Privacy Policy

Effective Date: 7 September 2026
Last Updated: 7 September 2026

Astalex International Solutions (“Astalex”, “we”, “us” or “our”) respects the privacy of the individuals, businesses, communities and organisations whose information we handle.

Astalex provides remote administrative, property management support, executive and board support, financial and debtors administration, operations support, maintenance co-ordination and related professional services to clients in South Africa and internationally.

Because our services may involve handling information on behalf of property managers, estates, community associations, trustees, directors, businesses and other clients, data protection and confidentiality form an important part of how we operate.

This Privacy Policy explains how we collect, receive, use, store, share, protect and otherwise process personal information and personal data.

Scope of this Privacy Policy

This Privacy Policy applies to personal information processed by Astalex through:

our website at astalexinternational.com;
enquiries submitted through our website;
email, telephone and other communications;
prospective and existing client relationships;
service delivery;
records, documents, spreadsheets, systems and platforms made available to us by clients;
suppliers, contractors and professional service providers;
newsletters and other communications where applicable; and
other legitimate business activities carried out by Astalex.

It applies both where Astalex determines why and how personal information will be processed and where Astalex processes information on behalf of a client.

Data Protection Laws and International Standards

Astalex is based in South Africa and primarily operates subject to South African law, including:

the Protection of Personal Information Act 4 of 2013 (“POPIA”);
the Promotion of Access to Information Act 2 of 2000 (“PAIA”); and
other applicable South African legislation relating to privacy, confidentiality, electronic communications and access to information.

As Astalex provides services internationally, additional privacy and data protection legislation may apply depending on the location of a client, data subject or processing activity.

Where applicable, Astalex will process personal information in accordance with relevant requirements arising from legislation and recognised privacy frameworks including:

the European Union General Data Protection Regulation (“EU GDPR”);
the United Kingdom General Data Protection Regulation (“UK GDPR”);
the UK Data Protection Act 2018;
the UK Privacy and Electronic Communications Regulations (“PECR”), as amended;
the UK Data (Use and Access) Act 2025, where relevant;
Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial privacy legislation;
Australia’s Privacy Act 1988 and the Australian Privacy Principles (“APPs”);
New Zealand’s Privacy Act 2020;
Singapore’s Personal Data Protection Act (“PDPA”);
Nigeria’s Data Protection Act 2023 (“NDPA”);
Brazil’s Lei Geral de Proteção de Dados Pessoais (“LGPD”);
applicable United States federal or state privacy legislation, including the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), where applicable; and
other data protection and privacy legislation having lawful jurisdiction over a particular processing activity.

Astalex also seeks to apply generally recognised principles of data protection, including accountability, transparency, purpose limitation, data minimisation, accuracy, security, confidentiality, responsible retention and respect for individual privacy rights.

Where different privacy laws apply to the same processing activity, Astalex will seek to comply with the applicable requirements and, where reasonably practicable, apply the higher appropriate standard of protection.

Nothing in this Privacy Policy should be interpreted as stating that every law listed above applies to every Astalex activity.

Our Role When Processing Personal Information

Depending on the circumstances, Astalex may act in different data protection roles.

3.1 Astalex as Responsible Party or Data Controller

Astalex generally acts as the responsible party or data controller when we determine the purpose and manner in which information is processed.

Examples may include information relating to:

website visitors;
individuals contacting Astalex;
prospective clients;
existing clients;
suppliers and contractors;
our own business administration;
invoicing and account management; and
marketing or newsletter communications.

3.2 Astalex as Operator or Data Processor

A significant part of Astalex’s work may involve processing information on behalf of a client.

For example, a property management company, estate, community association or other organisation may provide Astalex with information necessary to carry out administrative or operational functions.

In these circumstances, the client will ordinarily determine the purposes for which the information is processed and Astalex will process the information in accordance with:

the client’s lawful instructions;
the relevant service agreement;
any applicable data processing agreement;
confidentiality obligations; and
applicable data protection legislation.

Where Astalex acts solely as an operator or processor, requests relating to the underlying personal information may need to be referred to the relevant client as the responsible party or controller.

