Legal
Privacy Policy
PEx Recovery Solutions Ltd., Project Exodus SA NPC & Exodus Recovery Applications
Last updated: 27 May 2026
Introduction
- This Privacy Policy constitutes a legal agreement between you and PEx Recovery Solutions Ltd (herein referred to as “PROJECT EXODUS”).
- For convenience and clarity, this Privacy Policy refers to Pex Recovery Solutions Ltd as “PROJECT EXODUS” or “we”, “us” or “our” and to you as “you” or “your”, as the context might indicate.
- By using and accessing the Services (as defined in the PROJECT EXODUS Terms of Service), you agree to be bound by this Privacy Policy.
- This Privacy Policy explains the following, amongst other things:
- our principles with respect to your data and your privacy;
- the information we collect about you;
- how we collect and use your personal information;
- how your personal information is kept safe and secure;
- how we share your personal information;
- how we use cookies and similar technology;
- your choices with respect to your personal information; and
- how to contact us regarding privacy.
Privacy Policy
- This Privacy Policy is applicable when you access and use the Services and the Content (all as defined in the Terms of Service) and all related websites, tools, applications, data, software, and any services provided by us, all of which have been designed to give you control over the information you share with us and publish more generally. Please take full advantage of these tools and make sure you only disclose and share what you want to share.
- This Privacy Policy sets out the manner in which we deal with your personal information, as defined in privacy laws (the model for our Privacy Policy is the Protection of Personal Information Act Nr 4 of 2013 (POPI) and General Data Protection Regulation 2016/679 (GDPR), a regulation of European law on data protection and privacy for individuals).
- Your rights under these privacy laws include:
- Right of Access
This includes your right to access the Personal Information we gather about you and your right to obtain information about the sharing, storage, security and processing of that information. - Right to Correction
This is your right to request correction of your Personal Information. - Right to Erasure
This is your right to request, subject to certain limitations, that your Personal Information be erased from our possession (also known as the “Right to be forgotten”). Our fulfilment of a request to delete your information might affect your use of the Services or prevent you from using the Services and may result in the closure of your account. - Right to Complain
You have the right to make a complaint regarding our handling of your Personal Information with the appropriate supervisory authority under POPI and the GDPR. - Right to Restrict Processing
This is your right to request restriction of how and why your Personal Information is used or processed. - Right to Object
This is your right, in certain situations, to object to how or why your Personal Information is processed. - Right to Portability
This is your right to receive the Personal Information we have about you and the right to transmit it to another party. - Right to not be subject to Automated Decision-Making
This is your right to object to (and prevent) any decision that could have a legal or similarly significant effect on you from being made solely in accordance with an automated process. This right is limited, however, if the decision is necessary for performance of any contract between you and us, or is allowed by applicable law, or is based on your explicit consent.
- Right of Access
- Many of these rights can be exercised by signing in and directly updating your account information. If you have questions about exercising these rights or need assistance, please contact us at online@projectexodus.net.
- If you are at all concerned that this Privacy Policy is in any way incompatible with privacy laws in your country or the country from which you access the Services, you must notify us in writing by email sent to online@projectexodus.net, providing sufficient detail to enable us to assess and rectify (if necessary), the suspected incompatibility.
Binding Agreement
- Your agreement to this Privacy Policy is established through two distinct mechanisms:
- Account registration — when you create an account with PROJECT EXODUS, you accept this Privacy Policy and our Terms of Service. This acceptance covers the collection and use of personal information necessary to provide the Services, including account authentication, group management, member administration, billing, and transactional communications.
- Cookie consent — when you first visit our websites or applications, a cookie consent banner allows you to separately choose whether to enable analytics tracking and marketing communications. This consent is distinct from account registration, freely given, and can be withdrawn at any time by selecting “Cookie Preferences” in the footer of any page.
- Withdrawing analytics or marketing consent does not affect your ability to access the Services.
- Please take some time to read this Privacy Policy, and make sure you agree with the manner of our use and disclosure of your personal information. If you do not agree to any of the provisions of this Privacy Policy or if you are uncertain about any aspect of this Privacy Policy, immediately cease all use of the Services and raise your concerns with us — contact us at online@projectexodus.net.
- The terms and conditions of use and this Privacy Policy are associated by reference and must be read one in conjunction with the other.
Personal Information
- Our Services requires you to collect, process and provide your related Personal Information to us, including information that relates to you (for example name, age and related information). This information and in fact any information that we have about you will be regarded and will be referred to in this Privacy Policy as Personal Information (“Personal Information”).
Voluntary Submission of Information
- We do not assume any responsibility to check or correlate your Personal Information and, instead, we provide you with every opportunity to access and ensure the correctness of all your Personal Information. For this reason, you are responsible for ensuring the accuracy of all Personal Information we have about you.
How We Collect Your Personal Information
- We collect information, including Personal Information, from you in a variety of ways. Whenever you use our Services, contacting us electronically or using any of the tools, applications, data or any services provided by us, we automatically collect information about you.
- We collect Personal Information only from those who submit such information. You can always and you are entitled to refuse to supply such Personal Information. Such refusal may however prevent you from engaging in certain of our Services.
Reasons for Collecting Your Personal Information
- The following are reasons why we collect your personal information:
- to identify you properly and to personalise your experience;
- to process your instructions or requests — to make your use of our Services as successful and effective as possible, it is necessary for us to find out exactly what you require from us;
- to ensure that we meet your requirements, we may collect and analyse your Personal Information and combine all the information that we have about you to compile a profile of you in order for us to personalise and tailor our Services to meet your specific requirements to improve the functionality and operation of our Services, we may use Personal Information in the aggregate (de-identified and aggregated to prevent personal identification) to understand how some of you, as a group, use our Services; and
- to improve our Services and customer service — we continually strive to improve our Services offerings based on the information and feedback we receive from you — your information helps us to respond more effectively to your service requests and support needs.
