Privacy notice

Diretsa is a product of Aha Core Pty Ltd. Aha Core Pty Ltd is the responsible party for personal information it processes to operate Diretsa, manage partner accounts and respond to enquiries. POPIA protects information about identifiable people and, where applicable, existing legal entities.

Publishers and advertisers remain responsible for personal information they collect for their own publications, mailing lists, websites and campaigns. Where we process information on a partner’s instructions, the relevant agreement must set out our responsibilities as an operator.

• Enquiries: your name, email address, contact details and the publication or campaign information you send us.
• Partner accounts: email address, sign-in credentials handled by our authentication service, email-confirmation status, organisation memberships, roles and permissions. We do not need you to send us your password.
• Campaign and publication records: sites, placements, campaign briefs, budgets, artwork, destination links, approval records, recorded invoices, delivery figures and earnings reports. These may include contact details or other personal information supplied by a partner.
• Activity and technical information: sign-in and security events, approval and audit records, and information needed to deliver and troubleshoot the service. Hosting and delivery services may process IP addresses, browser information and request logs.
• Analyst conversations: questions, saved conversations and campaign evidence used by the optional AI Analyst available to authorised operators.

We collect information directly when you contact us or use Diretsa, from the organisation that invites or authorises you, and from the connected media-delivery services used to run and report campaigns. Public pages do not require a partner account. Delivery reports show impressions and clicks; they are not proof of an individual’s purchases or interests.

Please do not upload mailing lists, identity documents, sensitive personal information or children’s personal information into campaign artwork, support messages or Analyst conversations unless a lawful, agreed process specifically requires it.

• To respond to enquiries, discuss participation in the network, and take steps towards an agreement at your request.
• To provide an agreed service: manage accounts and access, plan and approve campaigns, deliver artwork, report results and reconcile financial records.
• To protect the service, investigate misuse, keep accountable approval records and resolve disputes, where necessary for our or a partner’s legitimate interests and subject to your rights.
• To meet applicable legal obligations, including financial recordkeeping and lawful requests from authorities.
• Where consent is the appropriate basis, to carry out the specific activity you agreed to. You may withdraw that consent without affecting processing that was lawful before withdrawal.

Contact and account details needed to answer your enquiry or provide partner access are necessary for those purposes. If they are not provided, we may be unable to respond, verify your identity or provide the relevant service. Optional information need not be supplied.

We do not treat visiting the site as consent to electronic direct marketing. Any such marketing must meet POPIA’s consent or applicable existing-customer requirements and include a way to object or unsubscribe. Service messages about your account or an agreed campaign are distinct from promotional messages.

The Analyst provides advisory answers, not automated campaign approval. It cannot approve spending, pause or change a campaign. Authorised people make those decisions.

Access is limited to the people and services that need information for the relevant purpose. This may include authorised people in your organisation, Diretsa administrators, participating publishers or advertisers where needed to fulfil a booking, hosting and authentication providers, storage services, media-delivery providers and professional advisers. We may disclose information where legally required or necessary to establish or defend legal rights.

When an authorised operator uses the Analyst, the question and relevant campaign evidence are sent to an AI service through Lovable AI Gateway to generate an answer. Saved conversations are associated with the operator’s account. Avoid including unnecessary personal or confidential information in questions.

Service providers may process information outside South Africa. Any cross-border transfer must meet section 72 of POPIA, for example through adequate protection under law or a binding agreement, or another applicable ground permitted by that section. You may contact us for information about providers and safeguards relevant to your records.

A publisher’s site, newsletter and advertising delivery may involve separate processing and notices. This notice does not replace those publishers’ or advertisers’ privacy obligations.

Diretsa uses sign-in, confirmed-email checks, organisation-based permissions, private artwork storage and server-side approval checks to limit access. We take reasonable technical and organisational measures to protect personal information; no online system can guarantee absolute security.

If there are reasonable grounds to believe an unauthorised person has accessed or acquired personal information, we will assess the incident and notify the Information Regulator and affected data subjects as required by section 22 of POPIA, subject to any lawful delay.

We retain information only for as long as reasonably needed for the purpose for which it was collected, an applicable legal obligation, an agreement, or establishing or defending legal rights. The period depends on the record: enquiry correspondence, account records, campaign approvals, financial records and saved conversations serve different purposes. When continued retention is not justified, information should be deleted, destroyed or de-identified securely. Backup copies may remain until the applicable backup cycle expires.

Ask us about the retention period or deletion of a particular record. Closing an account does not necessarily erase financial records or campaign approvals that must lawfully be retained.

Subject to POPIA’s requirements and applicable lawful exceptions, you can:

• Ask whether we hold personal information about you and request access to it.
• Request correction or deletion of information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained.
• Request destruction or deletion of information we are no longer authorised to retain.
• Object on reasonable grounds to applicable processing, and object to direct marketing.
• Withdraw consent where processing relies on it, and complain to the Information Regulator.

We may need proportionate proof of identity or authority before releasing or changing records, to protect them from unauthorised access. Confirmation of whether information is held is free; access procedures or a prescribed access fee may apply where permitted by law. If a request cannot be granted, we will explain the applicable reason.

Access requests may also fall under the Promotion of Access to Information Act (PAIA). Contact us for the applicable request procedure. This notice is not a PAIA manual.

Email support@diretsa.com with the subject “Diretsa privacy request”, or use the postal address or telephone above. Tell us what information or action your request concerns. Do not send a password or unnecessary identity documents. We will explain any verification needed and route the request to the person responsible for information protection.

You may complain directly to South Africa’s Information Regulator without first contacting us. See the Information Regulator’s official website for current complaint procedures, prescribed forms and contact details.

We may update this notice when our services or legal obligations change. The effective date above identifies this version. Material changes affecting partner information will be communicated through an appropriate channel. A change to this notice does not itself create consent for a new purpose.