The AI Act Compliance Programme, operated by Vito Solutions.
The programme is operated by Vito Solutions, a business registered in South Africa, registered address First Floor, Willowbridge Centre, 39 Carl Cronje Dr, Tyger Valley, Cape Town 7530, South Africa. We are the data controller for the personal data described below.
Contact for any privacy question or request: info@vitosolutions.co.za
The programme produces a compliance file for your business. That file contains your AI tool inventory, your policies, and a training record for each of your staff.
We do not hold that file, and we do not hold your staff's names. The file is built in your own browser and stays on your machine. Individual training records live inside your file, not in our systems. Our own record that we delivered the programme contains the session date, how many people attended, and which version of the materials we used. It does not name your employees.
This is deliberate. The less we hold, the less there is to lose.
| What | Why we need it | Lawful basis |
|---|---|---|
| Your name, business name, work email, sector and approximate team size | To answer your enquiry, confirm your place, and price the programme correctly | Consent for enquiries. Performance of a contract once you buy. |
| Payment reference and bank transfer details as they appear on our statement | To match your payment to your place and to keep lawful accounting records | Legal obligation |
| Session delivery record: date, attendee count, materials version | To evidence that we delivered what you bought | Legitimate interests, and it supports your own records |
| Messages you send in the WhatsApp support room | To answer your questions during the seven days | Performance of a contract |
We do not use tracking cookies, we do not profile you, and we do not sell or share your details with anyone for marketing.
We keep each item only as long as we need it, or as long as the law requires, whichever is longer. In most cases the law sets no minimum at all, so we delete.
| Data | Kept for | Why that period |
|---|---|---|
| Enquiry details where you did not join a cohort | 6 months from your last contact with us, or immediately on request | No legal minimum applies. We keep it only long enough to answer a follow-up or tell you about the next cohort. |
| Customer name, business, email and payment reference | 7 years | These form part of the accounting record and cannot be separated from it. |
| Invoices and payment records | 7 years | Required of a South African company. See section 6. |
| Session delivery record, no employee names | 7 years | Held with the invoice it relates to. |
| WhatsApp support room content | Deleted when the room archives at the end of Day 7 | No legal minimum applies and we have no continuing need for it. |
| Your Record of AI Literacy Training | Issued to you, not retained by us | Keep your copy. We cannot re-issue one we never kept. |
The only records we are legally required to keep are financial ones. As a South African company we retain accounting records for seven years under section 24 of the Companies Act 71 of 2008. The Tax Administration Act 2011 separately requires five years. Where both apply, the longer period governs, so we keep seven.
We are a South African company, and South Africa does not hold a European Commission adequacy decision. Two things follow, and it is worth being precise about both.
The data you give us is not a "restricted transfer". Under the European Data Protection Board's Guidelines 05/2021, personal data that you enter directly into our forms passes from you to us, not from one organisation to another, and that direct collection falls outside Chapter V of the GDPR. The GDPR still applies in full to how we handle it, because we offer this programme to people in the EU. Your rights in section 9, including your right to complain to the Data Protection Commission, are unaffected.
Our service providers make their own arrangements. Where the providers in section 8 process data outside the EEA, they do so under their own compliance frameworks, such as the EU-US Data Privacy Framework or standard contractual clauses in their terms.
We also keep the amount of personal data involved to the minimum described in section 4, which is why your compliance file and your staff records never come to us at all.
You can ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict how we use it, or object to our using it. You can withdraw consent for enquiry data at any time, and we will delete it. Where a legal obligation requires us to keep financial records, we will keep only those and delete the rest.
Email info@vitosolutions.co.za and we will respond within one month.
If you are unhappy with how we have handled your data, you can complain to your local supervisory authority.
If we change how we handle personal data we will update this page and change the date at the top. Material changes will be told to current cohort members by email.