Privacy Policy

1. Who is responsible

The responsible party (and, under the GDPR, the controller) is Department Six (Pty) Ltd, registration number 2023/241890/07, of 4th Floor, The Harrington, 50 Harrington Street, Zonnebloem, Cape Town, 8001, South Africa ("Department Six", "D6", "we", "us").

Our Information Officer is the Chief Executive Officer of Department Six (Pty) Ltd. You can reach the Information Officer at hello@departmentsix.co, or by post at the address above.

Our six departments (D6 Ventures, D6 Creative Studio, D6 Product, D6 Engineering, D6 Harness and D6 Signal) are ways we organise our work, not separate legal entities. This policy covers all of them.

2. When we act for a client instead

Much of our work involves personal information that belongs to our clients: their customers, their users, their staff. When we design, build, host, automate or analyse on a client's behalf, we act as that client's operator (processor) and process the information only on their instructions. The client's privacy notice governs that processing, and requests about it should go to the client in the first instance. We will help the client respond.

Our standard commitments as an operator are set out in section 12 and in our Terms and Conditions, and we sign a data processing agreement where an engagement calls for one.

3. What this website collects

We have designed https://www.departmentsix.co to collect as little as possible.

We do not use advertising cookies, remarketing pixels, fingerprinting, session recording or social media trackers on this site. If that ever changes we will update this policy and ask for consent first where the law requires it.

4. What we collect beyond the website

Running a studio means holding information about the people we work with. By category:

• Clients and their staff: names, roles, work contact details, communications, meeting notes and recordings (with notice), briefs, approvals, feedback, contract and billing details, and the content of the work itself where it includes personal information.
• Prospects and network: names, roles, organisations, work contact details, how we met, notes on conversations, and information you share with us about your business or venture.
• Suppliers, contractors and partners: contact details, contracts, invoices, bank details for payment, tax numbers, and performance notes.
• Job applicants and candidates: CVs, portfolios, contact details, interview notes, references, and (where relevant to the role and with your knowledge) right-to-work information. We do not ask for special personal information unless the law requires it.
• Founders and portfolio companies (D6 Ventures): the information above plus financial, cap table, performance and governance information relevant to an investment or participation, and identity verification where required by law.
• Users of products we operate for clients: whatever the product collects, on the client's instructions, as described in section 2.
• Event and marketing contacts: name, email, organisation and your communication preferences.

We collect this directly from you, from your organisation, from public sources (your company website, LinkedIn, company registries), from introductions, and in the course of the work.

5. Why we use it, and the lawful basis

POPIA requires a justification for every processing activity, and the GDPR requires a lawful basis. Ours are:

We do not sell personal information. We do not use it for automated decisions that have legal or similarly significant effects on you.

6. Direct marketing

We market sparingly. If you are an existing client we may email you about services similar to the ones you have used, and every such email will tell you how to opt out. If you are not an existing client we will only send marketing email with your prior consent, obtained in a way that records what you agreed to.

We do not make unsolicited marketing calls, send marketing SMS or WhatsApp messages, or use automated calling. We honour opt-outs within 10 Business Days and keep a suppression list so that you are not contacted again. Where the Consumer Protection Act's opt-out mechanisms apply to a communication, we honour those too.

To opt out at any time, use the link in the email or write to hello@departmentsix.co.

7. Who we share it with

We share personal information only where needed, with people and providers bound to protect it. We never sell it.

• Our team and contractors, on a need-to-know basis and under confidentiality obligations.
• Operators (processors) that run our business. The main ones are: Vercel (hosting and logs), Supabase (database), Resend (transactional email), Slack (internal messaging), Plausible (analytics), Google Workspace (email, calendar, documents and storage), Xero (accounting and invoicing), Notion and Linear (project and documentation), Figma and Adobe (design), GitHub (code), and AI providers including Anthropic and OpenAI (see section 11). Each processes information only on our instructions under a written agreement.
• Clients, where you are their staff, user or customer and the engagement requires it.
• Professional advisers: lawyers, accountants, auditors and insurers.
• Co-investors, portfolio companies and their advisers, in D6 Ventures work, where you are a founder or stakeholder in that company.
• Regulators, courts, law enforcement and other authorities where the law requires or permits it.
• A successor business, if we sell, merge or restructure, in which case the successor will be bound by this policy.

8. Transfers outside South Africa

Most of the providers in section 7 store data in the United States or the European Union, so personal information we hold is routinely transferred outside South Africa. POPIA section 72 allows this where the recipient is bound by law or contract to protect the information to a standard substantially similar to POPIA. We rely on our written agreements with each provider, which include data processing terms, and, for EU and UK data, on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision where one exists.

We work with clients across Africa, Europe, the United Arab Emirates, Japan and Australia, and we will transfer information to and from those clients as the engagement requires, under the same protections.

9. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, and then delete or anonymise it. Our standard periods:

Backups are deleted on their own rolling schedule, typically within 90 days of the primary record being deleted.

10. Security

POPIA section 19 requires reasonable technical and organisational measures. Ours include: encryption in transit and at rest on all core systems; single sign-on with multi-factor authentication; least-privilege access to client systems and data, revoked when an engagement ends; secrets kept in managed vaults rather than in code; code review and dependency monitoring for the software we build; vetted providers with their own security certifications; and a security and incident response procedure that our team is trained on.

