Privacy Policy

Akkord (Pty) Ltd, a private company incorporated in the Republic of South Africa under registration number 2026/467847/07, trading as getohdit (“getohdit”, “we”, “us”, or “our”), provides digital risk and compliance assessment services at getohdit.co.za.

For the purposes of POPIA, Akkord (Pty) Ltd is the Responsible Party in respect of all personal information processed through the getohdit platform. getohdit is a trading name, not a separate legal person.

Information Officer: Under POPIA, the Information Officer of a private body is the head of that body. For Akkord (Pty) Ltd this is the company's director, whose particulars are held on public record by the Companies and Intellectual Property Commission (CIPC) under registration number 2026/467847/07. The Information Officer may be contacted at privacy@getohdit.co.za, or by post at the registered address on record with CIPC.

We collect personal information only to the extent necessary to deliver our services:

We do not intentionally collect special personal information (Section 26 of POPIA) such as health, religious, political, or biometric data.

We share personal information only where necessary and under appropriate data processing agreements:

Where we transfer personal information outside South Africa (including to AI providers in the United States), we ensure adequate protection is in place consistent with Section 72 of POPIA. As the United States does not have a general adequacy determination from the South African Information Regulator, we rely on Data Processing Agreements (DPAs) with each sub-processor that impose data protection obligations substantially equivalent to POPIA's conditions of lawful processing (Section 72(1)(d)). Copies of applicable DPAs are available on request to privacy@getohdit.co.za. We do not sell personal information to third parties.

When assessing a submitted website URL, our automated pipeline processes the publicly accessible content of that website - which may include the names and professional details of attorneys and staff listed thereon. This processing is conducted under the legitimate interest ground (POPIA Section 11(1)(f)) for the sole purpose of delivering the requested compliance assessment to the client firm. The information concerned is voluntarily published and professional in nature, and is contained in a record deliberately made public by the data subject (Section 12(2)(b) of POPIA). Direct notification of each individual is not required because non-compliance would not prejudice the legitimate interests of the data subject and compliance is not reasonably practicable in the circumstances (Section 18(4)(b) and (e) of POPIA).

To be explicit: the content of an assessed website - including any personal information published on it - is transmitted to the AI providers listed in the table above, several of which are located in the United States, for the sole purpose of generating your report. If you do not want a website's content processed in this way, do not submit it for assessment.

At the end of each retention period, personal information is securely deleted or anonymised in accordance with Section 14 of POPIA.

We implement appropriate technical and organisational measures consistent with our obligations under Section 19 of POPIA, including:

• Encryption of data in transit (TLS/HTTPS on all endpoints)
• Access controls and role-based permissions
• Secure credential storage using industry-standard practices
• Regular security assessments of our own platform
• Staff training on data handling and confidentiality obligations

In the event of a security compromise that may affect your personal information, we will notify you and the Information Regulator as required by Section 22 of POPIA.

We will respond to access and correction requests within 30 days. We may request proof of identity before processing a request.

Requests for access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA) are dealt with in our PAIA Manual, which sets out the records we hold, the request procedure, and the grounds on which access may be refused.

Our website uses cookies and similar technologies. We use:

• Strictly necessary: Required for the website to function - routing, security, and storing your cookie choice. These cannot be disabled and are not used for tracking.
• Analytics: Google Analytics, used to understand site usage. Opt-in only. The Google Analytics script is not loaded and no request is made to Google unless and until you grant analytics consent.
• Preferences: Used to remember non-essential choices and settings. Opt-in only.

No non-essential cookies or third-party scripts are placed before you make a choice. Your choice is stored in your browser's local storage (not in a cookie), so declining leaves no identifier that we can read.

We also use Vercel Analytics and Vercel Speed Insights to measure traffic and page performance. These are cookieless, do not store or read identifiers on your device, and do not track you across sites, so they operate without consent.

You may change or withdraw your choice at any time via the Cookie preferences link in the site footer. Withdrawing consent is as easy as granting it and will not affect your ability to use our core services.

If you are not satisfied with our response, you may lodge a complaint with:

We may update this Policy to reflect changes in our practices or legal requirements. Material changes will be notified by email (where we hold your address) and by a notice on our website, taking effect 14 days after notification.