Privacy Policy

1. Who we are

Dry Tech Aerogels (Pty) Ltd (registration number 2016/288016/07, VAT number 4090275456) is the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).

Our address is 11 Delfos Boulevard, Afrox Business Park, Vanderbijlpark N. W. 7. You can reach us on 016 931 1640 or at info@dry-tech.co.za.

This policy covers the Atom8 Vault, our internal formulation, production, laboratory, quality and administration system, and the customer portal and batch-verification pages served from it.

2. Information Officer

POPIA requires every private body to have an Information Officer, who is accountable for how the organisation handles personal information and who must be registered with the Information Regulator.

Our Information Officer can be contacted at pop@dry-tech.co.za, or by post or telephone at the address above.

3. The personal information we process

We hold different information depending on your relationship with us. We collect it directly from you, or from your employer where you are a business contact, unless stated otherwise.

Employees and contractors

Name, identity or passport number, date of birth, gender, marital status, contact details, home address, banking details, job title and department, start and end dates, salary and pay frequency, tax reference number, tax directives, number of medical-aid dependants, UIF and SDL applicability, leave records, time and attendance records, training records and assessment results, and payslips.

Customer and supplier contacts

Company name, contact name, email address, telephone number, physical and delivery addresses, and account and credit information. Where we carry out a credit or compliance check we also hold the supporting documents you give us, which may include a copy of a director's identity document, CIPC registration documents, a VAT certificate, bank confirmation letters, proxy confirmations and completed account applications.

People who use the system

Name, work email address, role and permissions, a password stored only as a cryptographic hash, an optional profile photograph, an optional signature image used to sign laboratory records, and a record of failed sign-in attempts used to lock an account after repeated failures.

Activity records

An audit trail of actions taken in the system — who did what, and when — together with internal chat messages and any files attached to them. Audit entries are cryptographically chained so that a later alteration is detectable.

Quality and production records

Batch, sample and certificate records. These are records about products rather than people, but they identify the analyst who performed a test and the person who approved a certificate, and are retained as quality records.

Technical information

A session cookie named vault_session, which is strictly necessary to keep you signed in and expires after eight hours; a cookie named vault-theme recording whether you chose the light or dark appearance; and small preferences stored in your browser, such as which menu sections you collapsed. We do not use advertising or analytics cookies and we do not track you across other websites.

4. Special personal information and children

Some of the information we hold about employees is special personal information under section 26 of POPIA, or is otherwise sensitive. This includes information about health where it is relevant to medical-aid deductions, and biometric information in the form of a signature image used to sign laboratory records.

We process this information only where POPIA permits it — principally because it is necessary to comply with an obligation of employment law, tax law or social security law, or with your consent.

The Vault is not intended for use by children and we do not knowingly process the personal information of a child, except where an employee's dependants must be recorded for payroll purposes.

5. Why we process it, and on what basis

We process personal information only for the purposes set out below, and we do not use it for an unrelated purpose without telling you first.

To employ people and run payroll

Calculating and paying salaries, making statutory deductions, submitting returns to SARS, administering leave and attendance, and recording training. Basis: performance of the employment contract, and compliance with obligations imposed by law.

To supply customers

Quoting, invoicing, dispatching, collecting payment, and issuing certificates of analysis. Basis: performance of a contract, and our legitimate interests in running the business.

To meet quality and traceability obligations

Maintaining batch traceability, test records and certificates in line with ISO/IEC 17025 and our own quality system, including recording who performed and approved each step. Basis: compliance with obligations, and our legitimate interests in being able to demonstrate the integrity of our products.

To keep the system secure and accountable

Access control, audit logging, backups and detecting misuse. Basis: our legitimate interests, and the security safeguards POPIA itself requires.

To carry out credit and compliance checks

Verifying that a business we trade with is who it says it is, and assessing credit risk. Basis: our legitimate interests, and compliance with obligations imposed by law.

6. Who we share it with

We do not sell personal information, and we do not share it for anyone else's marketing.

We share it only where we need to, with:

• SARS and other regulators, where the law requires it — including payroll submissions and statutory returns.
• Our bank, for paying salaries and collecting payment.
• Medical aid and retirement fund administrators, where an employee participates through payroll.
• Our auditors and professional advisers, under a duty of confidentiality.
• Service providers who process information on our behalf as operators under sections 20 and 21 of POPIA. Each is required to process it only on our instructions and to keep it secure.
• A purchaser or successor, if the business or part of it is ever sold or transferred.
• Anyone else, where you have asked us to, or where the law compels us.

