Data Protection & Privacy Notice

Privacy Policy & Data Processing Notice

Effective Date: September 15, 2026 • Governs Valuelab The Modern Deal House, Virtual Data Room (VDR), DealBase Capital Marketplace, and AI Verification Services • Fully compliant with POPIA, GDPR, and Meta Developer Platform Policies.

1. Identification of the Controller & Scope

This Privacy Policy is issued by Valuelab (Pty) Ltd (Registration No: 2024/721972/07, "Valuelab", "we", "us", or "our"), based in Menlyn Maine, Pretoria, South Africa.

This policy governs all personal information, commercial documentation, and communications processed across our digital platforms, including:

Valuelab Deal House Portal: valuelab.co.za
Valuelab DealBase Capital Marketplace: dealbase.valuelab.co.za
Valuelab Virtual Data Room (VDR): vdr.valuelab.co.za
Notification & Communications Infrastructure: Automated transactional notifications delivered via Microsoft Exchange Online and the Meta WhatsApp Business Cloud API.

2. Lawful Basis for Processing (POPIA & GDPR)

In accordance with Condition 2 of the Protection of Personal Information Act 4 of 2013 (POPIA) and Article 6 of the General Data Protection Regulation (GDPR), Valuelab processes personal data only where a lawful basis exists:

Performance of Contract: Facilitating valuation, diligence, data room access, document verification, and deal execution requested by clients.
Consent: Explicit opt-in consent provided during registration, onboarding, mobile verification, and notification channel selection (including WhatsApp notifications).
Legal & Statutory Obligations: Compliance with anti-money laundering (FICA), corporate governance (Companies Act 71 of 2008), and tax administration laws.
Legitimate Interests: Securing platform infrastructure, preventing fraud, managing access controls (BOLA), and maintaining defensible audit trails.

3. Categories of Personal Data We Collect

We collect only data that is strictly necessary for our diligence and deal-room operations:

A. Account & Identification Information

Full name, corporate email address, password hash (managed securely via Firebase Auth), role assignment (Business Owner, Investor, Analyst, Admin), company registration details, and professional job title.

B. Mobile & Messaging Telemetry (Meta WhatsApp API)

International mobile telephone numbers (E.164 format), notification opt-in records, message delivery telemetry (message ID, sent timestamp, delivery receipt, read status, and webhook status payloads from the Meta WhatsApp Cloud API), and user-initiated notification preferences.

C. Corporate & Confidential Diligence Documents

Audited and management financial statements, tax clearance certificates, CIPC incorporation documents, share registers, shareholder agreements, non-disclosure agreements (NDAs), intellectual property records, and questionnaire responses.

D. System Audit, Security & Device Logs

IP addresses, browser type, operating system, authentication tokens, timestamped action logs, and session security identifiers.

4. Meta Platforms & WhatsApp Business API Integration

Valuelab integrates with the WhatsApp Business Cloud API provided by Meta Platforms, Inc. and Meta Platforms Ireland Ltd. ("Meta") to transmit essential transactional and operational alerts to platform participants.

Scope of WhatsApp Notifications: Communications transmitted via WhatsApp are strictly confined to critical account and workflow updates, including:

Two-factor authentication (2FA) and One-Time Pin (OTP) verification codes.
Document classification, processing, and batch review completion notices.
Non-Disclosure Agreement (NDA) signing requests and execution confirmations.
Due diligence questionnaire status alerts and investment mandate milestone notifications.

Consent, No Marketing & Opt-Out Policy:

No Marketing / No Spam: Valuelab strictly complies with the Meta Platform Terms and WhatsApp Business Messaging Policy. We do NOT use WhatsApp for unsolicited commercial advertising, mass marketing, or promotional spam.

Opt-In: You only receive WhatsApp communications after explicitly providing and confirming your mobile phone number on the Valuelab platform.

Immediate Opt-Out: You may unsubscribe or opt out of WhatsApp notifications at any time by:

Replying "STOP", "UNSUBSCRIBE", or "CANCEL" directly to any WhatsApp message sent by Valuelab.
Updating your notification channel preferences under your Account Settings in the portal.
Emailing our support team at info@valuelab.co.za with the subject line "WhatsApp Unsubscribe".

5. User Data Deletion & Account Erasure Instructions

In compliance with Meta Platform Term 4.b, the GDPR Right to Erasure (Article 17), and Section 24 of POPIA, Valuelab provides a transparent, readily accessible mechanism for all users to request the permanent deletion of their personal information, WhatsApp messaging records, and platform account data.