No system is perfectly secure. If we become aware of a security compromise affecting your personal information, we will notify the Information Regulator and, where required by POPIA section 22 or other applicable law, notify you as soon as reasonably possible, with enough detail for you to protect yourself.

11. How we use AI

We use AI tools in research, writing, design, engineering and automation, and D6 Harness builds AI systems for clients. In our own work this means personal information may be processed by AI providers acting as our operators, under agreements that prohibit them from training their models on our data. We do not feed special personal information, or client data we are told is sensitive, into AI tools unless the client has agreed to it and the tool is contracted for that purpose. People review AI output before it goes into anything we deliver or decide.

Where we build an AI system for a client, the client decides what personal information it processes and remains the responsible party for it, as described in section 2.

12. Our commitments as an operator

When we process personal information on a client's behalf we will: process it only on the client's documented instructions; keep it confidential and ensure our people are bound by confidentiality; apply the security measures in section 10; not engage a sub-operator without the client's general or specific authorisation and without flowing down equivalent terms; help the client respond to data subject requests and meet its own security and notification duties; notify the client without undue delay on becoming aware of a security compromise; and, at the end of the engagement, return or delete the information as the client chooses, unless the law requires us to keep it.

13. Your rights

Under POPIA (and, if they apply to you, the GDPR and UK GDPR) you have the right to:

• Know whether we hold personal information about you, and ask for access to it and a description of its recipients (POPIA s23).
• Ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and to destroy or delete records we are no longer authorised to keep (POPIA s24).
• Object, on reasonable grounds, to processing based on our legitimate interests, and object at any time to direct marketing (POPIA s11(3) and s69).
• Withdraw consent at any time where processing is based on consent, without affecting what was done before.
• Not be subject to a decision based solely on automated processing that affects you significantly (POPIA s71).
• Under the GDPR and UK GDPR: restrict processing, receive your data in a portable format, and the rights above as framed in articles 15 to 22.
• Complain to the Information Regulator, or to your local supervisory authority if you are in the EEA or UK.

To exercise a right, email hello@departmentsix.co or write to the Information Officer at 4th Floor, The Harrington, 50 Harrington Street, Zonnebloem, Cape Town, 8001, South Africa. Tell us what you are asking for and enough to identify you; we may ask for proof of identity before releasing information. There is no charge for objection, correction or deletion requests. Access requests are free for a confirmation of whether we hold information and, for a copy of the record, may attract the prescribed fee under PAIA, which we will quote before proceeding. We respond within 30 days, and we will tell you if we need more time and why.

Our PAIA manual, prepared under section 51 of the Promotion of Access to Information Act 2 of 2000, is published at https://www.departmentsix.co/paia and is available on request from the Information Officer.

14. Complaints and the Information Regulator

If you are unhappy with how we have handled your personal information, please tell us first at hello@departmentsix.co and give us a chance to put it right. You also have the right to lodge a complaint with the Information Regulator:

• The Information Regulator (South Africa)
• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• POPIAComplaints@inforegulator.org.za (POPIA complaints) or enquiries@inforegulator.org.za (general)
• 010 023 5200
• https://inforegulator.org.za

15. Children

Our services are for businesses and the website is not aimed at children. We do not knowingly collect personal information from anyone under 18 without the consent of a competent person. If you believe a child has given us personal information, contact us and we will delete it.

16. Changes to this policy

We will update this policy when our practices or the law change. The version and effective date appear at the top. For material changes affecting how we use information we already hold about you, we will tell you by email or a notice on the site before the change takes effect.

1. Controller, representative and contact

Department Six (Pty) Ltd is the controller. We are established in South Africa and do not have an establishment in the EEA or UK. We process EEA and UK personal information in the course of offering services to clients there, and our contact for all data protection matters is hello@departmentsix.co. We will appoint an EU or UK representative under article 27 if and when the scale of our processing requires it, and we will publish their details here.

2. Lawful bases and legitimate interests

The lawful bases we rely on are listed in Part A, section 5. Where we rely on legitimate interests, those interests are: running and promoting a professional services business; responding to and following up enquiries; maintaining relationships with clients, prospects and our network; securing our systems; and managing our venture portfolio. We have assessed those interests against your rights and consider them proportionate, given the business-to-business nature of our work and the limited sensitivity of the information involved. You may object at any time (Part A, section 13).

3. International transfers from the EEA and UK

South Africa is not currently the subject of an adequacy decision by the European Commission or the UK government. When personal information travels from the EEA or UK to us, or from us to our providers in the United States or elsewhere, we rely on the Standard Contractual Clauses (2021/914) and, for UK data, the International Data Transfer Addendum, supplemented by the technical measures in Part A, section 10. Where a provider is certified under the EU-US Data Privacy Framework or its UK extension, we may rely on that instead. You may ask for a copy of the relevant clauses at hello@departmentsix.co.

4. Your rights and how to complain

In addition to the rights in Part A, section 13, you have the right to lodge a complaint with the supervisory authority of the EEA member state where you live or work, or with the UK Information Commissioner's Office (ico.org.uk). We would welcome the chance to address your concern first.

5. Other jurisdictions

If you are in the United Arab Emirates, Japan, Australia or another jurisdiction with its own data protection law, the rights in Part A apply to you as a matter of our policy, and we will honour any additional rights your local law gives you. Contact hello@departmentsix.co and tell us where you are.