Personal Information We May Process

The information processed by Astalex depends on the services being provided and may include the following categories.

4.1 Contact and Identification Information

This may include:

names and surnames;
email addresses;
telephone numbers;
physical or postal addresses;
job titles;
organisations;
property or unit information; and
other identifying or contact information.

4.2 Client and Business Information

This may include:

client contact details;
contractual information;
correspondence;
instructions;
project records;
quotations;
invoices;
statements;
meeting records;
administrative records; and
business documentation.

4.3 Property and Community Management Information

Where required to provide services to a client, Astalex may process information relating to:

owners;
residents;
tenants;
trustees;
directors;
committee members;
managing agents;
employees;
contractors;
suppliers;
service providers; and
other persons associated with a property, estate, community or organisation.

Information may include correspondence, requests, complaints, administrative records, contact information, property-related information, registers and records required for operational purposes.

4.4 Board and Executive Administration Information

This may include:

meeting documentation;
agendas;
minutes;
resolutions;
action registers;
correspondence;
reports;
governing documents;
attendance records;
decisions;
supporting documentation; and
other administrative records.

4.5 Financial and Debtors Administration Information

Where required for the services provided, information may include:

account information;
outstanding balances;
payment information;
payment history;
debtor records;
invoices;
statements;
financial correspondence;
budget-related information;
supporting financial documentation; and
records relating to payment follow-up or account administration.

Astalex does not require or intentionally collect payment-card credentials unless specifically necessary and appropriately authorised.

4.6 Maintenance, Contractor and Operational Information

This may include:

maintenance requests;
work orders;
quotations;
contractor information;
supplier information;
inspection records;
project records;
photographs or supporting evidence;
completion records;
outstanding actions; and
operational correspondence.

4.7 Security, Incident and Complaint Information

Where relevant to a client’s operations, Astalex may receive information concerning:

security incidents;
complaints;
access-related matters;
operational incidents;
resident or visitor concerns;
investigations;
supporting correspondence; and
follow-up actions.

Astalex will only process such information to the extent reasonably necessary for the service being provided or where otherwise permitted by law.

4.8 Website and Technical Information

When you use our website, certain technical information may be collected automatically by the website, hosting infrastructure or authorised service providers.

Depending on the technologies in use, this may include:

IP address;
browser type;
device type;
operating system;
referring website;
pages visited;
approximate location derived from technical information;
dates and times of access;
cookie identifiers; and
website usage information.

4.9 Enquiry Information

The Astalex website allows individuals to submit enquiries.

Information submitted may include:

first and last name;
email address;
the service being enquired about;
information entered into free-text enquiry fields; and
any other information voluntarily provided by the individual.

Please do not submit unnecessary confidential, sensitive or special-category personal information through the website enquiry form.

Special or Sensitive Personal Information

Due to the nature of property, community, debtor, complaint, security and administrative work, information supplied to Astalex by a client could occasionally contain sensitive or special-category personal information.

Astalex does not seek to collect such information unnecessarily.

Where sensitive or special-category information must be processed, it will be processed only where:

reasonably necessary for a legitimate purpose;
instructed or authorised by the relevant client;
permitted by applicable law;
appropriate safeguards are in place; and
any additional legal requirements relating to sensitive information have been satisfied.

How We Obtain Personal Information

Astalex may obtain personal information:

directly from you;
when you complete a website form;
when you email or telephone us;
when you request information about our services;
when you become a client;
from an organisation for which you work;
from a client engaging Astalex to perform services;
from property managers, estates, community associations or governing bodies;
from authorised representatives;
from contractors, suppliers or professional advisers;
from systems or platforms to which we are lawfully granted access;
from correspondence and administrative records;
from publicly available information where lawful and appropriate; or
automatically through website and technical systems.

Where personal information has been supplied to Astalex by a client, Astalex relies on that client to ensure that it has an appropriate lawful basis for providing the information to Astalex.

