Privacy Policy

Who this policy applies to

This Privacy Policy applies when you:

• visit or interact with the Haillo website;
• create or use a Haillo account;
• communicate with us;
• request a demonstration, quotation or support;
• use the Haillo platform;
• interact with a business using Haillo to provide voice, messaging, WhatsApp or other automated services; or
• otherwise have your personal information processed through our services.

Depending on the circumstances, Haillo may process information either as a Responsible Party or as an Operator, as those terms are defined under POPIA.

When we determine the purpose and means of processing personal information, such as information relating to our customers, website visitors and prospective customers, Haillo generally acts as the Responsible Party.

When one of our customers uses Haillo to process information about its customers, employees or other individuals, that customer will generally be the Responsible Party and Haillo will process the information as its Operator and in accordance with the customer’s instructions.

Personal information we may collect

The information we process depends on how you interact with Haillo and how our customers configure the platform.

Information you provide to us

This may include:

• your name and surname;
• email address;
• telephone number;
• company name and job title;
• account and profile information;
• billing and transaction information;
• support requests and communications;
• information submitted through forms; and
• information you provide when communicating with us.

Information processed through Haillo

Our customers may configure Haillo to process information during conversations and automated workflows, including:

• telephone numbers and caller information;
• voice recordings where recording is enabled;
• call transcripts;
• SMS, WhatsApp, chat or other message content;
• email content;
• dates and times of communications;
• conversation history;
• customer reference or account information;
• information collected during an automated workflow;
• information retrieved from or sent to systems integrated with Haillo; and
• AI-generated summaries, classifications, actions and workflow results.

The exact information collected through a Haillo-powered interaction is determined by the organisation providing that service.

Technical information

When you use our website or platform, we may automatically collect information such as:

• IP address;
• browser and device information;
• operating system;
• login and authentication information;
• usage data;
• pages or platform features accessed;
• diagnostic information;
• security logs; and
• cookie or similar technology information.

How we use personal information

We may process personal information to:

• provide and operate the Haillo platform;
• create and manage customer accounts;
• enable voice, messaging, WhatsApp and other communications;
• transcribe and analyse conversations;
• enable conversational AI functionality;
• execute workflows configured by our customers;
• connect Haillo with third-party systems and applications;
• route conversations or tasks;
• generate summaries and other outputs;
• provide customer support;
• maintain the security and integrity of the platform;
• detect fraud, misuse or security incidents;
• monitor system performance and reliability;
• improve our products and services;
• process payments and administer customer relationships;
• communicate service-related information;
• respond to enquiries and demonstration requests;
• meet legal, regulatory and contractual obligations; and
• where permitted, communicate relevant information about Haillo products and services.

We will not process personal information in a manner that is incompatible with the purpose for which it was collected unless permitted by law.

AI and automated processing

Haillo uses artificial intelligence and automated technologies to enable conversations, interpret requests and perform configured workflows.

Depending on how a customer has configured Haillo, this may include:

• converting speech to text;
• generating conversational responses;
• interpreting the intent of a conversation;
• extracting information provided during a conversation;
• summarising interactions;
• categorising or routing conversations;
• triggering business workflows;
• retrieving information from integrated systems;
• updating connected systems; and
• determining the next step within a configured workflow.

AI systems can make mistakes. Haillo is therefore designed to allow customers to configure validation, escalation, human review and other controls appropriate to their use case.

Where processing constitutes a decision based solely on automated processing that produces legal consequences or otherwise significantly affects an individual, Haillo and its customers must ensure that the processing is performed in accordance with applicable requirements under POPIA, including any rights an individual may have to make representations regarding such a decision.

Haillo does not permit customers to use the platform in a manner that unlawfully discriminates against individuals or otherwise violates applicable law.

Our customers’ responsibilities

Where Haillo processes personal information as an Operator on behalf of a customer, the customer remains responsible for determining:

• what personal information should be collected;
• why that information is required;
• whether there is a lawful justification for processing it;
• what notices or disclosures must be provided;
• whether consent is required;
• how long the information should be retained;
• whether conversations should be recorded; and
• what automated workflows or decisions are appropriate.

If you interacted with Haillo while communicating with another organisation and would like to exercise your privacy rights in relation to that interaction, you should normally contact that organisation directly.

We will assist our customers with appropriate requests as required under our agreements and applicable law.

When we may share personal information

We do not sell personal information.