7. Where information goes, and transfers outside South Africa

The Vault runs on our own server in South Africa, and the database sits on that server. It is not hosted with a third-party cloud provider.

Some features do send limited information outside the country. Section 72 of POPIA restricts such transfers, and we rely on them being necessary for the performance of a contract or for the conclusion of a contract in your interest, or on the recipient being subject to comparable protection. The transfers currently in operation are:

WhatsApp alerts — Meta Platforms, United States

Where operational alerts are sent by WhatsApp, the recipient's telephone number and the content of the alert are sent to Meta's WhatsApp Business Platform in order to deliver the message. Inbound messages to our WhatsApp number are received back through the same platform.

AI insights — OpenAI, United States

Where a member of staff requests an AI summary of business data, the figures needed to answer that request are sent to OpenAI. This feature is used at a member of staff's initiative and can be switched off entirely.

GIF search — Giphy, United States

Where a member of staff searches for a GIF in internal chat, the search term is sent to Giphy. No customer or employee data is included. This feature can be switched off entirely.

Email

Outbound email, including payslips and customer documents, is sent through our own mail server on the dry-tech.co.za domain, and then travels over the internet to the recipient's mail provider in the ordinary way.

8. How we protect it

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. The measures we apply include:

• Access is granted by role, so a person sees only the modules their role requires. Payroll and employee records are restricted to those who need them.
• The system is reachable only over HTTPS with a valid certificate. The application itself listens only on the server's internal interface and is not directly exposed to the internet.
• Passwords are never stored in readable form, only as cryptographic hashes. Repeated failed sign-in attempts lock an account.
• Secrets such as API keys and mail passwords are write-only in the interface: once saved they are never displayed again.
• Every change of consequence is written to an audit trail whose entries are cryptographically chained, so a later alteration or deletion is detectable rather than silent.
• Backups are taken nightly, verified after they are written, and checksummed.
• Documents and attachments are stored outside the public web root and served only after an access check.

9. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires — whichever is longer. In practice:

Employment and payroll records

Kept for the duration of employment and then for at least five years afterwards, in line with the Basic Conditions of Employment Act and the record-keeping requirements of the Tax Administration Act.

Customer accounts and invoices

Kept for at least five years from the end of the tax period to which they relate, as tax law requires.

Quality, batch and certificate records

Kept in line with our quality system and the retention period set for laboratory records, so that a batch remains traceable for its shelf life and beyond.

Audit trail

Retained as a security and accountability record. Entries are not deleted in the ordinary course.

Chat messages and attachments

Retained while operationally useful, and deleted when no longer needed.

Webhook and delivery logs

Short-lived, and kept only long enough to diagnose delivery problems.

10. Your rights

Under POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA), you have the right to:

• Ask us to confirm whether we hold personal information about you, and to be given a copy of it. POPIA allows us to charge a prescribed fee for providing the record.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• Object to our processing of your information, on reasonable grounds.
• Withdraw consent, where we relied on your consent — although this does not affect processing we are obliged to carry out by law.
• Ask us not to use your information for direct marketing, which we must respect under section 69 of POPIA.
• Complain to the Information Regulator, and to seek civil relief in a court.

How to make a request

Write to pop@dry-tech.co.za. POPIA prescribes forms for some requests: Form 1 to object to processing, Form 2 to request access to your information, and Form 3 to request correction or deletion. We will help you complete the right form if you ask. We will respond within the period the law allows, and we may need to verify your identity first so that we do not disclose your information to someone else.

Where we may refuse

Some records must be kept even if you ask us to delete them — payroll and tax records, and quality records that establish the traceability of a product batch, are examples. Where we cannot act on a request we will tell you why.

11. If something goes wrong

If personal information in our care is accessed or acquired by someone unauthorised, section 22 of POPIA requires us to notify the Information Regulator, and to notify you, as soon as reasonably possible after discovering it. We will tell you what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

12. Complaints to the Regulator

If you are not satisfied with how we have handled your information, you may complain to:

Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Complaints

complaints.IR@justice.gov.za

General enquiries

enquiries.IR@justice.gov.za

13. Changes to this policy

This is version 1.0, effective 1 September 2026. If we change how we handle personal information we will update this policy and, where the change is significant, tell the people affected. Earlier versions are retained as controlled documents in our quality system.