Why We Process Personal Information

Astalex may process personal information for purposes including:

responding to enquiries;
providing quotations or proposals;
communicating with prospective clients;
entering into and managing client relationships;
delivering contracted services;
managing owner, resident, tenant or stakeholder correspondence on behalf of clients;
supporting community and property administration;
preparing meeting documentation, minutes, reports and registers;
tracking actions, responsibilities and outstanding matters;
administering accounts, debtors, invoices and statements;
following up payments where instructed;
co-ordinating maintenance, contractors, inspections and projects;
maintaining records and documentation;
dealing with complaints, operational matters or security-related administration;
communicating with suppliers and contractors;
managing our own accounting and business administration;
complying with legal and regulatory obligations;
protecting legal rights and legitimate business interests;
preventing misuse, fraud or security incidents;
maintaining and protecting our website and systems;
analysing and improving our services;
sending communications requested or consented to by recipients; and
establishing, exercising or defending legal claims.

Astalex will not intentionally use personal information for a materially incompatible purpose without an appropriate legal basis.

Legal Bases for Processing

Depending on the jurisdiction and circumstances, Astalex may rely on one or more lawful grounds for processing personal information, including:

your consent;
steps taken at your request before entering into a contract;
performance of a contract;
compliance with a legal or regulatory obligation;
protection of the legitimate interests of a data subject;
protection of another person’s vital interests where applicable;
Astalex’s legitimate business interests;
the legitimate interests of a client or another third party where those interests are not overridden by applicable privacy rights;
establishment, exercise or defence of legal claims; or
another lawful basis permitted by applicable legislation.

Where consent is the legal basis for processing, you may withdraw that consent subject to applicable law.

Withdrawal of consent does not invalidate processing that lawfully occurred before the withdrawal.

Client-Provided Information

Astalex’s services are designed to operate as an extension of a client’s existing administrative or management function.

Clients may therefore provide Astalex with information concerning individuals with whom Astalex has no direct relationship.

Where Astalex processes such information solely on behalf of a client:

Astalex will use the information only for the authorised service;
access will be limited to persons who reasonably require it;
confidentiality obligations will apply;
Astalex will not independently determine unrelated uses for the information;
Astalex will take reasonable measures to protect the information;
Astalex will reasonably assist the client with appropriate data protection obligations where required; and
information will be returned, deleted, retained or otherwise dealt with in accordance with the agreement with the client and applicable law.

Clients remain responsible for ensuring that instructions provided to Astalex are lawful.

Sharing and Disclosure of Personal Information

Astalex may disclose personal information where reasonably necessary to:

the relevant Astalex client;
persons authorised by that client;
employees, personnel or authorised representatives involved in providing the service;
property managers or managing agents;
trustees, directors, board members or committee members;
contractors and suppliers;
accountants, attorneys, auditors and other professional advisers;
technology, hosting, communication, document-management or cloud service providers;
financial institutions or payment providers where necessary;
regulatory authorities;
law enforcement authorities;
courts or tribunals; or
another party where disclosure is required or permitted by law.

Astalex requires service providers that process personal information on our behalf to handle that information appropriately and, where required, subject to contractual confidentiality and data protection obligations.

Astalex does not disclose personal information merely because a third party requests it.

Sale of Personal Information

Astalex is a professional services business and does not operate as a data broker.

Astalex does not sell personal information as part of its ordinary business activities.

Where a particular jurisdiction gives individuals additional rights concerning the “sale” or “sharing” of personal information, those rights will be honoured where the relevant law applies.

International and Cross-Border Transfers

Astalex provides remote services internationally. Personal information may therefore be accessed, processed, stored or transferred across national borders where necessary to provide services.

Astalex will take reasonable steps to ensure that international transfers are made in accordance with applicable data protection requirements.

Depending on the jurisdiction, safeguards may include:

transferring information to a country recognised as providing an adequate level of protection;
contractual data protection requirements;
data processing agreements;
confidentiality agreements;
the European Commission’s Standard Contractual Clauses where applicable;
appropriate UK international transfer mechanisms where applicable;
POPIA-compliant contractual protections;
consent where legally appropriate;
another recognised transfer mechanism; or
another exception specifically permitted by applicable legislation.

