Privacy Notice

PiVOTiQ Commercial Intelligence (ABN 90 666 355 666), an Australian entity ("PiVOTiQ", "we", "us"), is the responsible party for the personal information described in this notice in respect of its South African clients. PiVOTiQ provides AI-enabled commercial intelligence on construction contracts from Australia to clients in South Africa and elsewhere.

This notice explains what personal information we collect, how we use it, who processes it on our behalf (our operators), how long we keep it, and the rights available to you under the Protection of Personal Information Act 4 of 2013 (POPIA). It should be read with our Terms & Conditions and Disclaimer.

• Contract documents and project material you submit for review (which may contain personal information of your personnel or counterparties)
• Intake-form details describing the contract, trade, value band and the questions you want addressed
• Contact and account details — name, role, organisation, email, phone, city/province, and your accounts-payable contact
• Payment metadata — plan, tier, invoice and transaction references. Card details for month-to-month plans are handled directly by Stripe; PiVOTiQ does not store card numbers
• Correspondence with us, and the timestamp and IP address captured by our intake form as an audit record of submission and consent
• Where you use CRI Live — your messaging-channel identifier (for example, your Telegram chat ID), the mobile number or account you register for the service, and the questions you send together with the answers returned to you

We process the information above to deliver the service you have requested and to operate our business lawfully:

• To produce, quality-check and deliver your Contract Review Pack and reports
• To issue invoices, process payments and maintain financial and tax records
• To respond to your enquiries and provide support
• To meet our legal, regulatory and record-keeping obligations

We do not sell personal information, and we do not use it for advertising.

Automated report generation

PiVOTiQ's automated delivery pipeline uses Anthropic's Claude AI via PiVOTiQ's API account, governed by Anthropic's Commercial Terms of Service. Under those terms, data submitted via the API is not used to train Anthropic's AI models and is subject to a standard 30-day retention period for operational and abuse-monitoring purposes only.

Manual quality review and commercial extraction

Elements of PiVOTiQ's quality-review process may also involve Anthropic's Claude AI accessed through an individual Claude Max subscription (claude.ai). The Claude Max plan is governed by Anthropic's consumer Terms of Service and Privacy Policy. Under consumer terms, Anthropic may use conversation data to improve its models unless the account holder has opted out of model training in their account settings. PiVOTiQ operates this account with the training opt-out active.

In both pathways above, a person on the PiVOTiQ team reviews every report before it is delivered. AI processing supports the analysis; it does not make the final commercial determination presented to you.

CRI Live — real-time answers

Where you use CRI Live, your question is processed through Anthropic's Claude AI via PiVOTiQ's API account, on the same Commercial Terms described above, and answered strictly from the completed reports already issued for your contract. Unlike a report, an individual CRI Live answer is not reviewed by a person before it is returned to you — the human quality review sits upstream, on the reports the answer draws from. Your questions and the answers returned are transmitted through the messaging platform you use to access the service (see §5) and are subject to that platform's own privacy policy in addition to this notice.

We engage the following categories of operator to deliver the service. Each is engaged under contractual confidentiality and data-protection terms, and is not authorised to use your information for any purpose beyond delivering the service:

We keep this list current and update it when our operators change.

Because PiVOTiQ is an Australian entity and several of our operators are located outside South Africa, your information is processed in Australia and, through the operators listed above, in the European Union and the United States. Where you use CRI Live, messages are also transmitted through a messaging platform operating outside South Africa. By submitting information to PiVOTiQ, and by registering for CRI Live if you choose to use it, you consent to this cross-border processing.

We transfer personal information across borders only where a condition in section 72 of POPIA is met — including where the recipient is subject to laws or binding agreements that provide an adequate level of protection, or where you have consented to the transfer. Electronic submissions and signatures are recognised under the Electronic Communications and Transactions Act 25 of 2002.

We retain client contract documents and report records for 12 months after report delivery, after which they are deleted, unless we are required to keep them longer to meet a legal or tax obligation. We will delete submitted contract documents earlier on written request, subject to those obligations. Financial records are retained for the period required by applicable law.

For CRI Live, we retain the registration record linking your messaging-channel identifier to your contract for as long as the CRI Live subscription for that contract remains active. On cancellation, that registration record is deleted and access ends. Message content sent and received through the messaging platform remains in your own account on that platform and is governed by its retention settings, which are outside PiVOTiQ's control — you can delete it there at any time.

Subject to POPIA, you have the right to:

• Request access to the personal information we hold about you
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, or no longer authorised to be retained
• Object, on reasonable grounds, to the processing of your personal information
• Withdraw consent where processing is based on consent (without affecting prior lawful processing)
• Lodge a complaint with the Information Regulator (South Africa)

To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request.

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and unlawful processing, and we require our operators to maintain a comparable standard. No system can be guaranteed completely secure; we manage this risk on an ongoing basis.

A decision on website analytics tooling has not yet been finalised. If a privacy-friendly, cookieless analytics tool is adopted (such as Plausible), no cookie banner will be required and this section will be updated to confirm that position. If a tool that sets cookies is adopted, a cookie banner will be added before go-live and this section updated accordingly. No analytics cookies are currently set on the PiVOTiQ website.

We may update this notice from time to time by publishing a revised version on this page. Material changes will be reflected in the version and effective date above.

Information Officer / Contact

• Email: enquiries@pivotiq.com.au
• Payments: payments@pivotiq.com.au
• Website: www.pivotiq.com.au
• Entity: PiVOTiQ Commercial Intelligence | ABN 90 666 355 666