We may share personal information with trusted service providers where reasonably necessary to operate Haillo, including providers of:

• cloud infrastructure and hosting;
• telecommunications;
• speech-to-text services;
• text-to-speech services;
• artificial intelligence and language models;
• messaging and communications;
• authentication and security;
• analytics;
• payment processing; and
• technical support.

These organisations may act as Operators or subprocessors and are permitted to process information only for authorised purposes and subject to appropriate contractual and security requirements.

We may also disclose information:

• where required by law or a lawful regulatory request;
• to protect Haillo, our customers or other individuals from fraud, security threats or unlawful activity;
• in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business, subject to appropriate safeguards; or
• where you have authorised us to do so.

International transfers

Some of the service providers and technology infrastructure used to deliver Haillo may be located outside South Africa or may process information in other countries.

Where personal information is transferred outside South Africa, we take reasonable steps to ensure that the transfer complies with POPIA, including the requirements applicable to transborder flows of personal information.

This may include ensuring that the recipient is subject to an applicable law, binding corporate rules, contractual obligations or another legally recognised mechanism that provides an adequate level of protection for the information.

Customers may contact us for additional information regarding material subprocessors and processing locations applicable to their Haillo services.

Information security

We take reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access or unlawful processing.

Depending on the service and risk involved, these controls may include measures relating to:

• access control;
• authentication;
• encryption;
• network and infrastructure security;
• logging and monitoring;
• vulnerability management;
• backups and resilience;
• secure software development;
• vendor management; and
• incident response.

No internet-based system can be guaranteed to be completely secure. We continuously assess our safeguards and update them as our technology and risks evolve.

Security compromises

If we become aware of a security compromise involving personal information for which Haillo is the Responsible Party, we will assess the incident and make notifications to the Information Regulator and affected individuals where required by POPIA.

Where Haillo acts as an Operator for a customer, we will notify the applicable customer of qualifying security compromises in accordance with POPIA and our contractual obligations so that the customer can fulfil its responsibilities as the Responsible Party.

How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, contractual and operational requirements.

Different information may therefore have different retention periods.

Information processed through the Haillo platform on behalf of a customer may be retained according to the customer’s configuration, instructions and contractual arrangements with Haillo.

When personal information is no longer required, we will delete, destroy or de-identify it where reasonably practicable and required by law.

Cookies and similar technologies

Haillo may use cookies and similar technologies to:

• operate our website and platform;
• maintain sessions;
• authenticate users;
• remember preferences;
• protect our services;
• understand website and product usage; and
• improve performance.

Where required, users should be able to control non-essential cookies through the cookie controls implemented on the website.

Some cookies are necessary for the website or platform to function and cannot be disabled through our systems.

Direct marketing

We may send marketing communications where permitted under POPIA and other applicable laws.

Where consent is required for electronic direct marketing, we will obtain it before sending such communications unless another provision of applicable law permits the communication.

You may unsubscribe from marketing communications at any time using the unsubscribe mechanism included in the communication or by contacting us.

We may still send non-marketing communications relating to your account, security, transactions or services.

Special personal information and information about children

Haillo is a flexible platform and our customers may configure workflows that involve categories of information that POPIA treats as special personal information or information relating to children.

Customers must ensure that they have appropriate authority and a lawful basis to process such information before using Haillo for that purpose.

Where Haillo itself determines the purpose of such processing, we will process special personal information or children’s information only where permitted by POPIA.

Your rights

Subject to POPIA and any applicable limitations, you may have the right to:

• request confirmation that we hold personal information about you;
• request access to your personal information;
• request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• request the destruction or deletion of information that we are no longer authorised to retain;
• object to certain processing of your personal information;
• object to certain direct marketing;
• withdraw consent where processing is based on consent;
• make representations regarding certain decisions based solely on automated processing; and
• lodge a complaint with the Information Regulator.

We may need to verify your identity before processing a request.

Where your information is processed by Haillo on behalf of one of our customers, we may refer your request to that customer as the Responsible Party.

Information Officer

Haillo has appointed an Information Officer responsible for overseeing our compliance with POPIA.

Privacy-related questions and requests may be directed to our Information Officer.

Complaints

We encourage you to contact us first if you have concerns about how we process your personal information so that we have an opportunity to address them.

You also have the right to lodge a complaint with the Information Regulator (South Africa)↗.

Third-party websites and services

Haillo may integrate with or contain links to services operated by third parties.

Those organisations process personal information under their own privacy policies and practices. Haillo is not responsible for the privacy practices of third parties where they independently determine how personal information is processed.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time as our services, technology or legal obligations change.

When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

Contact us

For questions about this Privacy Policy or how Haillo processes personal information, contact: