feedback and survey responses;
- records of decisions and instructions; and
- information required to investigate and resolve a request.
Please avoid including unnecessary personal information, passwords, private keys, or live credentials in support communications.
3.7 Professional-services information
During a Stratusolve engagement, we may process:
- project requirements;
- business-process information;
- system documentation;
- project plans;
- meeting notes;
- customer instructions;
- source code and configuration;
- test and production data;
- user and stakeholder information;
- access credentials provided for the engagement; and
- other information required to perform the agreed services.
Where practical, customers should use test or de-identified data for development and testing.
3.8 Marketing information
This may include:
- marketing preferences;
- consent records;
- event registrations;
- newsletter subscriptions;
- responses to campaigns;
- previous enquiries or purchases; and
- records of opt-out requests.
3.9 Special personal information and children’s information
Our products and services are not designed specifically to collect special personal information or information about children.
Customers should not place special personal information or children’s information in a Divblox project or provide it to Stratusolve unless:
- it is genuinely required for the customer’s lawful purpose;
- the customer is legally authorised to process it;
- appropriate security measures are implemented; and
- any required contractual arrangements or prior authorisations are in place.
If we become aware that such information is being processed unlawfully, we may restrict or remove it and take other appropriate action.
4. How we collect personal information
We may collect personal information:
- directly from you;
- when you create or use an account;
- when you purchase a subscription or service;
- when you communicate with us;
- through your use of our websites, products, and hosted environments;
- from your employer, organisation, or account administrator;
- from a customer that authorises you to use its project or account;
- from payment, hosting, authentication, security, and other service providers;
- from integrations that you or a customer enable;
- from lawful public sources; and
- where otherwise permitted or required by law.
If you provide us with another person’s personal information, you must be authorised to do so and must provide any notices required by law.
5. Why we process personal information
We may process personal information to:
- create and administer accounts;
- verify identity and authority;
- provide, operate, maintain, and secure Divblox products;
- provide Stratusolve professional services;
- configure and manage projects and hosted environments;
- process subscriptions, invoices, and payments;
- communicate about accounts, projects, incidents, and services;
- provide technical and customer support;
- diagnose errors and improve performance;
- develop and improve products and services;
- manage customer and supplier relationships;
- prevent fraud, abuse, unauthorised access, and unlawful activity;
- maintain audit, security, and transaction records;
- enforce our agreements and protect our rights;
- comply with legal, tax, accounting, and regulatory obligations;
- establish, exercise, or defend legal claims;
- send service announcements and operational communications;
- send marketing communications where permitted; and
- create aggregated or de-identified information that does not reasonably identify a person.
We will not process personal information in a manner that is incompatible with the purpose for which it was collected unless permitted by law.
6. Grounds on which we process personal information
Depending on the circumstances, we may process personal information:
- with the data subject’s consent;
- to conclude or perform a contract;
- to comply with a legal obligation;
- to protect a legitimate interest of the data subject;
- to pursue our legitimate interests or those of a third party, provided the data subject’s rights are appropriately protected; or
- where otherwise authorised by law.
Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.
Some information is required to provide an account, subscription, product, or professional service. If that information is not provided, we may be unable to supply the requested product or service.
7. How we share personal information
We may share personal information only where reasonably necessary and permitted by law.
Recipients may include:
- Divblox or Stratusolve personnel who require access for their work;
- the other company where necessary to provide an integrated product or service;
- cloud hosting and infrastructure providers;
- payment and billing providers;
- authentication, communications, analytics, monitoring, and security providers;
- professional advisers, auditors, insurers, and financial institutions;
- contractors and subcontractors assisting with an authorised engagement;
- regulators, law-enforcement agencies, courts, and government authorities;
- a purchaser, investor, or successor involved in a proposed or completed corporate transaction; and
- other parties where you or the responsible customer instructs or authorises us to share the information.
Operators and service providers are required to process personal information only for authorised purposes and to apply appropriate confidentiality and security measures.
We do not sell personal information.
8. Customer administrators and team accounts
If your account is created or managed by an organisation, its authorised administrators may be able to:
- add, remove, or suspend users;
- manage permissions and roles;
- access account and project activity;
- manage subscriptions and billing;
- control projects and hosted environments;
- access or export information associated with the organisation’s account; and
- configure security and retention settings.
Your use of an organisation-managed account may also be subject to that organisation’s own privacy notices, policies, and instructions.
9. Cookies and similar technologies
Our websites and products may use cookies, local storage, pixels, and similar technologies.
These technologies may be used to:
- keep users signed in;
- maintain security;
- remember settings and preferences;
- operate requested functionality;
- understand website and product performance;
- diagnose errors;
- measure usage; and
- support marketing where permitted.
Some cookies are necessary for our websites or products to operate. Where required by law, non-essential cookies will be used only after you have been given an appropriate choice.
You can manage cookies through your browser or available cookie settings. Blocking necessary cookies may prevent parts of a website or product from working correctly.
10. Marketing communications
We may send information about Divblox products or Stratusolve services where:
- you have consented;
- you are an existing customer and the communication concerns similar products or services, where permitted by law; or
- another lawful ground applies.
Marketing communications will identify the sender and provide a reasonable way to opt out.
You may unsubscribe at any time by:
- using the unsubscribe option in the communication;
- emailing support@divblox.com for Divblox communications; or
- emailing info@stratusolve.com for Stratusolve communications.
Opting out of marketing will not prevent necessary account, billing, security, project, or service communications.
We will not charge you for withdrawing consent or objecting to direct marketing.
11. International processing and transfers
Our service providers, infrastructure, personnel, or customers may be located outside South Africa. Personal information may therefore be processed or stored in another country.
Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer is permitted under POPIA. Depending on the circumstances, these steps may include:
- transferring information to a recipient subject to an adequate data-protection law;
- entering into a binding agreement that provides an appropriate level of protection;
- obtaining consent where appropriate;
- transferring information where necessary to perform a contract; or
- relying on another lawful basis under POPIA.
Customers are responsible for configuring their projects and selecting deployment locations in a manner consistent with their own legal obligations.
12. Information security
We use appropriate and reasonable technical and organisational measures designed to protect personal information against:
- accidental or unlawful loss;
- damage or destruction;
- unauthorised access;
- unauthorised disclosure;
- alteration; and
- unlawful processing.
Measures may include, where appropriate:
- access controls and authentication;
- encryption in transit or at rest;
- logging and monitoring;
- vulnerability and patch management;
- backups and recovery measures;
- personnel confidentiality obligations;
- security policies and training;
- supplier security assessments; and
- incident-response procedures.
No system is completely secure. Customers and users must also take reasonable precautions, including protecting credentials, applying appropriate permissions, maintaining backups, and securely configuring their applications and environments.
13. Security compromises
If we reasonably believe that personal information under our control has been accessed or acquired by an unauthorised person, we will investigate and take appropriate containment and remediation steps.
Where we are the responsible party, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to applicable law and any lawful instruction delaying notification.
Where we act as an operator for a customer, we will notify the responsible customer as soon as reasonably possible after becoming aware of a relevant security compromise. The customer remains responsible for regulatory and data-subject notifications unless the applicable agreement or law provides otherwise.
Security concerns affecting Divblox should be reported promptly to support@divblox.com. Concerns relating to a Stratusolve professional-services engagement should be reported to info@stratusolve.com.
14. Retention of personal information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected or as required or authorised by law.
Retention periods depend on:
- the type and sensitivity of the information;
- the duration of the customer relationship;
- contractual commitments;
- security and fraud-prevention requirements;
- legal, tax, accounting, and regulatory obligations;
- applicable limitation periods;
- dispute and enforcement requirements; and
- customer instructions where we act as an operator.
Account and project information may be deleted, de-identified, or archived after termination.
Unless a different period is agreed, Divblox will ordinarily allow up to 30 calendar days after termination for a customer to request a reasonable export of customer-controlled data. Data may remain in protected backups for a limited period until those backups are overwritten in accordance with normal retention cycles.
We may retain de-identified or aggregated information that can no longer reasonably identify a person.
15. Your rights
Subject to applicable law, you may have the right to:
- ask whether we hold personal information about you;
- request access to that personal information;
- request correction of inaccurate, incomplete, outdated, excessive, or misleading information;
- request deletion or destruction where we are no longer authorised to retain the information;
- object to processing on reasonable grounds;
- withdraw consent where processing is based on consent;
- object to direct marketing;
- request restriction of processing while a dispute is being resolved;
- lodge a complaint with the Information Regulator; and
- challenge certain decisions based solely on automated processing.
These rights may be subject to lawful limitations, including the rights of other persons, legal privilege, security requirements, and record-retention obligations.
16. Exercising your rights
For personal information controlled by Divblox, submit your request to:
For personal information controlled by Stratusolve, submit your request to:
Please include:
- your name and contact details;
- the company or account concerned;
- a description of your request;
- enough information to identify the relevant records; and
- any supporting information reasonably required.
We may need to verify your identity and authority before acting on a request.
Where Divblox or Stratusolve processes information solely on behalf of a customer, we may refer the request to that customer or ask you to contact it directly.
We will respond within the period required by applicable law. If we cannot fulfil a request, we will explain the lawful reason where permitted.
Requests for correction or deletion may be made using the forms published by the Information Regulator or in another substantially similar manner permitted by law.
17. Automated decision-making
We may use automation to support security monitoring, fraud detection, spam prevention, system administration, and product functionality.
We do not ordinarily make decisions based solely on automated processing that have legal consequences or similarly significant effects on a person.
If such processing is introduced, we will apply the safeguards and notices required by law.
18. Children
Our websites, products, and professional services are intended primarily for businesses, organisations, developers, and adult users.
We do not knowingly collect personal information directly from children without appropriate authorisation.
If you believe that a child’s personal information has been provided to us unlawfully, contact support@divblox.com or info@stratusolve.com, as applicable.
Customers using Divblox to create services involving children are responsible for obtaining the required consent or other legal authority and implementing appropriate protections.
19. Third-party websites and integrations
Our websites and products may contain links to third-party websites or allow customers to enable third-party integrations.
Those third parties operate under their own terms and privacy policies. We are not responsible for their independent privacy practices.
Customers should review the privacy and security terms of a third-party service before enabling an integration or sending personal information to it.
20. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in:
- our products or services;
- how we process personal information;
- applicable law;
- regulatory guidance; or
- our security and operational practices.
The updated Policy will display its effective or last-updated date.
Where a change materially affects how we use personal information, we will provide reasonable notice through the relevant website, product, account, or contact details where appropriate.
21. Complaints
Please contact us first if you have a privacy concern so that we can investigate and attempt to resolve it.
You may also lodge a complaint with the South African Information Regulator:
Information Regulator South Africa
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg, South Africa
Telephone: 010 023 5200
Email: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za/
22. Contact details
Divblox privacy enquiries
Divblox (Pty) Ltd
Registration number: 2021/927569/07
39 Sovereign Drive
Route 21 Corporate Park
Irene, 0178
South Africa
Privacy, product support, billing, and account enquiries: support@divblox.com
Stratusolve privacy enquiries
Stratusolve (Pty) Ltd
Registration number: 2014/176066/07
39 Sovereign Drive
Route 21 Corporate Park
Irene, 0178
South Africa
Privacy and professional-services enquiries: info@stratusolve.com