Where POPIA applies, cross-border transfers will be dealt with in accordance with the requirements applicable to the transfer of personal information outside South Africa.

Astalex will not transfer personal information internationally merely for convenience where doing so would be unlawful.

Information Security

Astalex takes reasonable and appropriate technical and organisational measures designed to protect personal information against:

loss;
destruction;
unauthorised access;
unauthorised disclosure;
alteration;
misuse; and
unlawful processing.

Measures may include, where appropriate:

access controls;
password protection;
multi-factor authentication;
secure systems and devices;
encryption where appropriate;
secure backups;
confidentiality requirements;
restricted access to client information;
security updates;
malware protection;
appropriate document-management practices;
supplier due diligence;
contractual security requirements; and
incident-management procedures.

No electronic system or method of transmission can be guaranteed to be completely secure. Astalex therefore applies safeguards proportionate to the nature and sensitivity of information being processed.

Confidentiality

Information supplied to Astalex for the delivery of professional services will be treated as confidential subject to:

the client’s instructions;
contractual obligations;
operational requirements;
authorised disclosure; and
applicable law.

Astalex personnel and service providers who require access to confidential information will be expected to handle it appropriately.

Data Minimisation

Astalex seeks to limit the collection and processing of personal information to information that is:

relevant;
reasonably necessary;
proportionate to the purpose; and
not excessive in relation to the intended processing activity.

Clients are requested not to provide Astalex with personal information that is not reasonably required for the agreed service.

Accuracy of Information

Astalex will take reasonable steps to maintain personal information that is accurate, complete and not misleading where accuracy is relevant to the purpose for which the information is processed.

Individuals and clients should notify Astalex when information supplied to us materially changes.

Retention of Personal Information

Astalex retains personal information only for as long as reasonably necessary for the purposes for which it was collected or where retention is required or permitted by law.

Retention periods may depend on:

the nature of the information;
the services being provided;
client instructions;
contractual requirements;
financial and tax requirements;
statutory recordkeeping obligations;
potential legal claims;
dispute-resolution requirements;
regulatory obligations; and
legitimate operational requirements.

When information is no longer required, Astalex may securely delete, destroy, anonymise or return it, subject to applicable obligations.

Client data processed on behalf of a client may be retained or deleted according to the client’s lawful instructions and the applicable agreement.

Cookies and Website Technologies

The Astalex website may use cookies and similar technologies necessary for the operation, security, functionality and performance of the website.

Cookies may include:

Essential Cookies

These support core website functionality and security.

Preference or Functional Cookies

These may remember selections or settings intended to improve website functionality.

Analytics Cookies

Where analytics services are enabled, these may help us understand how visitors use the website.

Marketing Cookies

If Astalex introduces advertising or marketing technologies requiring tracking consent, such technologies will be used in accordance with applicable law.

Where applicable law requires consent before non-essential cookies or similar tracking technologies are placed, Astalex will seek the appropriate consent.

Users may also be able to restrict cookies through their browser settings.

Direct Marketing and Newsletters

Astalex may communicate with individuals about services, business updates or other relevant information where:

the individual has requested the communication;
consent has been provided;
an existing client relationship permits the communication;
another lawful basis applies; and
applicable direct-marketing legislation permits the communication.

Where consent is required, Astalex will seek that consent before sending the relevant marketing communication.

Marketing communications will include a reasonable method of opting out where required.

An individual may request that Astalex stop sending direct marketing communications at any time.

Automated Decision-Making

Astalex’s primary services are based on professional administrative and management support.

Astalex does not ordinarily make decisions having legal or similarly significant effects on individuals solely through automated processing.

If Astalex introduces such processing in future, affected individuals will be provided with additional information and safeguards where required by applicable law.

Children’s Personal Information

Astalex’s services are not specifically directed at children.

However, property, community or client records may in limited circumstances contain information relating to children.

Where such information is processed as part of a client service, Astalex will process it only where reasonably necessary, authorised and lawful, and will apply appropriate safeguards.

Children should not submit personal information directly through the Astalex website without appropriate adult involvement where required.

