Privacy Policy — Cumulus Blue Platforms
Scope: Marketing site only (cumulusblue.tech). The Learner Experience (LX) platform operates under its own separate privacy notice provided at registration. Aligned with: PAIA/POPIA Manual (Cumulus Blue Platforms) Version 2.0, dated 9 July 2026.
Effective date: [INSERT DATE WHEN PUBLISHED] Last updated: [INSERT DATE WHEN PUBLISHED]
1. Who we are
This Privacy Policy explains how Cumulus Blue Platforms (Pty) Ltd (“Cumulus Blue”, “we”, “us”, “our”) collects, uses, and protects your personal information when you visit our website at https://cumulusblue.tech (“the Website”) or submit information to us through it.
Our details:
- Registered company name: Cumulus Blue Platforms (Pty) Ltd
- Company registration number: 2015/189934/07
- VAT number: 4960272708
- Registered address: Unit 27 Cambridge Office Park, 5 Bauhinia Street, Highveld Techno Park, Centurion, South Africa
- General contact: info@cumulusblue.tech
2. Information Officer
In accordance with the Protection of Personal Information Act, 2013 (POPIA), we have appointed an Information Officer to whom you may direct any questions, requests, or complaints about your personal information.
- Name: Shane Francois Prinsloo
- Role: Information Officer (Chief Financial Officer)
- Email: shane@cumulusblue.tech
- Phone: 083 450 9206
The Head of the Body for the purposes of PAIA is Peter David Harris (Chief Executive Officer).
3. What personal information we collect
We collect the following categories of personal information:
3.1 Information you give us directly
When you complete the contact form on our Website, you may provide:
- Your full name
- Your phone number
- Your email address
- Optional information about your position, organisation, learning need, audience, commercial model, accreditation standard, qualification category, current learning format, programme duration, and location
3.2 Information collected automatically
When you visit the Website, our hosting infrastructure (Cloudflare) automatically processes certain technical information for security and reliability:
- Your IP address (anonymised in logs after 24 hours)
- The pages you visit and the date and time of visit
- Basic information about your device, browser, and operating system
- The website (if any) that referred you to us
[NOTE: This is the standard default for a static website served via Cloudflare. If you later add analytics — Google Analytics, Plausible, etc. — this section must be updated to disclose them.]
3.3 Information we do not collect on this Website
- We do not collect payment information through this Website. The Website does not process payments.
- We do not use advertising trackers or third-party advertising cookies.
- We do not sell your information to anyone.
4. Why we collect this information (purpose and lawful basis)
We process your personal information for the following purposes, under the following lawful basis under POPIA section 11:
| Purpose | Lawful basis (POPIA s.11) |
|---|---|
| To respond to your enquiry submitted via the contact form | Necessary for the conclusion or performance of a contract you are a party to (s.11(1)(b)) and our legitimate interest in conducting our business (s.11(1)(f)) |
| To send you information about our products and services you have asked about | Your consent (s.11(1)(a)), given by submitting the contact form |
| To improve and maintain the security of our Website | Our legitimate interest (s.11(1)(f)) |
| To comply with legal and regulatory obligations | Compliance with an obligation of law (s.11(1)(c)) |
We will not use your information to send unsolicited marketing communications unless you have specifically opted in to receive them.
[NOTE: If you plan to send a newsletter or marketing emails later, we must add an explicit opt-in checkbox to the contact form and an unsubscribe mechanism in every email. POPIA section 69 governs direct marketing and the rules are strict.]
5. Who we share your information with
We share your personal information only with the parties listed below, and only to the extent necessary to provide the services you have requested or to operate our Website.
5.1 Service providers we use
| Provider | Purpose | Country |
|---|---|---|
| Cloudflare, Inc. | Web hosting, content delivery, DDoS protection, and a bot-detection challenge (Turnstile) on the contact form | United States (with global edge presence including South Africa) |
| Google Workspace (Google LLC) | Email — @cumulusblue.tech mailboxes that receive your contact form submission | United States |
| Resend, Inc. | Email delivery — sending the contact-form submission from the Website to our mailbox at info@cumulusblue.tech | United States |
5.2 Other recipients
We may share your information:
- With law enforcement, regulators, or courts where we are required to do so by law, by a court order, or by a binding regulatory request.
- With our professional advisors (lawyers, accountants, auditors) where reasonably necessary, subject to confidentiality obligations.
- With a buyer or successor in the event of a merger, acquisition, or sale of all or substantially all of our assets, in which case we will notify you of the change.
We do not sell, rent, or trade your personal information to any third party for marketing purposes.
6. Cross-border transfers of your information
The service providers listed in section 5.1 (Cloudflare, Google Workspace, and Resend) process your information on servers located outside the Republic of South Africa, principally in the United States.
