Privacy Notice

For CloudMonkey's own website, billing, account, security, marketing, and platform administration data, CloudMonkey is generally the Responsible Party.

For managed services where a customer asks CloudMonkey to process personal information on the customer's behalf, the customer is generally the Responsible Party and CloudMonkey acts as Operator under the customer's instructions.

A Data Protection Addendum may apply to managed services such as hosting, email administration, Microsoft 365 tenant checks, voice services, support, security monitoring, and AI workflows.

We collect information directly from you when you create an account, request a quote, accept a service order, pay an invoice, submit a ticket, connect a provider, or use the dashboard.

We collect technical and service information automatically from the website, dashboard, logs, monitored systems, security tools, hosting infrastructure, support workflows, and connected services.

We may receive information from payment providers, identity providers, domain registries, cloud providers, email providers, voice providers, security vendors, referral partners, and other service providers involved in delivering CloudMonkey services.

We process personal information to perform contracts, take steps before entering contracts, comply with legal obligations, protect legitimate business and security interests, and where necessary based on consent.

Where we process personal information as Operator, we do so under the customer's documented instructions and the agreement that applies to the service.

You may withdraw consent where processing depends on consent, but this will not affect lawful processing that already happened or processing needed for contract, legal, security, billing, or record-keeping reasons.

We share personal information only where needed to provide services, operate the platform, meet legal duties, protect rights or security, process payments, manage infrastructure, or support customers.

Subprocessors may include hosting, DNS, domain, email, payment, identity, analytics, monitoring, backup, security, ticketing, communication, voice, AI, and software infrastructure providers.

We require staff, contractors, and relevant providers to handle personal information confidentially and only for authorised purposes.

Some providers used for cloud hosting, payment, security, email, support, analytics, voice, or AI may process information outside South Africa.

Where personal information is transferred outside South Africa, CloudMonkey relies on appropriate contractual protections, customer instructions, consent where applicable, adequacy-type safeguards, or transfer mechanisms allowed by POPIA.

Service orders or DPAs may provide more specific details about hosting regions, subprocessors, and cross-border processing for a particular customer service.

CloudMonkey uses reasonable technical and organisational safeguards such as access controls, role-based permissions, authentication controls, logging, backups, encryption where appropriate, secure administration practices, and staff confidentiality measures.

No system can be made perfectly secure. Customers must also protect passwords, recovery accounts, administrator access, API keys, domain access, tenant permissions, endpoint devices, and data shared with CloudMonkey.

If you suspect unauthorised access to a CloudMonkey account, connected tenant, domain, mailbox, server, PBX, or AI workflow, contact us immediately.

We keep personal information for as long as needed to provide services, maintain business records, comply with legal and tax obligations, resolve disputes, detect abuse, secure systems, and preserve audit evidence.

Backups, logs, signed agreements, invoices, service records, security records, and support records may be retained for different periods depending on operational, legal, accounting, and security requirements.

When information is no longer needed, we delete, anonymise, archive, or restrict it using reasonable processes.

Customers must not submit special personal information, confidential third-party data, regulated records, or sensitive business data into AI, support, voice, or website workflows unless the service is designed for that use and the applicable agreement allows it.

Where call recording, transcription, AI knowledge bases, or monitoring features are enabled, customers are responsible for ensuring they have the required notices, permissions, and lawful basis for their own users, staff, callers, and data subjects.

CloudMonkey may use upstream AI infrastructure to provide AI services, but customer-specific inputs and knowledge bases should be handled according to the applicable service order and DPA.

CloudMonkey may use cookies, local storage, session storage, and similar technologies to keep you signed in, remember preferences, protect forms, detect abuse, measure performance, and improve the website.

Some cookies are necessary for security and account functionality. Browser settings may allow you to block or delete cookies, but doing so can affect the dashboard and checkout experience.

If we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will assess the incident and notify affected customers or Responsible Parties as required by POPIA and the applicable agreement.

Where a customer is the Responsible Party, CloudMonkey's role is to notify and assist the customer so the customer can assess its own regulator and data subject notification duties.

For privacy requests, POPIA questions, or data protection notices, contact CloudMonkey at info@cloudmonkey.co.za. Billing-related privacy questions may also be sent to billing@cloudmonkey.co.za.

Please include enough information for us to verify your identity and locate the relevant account, invoice, domain, tenant, ticket, or service record.