Your Privacy Rights

Depending on the law applicable to you and the circumstances of the processing, you may have rights including the right to:

be informed about the processing of your personal information;
ask whether Astalex holds personal information about you;
request access to personal information;
request correction of inaccurate or incomplete information;
request deletion or erasure where legally permitted;
object to certain processing;
request restriction of processing;
withdraw consent where processing is based on consent;
request data portability where applicable;
object to direct marketing;
opt out of certain sale, sharing, targeted advertising or profiling activities where applicable;
request information concerning recipients of your personal information;
request information regarding international transfers;
challenge certain automated decisions;
not be discriminated against for exercising applicable privacy rights; and
lodge a complaint with an appropriate privacy or data protection authority.

These rights are not absolute and may be subject to legal exceptions.

For example, Astalex may be required to retain information because of contractual, tax, regulatory, evidentiary or other legal obligations.

Exercising Your Rights

Privacy requests may be sent to:

Astalex International Solutions
Email: info@astalexinternational.com
Telephone: +27 81 463 7047
Website: www.astalexinternational.com

Please clearly describe:

who you are;
the information or processing activity concerned;
the right you wish to exercise; and
sufficient information to allow us to identify the relevant records.

Astalex may request reasonable verification of identity before releasing, correcting or deleting personal information.

Where Astalex processes information solely on behalf of a client, Astalex may refer the request to that client or require the request to be made directly to the client.

We will respond within the time period required by applicable law.

Right to Object to Direct Marketing

You may object at any time to the use of your personal information for direct marketing.

Where applicable law grants an unconditional right to object to direct marketing, Astalex will stop using your personal information for that purpose following a valid objection, subject only to limited information being retained where necessary to record and honour the opt-out.

Security Incidents and Personal Data Breaches

If Astalex becomes aware of a personal information security compromise, Astalex will assess the incident and take reasonable steps to:

contain the incident;
investigate what occurred;
reduce potential harm;
secure affected systems or information;
notify the relevant client where Astalex acts as an operator or processor; and
notify affected individuals and/or regulatory authorities where required by applicable law.

PAIA and Access to Records

South African individuals may also have rights to request access to records under the Promotion of Access to Information Act 2 of 2000 (“PAIA”).

PAIA requests are separate from ordinary privacy or data-subject requests and are subject to the procedures, grounds for access, grounds for refusal and other requirements contained in PAIA.

Where required by law, Astalex will maintain or make available the information required for the exercise of PAIA rights.

Complaints

We encourage individuals to contact Astalex first if they believe their personal information has been handled incorrectly so that we have an opportunity to investigate and respond.

Privacy enquiries or complaints may be sent to:

info@astalexinternational.com

South Africa

Where POPIA applies, you also have the right to lodge a complaint with the:

Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191
South Africa

Telephone: 010 023 5200
Toll Free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za

European Union

Where the EU GDPR applies, you may have the right to lodge a complaint with the competent supervisory authority in the European Economic Area country in which you live, work or believe an infringement occurred.

United Kingdom

Where UK data protection legislation applies, you may have the right to complain to the United Kingdom Information Commissioner’s Office (“ICO”).

Other Jurisdictions

Where another privacy law applies, you may have the right to complain to the relevant privacy, information or data protection authority in that jurisdiction.

Third-Party Websites and Services

The Astalex website may contain links to websites or services operated by third parties.

Astalex is not responsible for the privacy practices of independent third parties.

Users should review the privacy policies of external websites and services before providing personal information to them.

Changes to this Privacy Policy

Astalex may update this Privacy Policy from time to time to reflect:

changes to our services;
changes to technology or systems;
changes to our information-handling practices;
changes to applicable legislation; or
regulatory guidance.

The latest version will be published on our website together with the effective or last-updated date.

Material changes may be communicated separately where required by law.

Contact Astalex

Questions about this Privacy Policy or the processing of personal information may be directed to:

Astalex International Solutions

Email: info@astalexinternational.com
Telephone: +27 81 463 7047
Website: www.astalexinternational.com

Remote support available internationally.