In accordance with section 72 of POPIA, any such cross-border transfer of your personal information is undertaken on one or more of the following bases:
- the recipient is subject to a law, binding corporate rules, or a binding agreement providing an adequate level of protection that upholds principles for reasonable processing substantially similar to Chapter 3 of POPIA; or
- the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request; or
- you have consented to the transfer.
Where required, we have entered into data-processing agreements or equivalent contractual safeguards with each of these providers. Cloudflare and Google are also certified under recognised international privacy frameworks that provide additional protection.
7. How long we keep your information
We keep your personal information only for as long as we need it for the purpose for which we collected it, or as required by law.
- Contact form submissions: Retained for 12 months from the date of submission, after which they are deleted unless we have an ongoing business relationship with you.
- Technical logs: IP addresses and other automatic data are typically retained for 30 days for security purposes, after which they are deleted or anonymised.
- Legal hold: Information may be retained for longer if required for legal, tax, or regulatory purposes.
You may at any time ask us to delete your information sooner — see section 8.
8. Your rights
POPIA gives you the following rights in relation to your personal information:
8.1 Right to be informed
You have the right to know what personal information we hold about you, where we got it from, who we share it with, and why we process it. This Privacy Policy provides that information; if you have specific questions, please contact our Information Officer.
8.2 Right of access
You may request a copy of the personal information we hold about you. We will respond within a reasonable time and in any event within 30 calendar days. We may charge a reasonable fee for repeated or large-volume requests.
8.3 Right to correction or deletion
If your personal information is inaccurate, incomplete, or out of date, you may ask us to correct or delete it. We will do so unless we have a legal obligation to retain it.
8.4 Right to object
You have the right to object, on reasonable grounds, to the processing of your personal information. You also have the right to object at any time to processing of your information for purposes of direct marketing.
8.5 Right to lodge a complaint
If you believe we have not complied with POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:
- Website: https://inforegulator.org.za
- Email: PAIAComplaints@inforegulator.org.za / POPIAComplaints@inforegulator.org.za
- Postal: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
We would, however, appreciate the chance to address your concerns first — please contact our Information Officer.
8.6 How to exercise your rights
Email our Information Officer at shane@cumulusblue.tech with your request. We will need to verify your identity before disclosing or amending personal information.
9. Security of your information
We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, alteration, or disclosure. These include:
- Encryption in transit: All traffic to and from this Website is encrypted using HTTPS (TLS).
- Encryption at rest: Information stored with our service providers (Google Workspace) is encrypted on their systems.
- Access controls: Only authorised personnel who need access to perform their role can access your information.
- Provider vetting: We only engage service providers that meet recognised international security standards.
No security measure is perfect, however, and we cannot guarantee absolute security. If we become aware of a security breach that materially compromises your personal information, we will notify the Information Regulator and, where required, you, in accordance with POPIA section 22.
10. Cookies and tracking
This Website uses minimal cookies and does not currently use third-party advertising trackers or analytics.
We use the following cookies, all of which are strictly necessary for the operation of the Website:
- Cloudflare security cookies (
__cf_bm,cf_clearance) — used to distinguish real users from automated traffic for security purposes.
We do not require you to accept cookies to use the Website. If you disable cookies in your browser, the Website will continue to function.
[NOTE: This section reflects the current state. If you add Google Analytics, Plausible, Meta Pixel, or any other tracker later, this section must be updated and — for non-essential cookies — a consent banner must be added to comply with the ePrivacy Directive standard that POPIA follows in spirit.]
11. Special personal information and children
We do not process special personal information (as defined in POPIA section 26 — information concerning religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, or criminal behaviour) through this Website.
We do not knowingly collect or process personal information of children (persons under the age of 18) through this Website. Our services are aimed at organisations and adults. If you believe a child has provided us with personal information, please contact our Information Officer and we will delete it.
[NOTE: If you later sell directly to learners under 18 (e.g. school-age qualifications), this section must be expanded to include parental-consent mechanisms in accordance with POPIA section 35.]
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or the law. The “Last updated” date at the top of this policy will show when the most recent change was made.
If we make a material change that affects how we process your information, we will take reasonable steps to notify you — for example, by email if we have your email address, or by a prominent notice on the Website.
Continued use of the Website after a change becomes effective means you accept the updated policy.
13. Learner Experience (LX) platform
This Privacy Policy applies to the marketing website at https://cumulusblue.tech. Our Learner Experience (LX) ecosystem — through which we host training content for our customers and their learners — operates as a separate service under a separate privacy notice that is made available to platform users on registration.
14. Contact us
If you have any questions about this Privacy Policy or how we handle your personal information, please contact us:
Information Officer: Shane Francois Prinsloo (Chief Financial Officer) Email: shane@cumulusblue.tech Phone: 083 450 9206 Postal address: Unit 27 Cambridge Office Park, 5 Bauhinia Street, Highveld Techno Park, Centurion, South Africa