Who we are

Phase Transitions (Pty) Ltd (registration 2026/448729/07) is the responsible party for the personal information described below. We are an analytics and AI consulting business: we connect AI to the financial and operational data that businesses already run on.

Phase Transitions (Pty) Ltd
graham@phasetransitions.ai · +27 82 351 5177

Our Information Officer is Graham Rowe, registered with the Information Regulator (registration 2026-039627). Any question, request or concern about personal information can be sent to graham@phasetransitions.ai.

Whose information, and what we collect

Visitors and enquiries

When you contact us by email or phone, we collect your name, contact details and whatever you choose to tell us. Our website is informational and does not require you to create an account.

Clients and their representatives

We collect the business contact details of the people we work with at client organisations, and the information needed to manage the engagement, invoice for it and meet our legal obligations.

Client business data we process on instruction

Most of the data we handle is our clients' own accounting and operational data, which we process strictly on their instruction to produce analytics for them. For that data the client is the responsible party and we act as the operator. Where that data contains personal information, requests about it are directed through the client. We see it on a tokenised, read-only basis and never use it to train AI models.

People we employ or contract

As an employer and a contracting business, we hold the personal information needed to run payroll, meet statutory employment and tax duties, and manage supplier relationships.

Why we process it, and on what basis

We process personal information to respond to enquiries, deliver and administer our services, invoice and keep proper financial records, meet legal and regulatory duties, and run the business. Our lawful bases under POPIA are the performance of a contract with you, compliance with a legal obligation, your consent where we ask for it, and our legitimate business interests. We do not sell personal information, and we do not use it for unrelated marketing.

Who we share it with

We share personal information only with service providers (operators) who help us run the business, each under a written data processing agreement, and with authorities where the law requires it. Our current operators include hosting and database providers, secure storage, identity and authentication, transactional email, and the AI provider that powers the analyst layer. A full sub-processor register, naming each provider, the data it touches and the agreement in place, is available on request.

Information processed outside South Africa

Some of our service providers operate outside South Africa, including in the European Union and the United States. Where personal information is processed across borders we rely on lawful transfer mechanisms, principally the standard contractual clauses contained in our agreements with those providers, consistent with section 72 of POPIA. Client financial data at rest is hosted in the European Union.

How long we keep it

We keep personal information only as long as we need it for the purpose it was collected, or as long as the law requires us to. Financial and tax records are kept for the periods set by South African law. When information is no longer needed, we delete or de-identify it.

How we protect it

We take reasonable technical and organisational measures to protect personal information, including encrypted transport, access controls and least-privilege roles, isolation of each client's data, and keeping credentials out of our code. We keep a written record of our security and compliance posture and review it regularly.

Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct or delete information that is wrong, misleading or no longer needed;
• object to processing on reasonable grounds;
• withdraw consent, where our processing relies on it; and
• complain to the Information Regulator.

To exercise any of these, email graham@phasetransitions.ai. We will respond within a reasonable time. Our PAIA manual, which explains how to make a formal access request, is published here.

The Information Regulator

If you believe we have not handled your personal information lawfully, you may lodge a complaint with the Information Regulator:

The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Complaints: POPIAComplaints@inforegulator.org.za
General: enquiries@inforegulator.org.za
inforegulator.org.za

Changes to this notice

We may update this notice as our business or the law changes. The effective date at the top shows when it was last revised. The current version always lives at this address.