Privacy Policy

1. Introduction

BX1X (“we”, “us”, or “our”), operated by Villiers Vision Works (Pty) Ltd, is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share personal information when you use the BX1X platform, our website (bx1x.com), and related services.

This policy is aligned with the Protection of Personal Information Act, 2013 (POPIA) and other applicable data protection legislation.

2. Information We Collect

2.1 Information you provide

• Account registration details (name, email address, phone number, company name)
• Billing and payment information
• Contact form submissions and demo requests
• Communications with our support team
• Data entered into the Platform by you and your Users (Customer Data)

2.2 Information collected automatically

• Device and browser information
• IP address and approximate location
• Pages visited, time spent, and navigation patterns on our website
• Cookies and similar tracking technologies (see our Cookie Policy)

2.3 Medical and sensitive information

If you use the BX1X Medical module, the Platform may process special personal information as defined by POPIA, including patient health records, medical aid details, and clinical notes. This data is processed solely on your instruction as the responsible party. We act as an operator (processor) of this data.

3. How We Use Your Information

We use personal information to:

• Provide, operate, and maintain the Service
• Process payments and manage your subscription
• Communicate with you about your account, support requests, and service updates
• Improve and develop the Platform
• Comply with legal obligations
• Protect the security and integrity of the Service

We do not sell your personal information. We do not use your Customer Data for advertising or marketing purposes.

4. Legal Basis for Processing (POPIA)

We process personal information on the following lawful grounds:

• Consent: Where you have given explicit consent (e.g., contact form submissions, demo requests).
• Contract: Where processing is necessary to perform our obligations under the subscription agreement.
• Legitimate interest: Where processing is necessary for our legitimate business interests (e.g., improving the Service, preventing fraud).
• Legal obligation: Where we are required to process data by law.

5. Data Sharing

We may share personal information with:

• Service providers: Third-party providers who assist in operating the Service (e.g., hosting providers, payment processors, email delivery services). These providers are bound by data processing agreements.
• Legal requirements: Where required by law, court order, or regulatory authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

We do not share Customer Data with other customers or unrelated third parties.

6. Data Storage and Security

• Data is encrypted at rest and in transit.
• Access to personal information is restricted to authorised personnel on a need-to-know basis.
• We maintain role-based access controls, audit trails, and logging across the Platform.
• We support both cloud-hosted and on-premises deployment options, giving you control over where your data resides.
• We conduct regular security reviews and maintain appropriate technical and organisational measures to protect against unauthorised access, loss, or destruction of data.

7. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service. Upon termination of your subscription, we will make your data available for export for 30 days, after which it may be securely deleted.

Certain information may be retained longer where required by law or for legitimate business purposes (e.g., billing records, tax compliance).

8. Your Rights Under POPIA

As a data subject, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention requirements
• Object to the processing of your personal information
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at info@bx1x.com.

9. Cross-Border Data Transfers

Where data is transferred outside of South Africa (e.g., to cloud infrastructure providers), we ensure that appropriate safeguards are in place in accordance with POPIA Section 72, including ensuring that the recipient country has adequate data protection laws or that binding agreements are in place.

10. Children’s Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Platform. The “Last updated” date at the top of this page indicates the most recent revision.

12. Contact

For privacy-related enquiries or to exercise your data subject rights:

You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.