How to Submit a Data Deletion Request

Users may request deletion of their data at any time by following these steps:

Send an Email Request: Send an email from your registered platform email address to our designated Data Protection Officer at:
To: info@valuelab.co.za
Subject: Data Deletion Request
Provide Identifying Information: In your email, include:
- Your full registered name.
- The registered email address associated with your account.
- The mobile phone number registered for WhatsApp notifications (including international dialing code).
- Your associated company name or mandate ID (if applicable).
Specify the Deletion Scope: Clarify whether your request relates to:
- Category A: WhatsApp messaging logs and mobile notification telemetry only.
- Category B: Uploaded financial and corporate documents.
- Category C: Complete account erasure and personal profile purge across all Valuelab systems (VDR, DealBase, and communications).
Verification & Processing Timeline:
Our Data Protection team will verify the authenticity of the request within 48 business hours. Once verified, all requested data is irrevocably removed or anonymized across active databases (Firestore, Cloud Storage buckets, and messaging queue stores) within 30 calendar days.
Confirmation Notice: A formal written Confirmation of Data Deletion will be sent to your email address upon successful completion of the purge.

Statutory Retention Exception: Under South African law (including Section 29 of the Tax Administration Act and the Companies Act 71 of 2008), certain corporate transaction contracts, executed NDAs, and anti-money laundering compliance records must be securely archived for statutory audit periods before permanent disposal. Non-statutory operational data, marketing preferences, and messaging telemetry are purged immediately.

6. Data Security, Cloud Infrastructure & Subprocessors

Valuelab enforces rigorous organizational and technological security safeguards to ensure confidentiality, integrity, and availability:

Encryption Standards: All uploaded files and confidential document archives are encrypted at rest using enterprise-grade AES-256 encryption within dedicated Google Cloud Storage (GCS) buckets. All web traffic and API endpoints are encrypted in transit via TLS 1.3.
Access Control & Authorization: Strict Broken Object Level Authorization (BOLA) guards, Firebase JWT token authentication, and role-based access control (RBAC) ensure users only access records explicitly authorized under executed NDAs or ownership mandates.
AI Evaluation Confidentiality: Document analysis and text extraction utilize enterprise AI endpoints (Google Cloud Vertex AI and OpenAI Enterprise APIs). Client data is never used to train or refine public or foundational AI models. Processing occurs in isolated, ephemeral environments.

Authorized Third-Party Subprocessors

Subprocessor	Service Purpose	Primary Location
Meta Platforms, Inc. / Meta Ireland	WhatsApp Business Cloud API messaging & delivery telemetry	United States / European Union
Google Cloud Platform (Google LLC)	Application hosting (Cloud Run), encrypted storage, Firestore, Vertex AI	South Africa (africa-south1) & Europe (europe-west1)
Microsoft Corporation	Microsoft 365 Exchange Online (Microsoft Graph API email delivery)	South Africa & Global
OpenAI, LLC	Enterprise document extraction inference (zero-training terms)	United States

7. Your Data Subject Rights (POPIA & GDPR)

Under POPIA and international data protection regulations, you retain enforceable rights:

Right to Access: Request confirmation and an exportable copy of all personal information held about you or your registered company.
Right to Rectification: Request the correction or updating of any inaccurate, misleading, or outdated personal information.
Right to Erasure (Deletion): Request the permanent deletion of your account and personal data (as detailed in Section 5).
Right to Restrict or Object to Processing: Object to processing based on legitimate interest or request temporary suspension of data processing.
Right to Withdraw Consent: Withdraw previously given consent for communications (such as WhatsApp alerts) at any time without penalty.
Right to Lodge a Regulatory Complaint: Lodge a formal complaint with the South African Information Regulator if you believe your rights under POPIA have been infringed.

8. Contact Our Information Protection Officer

If you have questions regarding this Privacy Policy, wish to exercise your data subject rights, or submit a data deletion request, please reach our designated Information Officer:

Valuelab Data Protection Office

Valuelab (Pty) Ltd

Menlyn Maine Central Square, Pretoria, South Africa

Email: info@valuelab.co.za

Web: valuelab.co.za

The Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg

Complaints: POPIAComplaints@inforegulator.org.za

Website: inforegulator.org.za

Loading Valuelab Intelligence...