- We may also collect non-personal identification information about you whenever you interact with our Services, including the browser name, the type of computer, mobile device and technical information about your means of connection to our Services, such as the operating system and the Internet service providers used in the process.
Special-Category Personal Information
- Where you participate in a PROJECT EXODUS recovery group or programme, our facilitators may collect special-category personal information as defined under POPIA Section 26, including:
- health information: substance use history, current and previous treatment programmes, and recovery background;
- demographic information: date of birth, gender, and ethnicity; and
- emergency contact details of a nominated third party.
- Legal basis for processing: This information is collected and processed for statistical analysis and research purposes in terms of POPIA Section 27(1)(b), to support group facilitation reporting and organisational programme evaluation. Aggregate and de-identified data derived from this information may be used in funding applications and programmatic reporting.
- Who can access it: Special-category information is accessible only to facilitators of each organisation where you have attended a group or participated in a programme — if you have engaged with multiple organisations, facilitators in each of those organisations will have access — and to authorised PROJECT EXODUS staff. It is not shared with other organisations or third parties except in anonymised, aggregated form.
- You may request access to, correction of, or deletion of your special-category information by contacting us at online@projectexodus.net. Deletion requests are processed by authorised PROJECT EXODUS staff.
Third-Party Processors
- The following third-party service providers process personal information on our behalf in the course of providing the Services. Each provider is bound by a data processing agreement or equivalent contractual terms requiring them to process data only on our instructions and to maintain appropriate security measures.
| Processor | Purpose | Data location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Vercel | Application hosting and delivery | US / EU |
| Make | Workflow automation | EU |
| Thinkific | Academy course enrolments and progress | US |
| Google Analytics | Website and application analytics | US |
| PostHog | Product analytics | EU |
| Loops | Transactional email delivery | US |
| Airtable | Research surveys and marketing forms | US |
| Shopify | E-commerce — programmes, merchandise, and academy courses | US |
| Mapbox | Location search (ephemeral — not stored) | US |
| DocuSeal | Document signing | US |
Protection of Your Personal Information
- We take all reasonable steps to protect your Personal Information from loss, misuse or unauthorised alteration.
- We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of your Personal Information stored on our computer systems.
- When you register on our Services, you must provide a username and password. You are responsible for maintaining the secrecy and confidentiality of your username and password.
Correction and Removal of Personal Information
- If your Services account remains inactive (no access, no use) for longer than 6 (six) months, whether you decide to stop using our Services or you simply no longer use our Services or for any other reasons, we will be entitled, but not obliged, to remove your Personal Information from our Services if you have not already done so.
Cross-Border Data Transfer
- The owner of the PROJECT EXODUS software is based in Mauritius. In providing the Services, we transfer personal information to processors located in the European Union and the United States — please refer to the Third-Party Processors section above for details of each processor and their location.
- We take steps to ensure that any processor to which we transfer personal information maintains data protection standards comparable to POPIA, including by entering into data processing agreements with processors that include appropriate contractual safeguards.
- This section constitutes notice in terms of Section 72 of POPIA regarding the transfer of personal information beyond South Africa's borders.
Personal Information Disclosed by You to a Third Party
- We do not exercise control over affiliate parties' privacy policies and you should refer to the privacy policy of any such affiliate party to see how that party protects your privacy.
AI Chat Assistant
- We offer an AI chat assistant that helps visitors find information about PROJECT EXODUS recovery solutions and resources. The assistant is available to the public and does not require you to create an account or sign in.
- When you use the assistant, we collect and process:
- the messages you send and the replies the assistant generates;
- a randomly-generated visitor identifier stored in your browser (in local storage) and a separate per-session identifier, which allow the conversation to continue across page loads; and
- technical metadata about each exchange, including timestamps, the AI model used, and the number of tokens processed.
- We use this information to operate the assistant, generate responses to your questions, maintain continuity within a conversation, and improve the quality and reliability of the service.
- To generate responses, the messages you send are processed by a third-party large-language-model provider via an AI gateway service. To find relevant information in our public knowledge base, short text snippets are also sent to a third-party embeddings provider. These providers process this data on our behalf in order to return a response and are subject to the same contractual safeguards described in the Third-Party Processors and Cross-Border Data Transfer sections above.
- The persistent visitor identifier is automatically anonymised 24 (twenty-four) months after a conversation is created, which breaks the link between the stored messages and your browser.
- The assistant is intended for general information only and is not a substitute for professional, medical, or crisis support. Please do not submit sensitive personal information — such as health details, identity numbers, or financial information — into the chat.
- The e-mail addresses provided by you may be used to send information and updates pertaining to our Services. It may also be used to respond to your inquiries and other requests or questions. If you opt-in to our mailing list, you will receive an e-mail that may include company news, updates, related product or service information. If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each e-mail.
- We may send you promotional information about our own Services that we think may be of interest to you. We do not share your contact details with affiliated or third-party organisations for their direct marketing purposes without your separate and explicit consent, which we will seek at the point of collection if relevant.
Warranty and Indemnity
- We use every reasonable endeavour to ensure that data and information stored by and supplied through our Services are secure, current and accurate.
- Notwithstanding the above, PROJECT EXODUS provides the Services and the data and information therein as is and without any warranties either express or implied, including any implied warranties of correctness or currentness of information, merchantability, non-infringement of third party rights, freedom from viruses or harmful code or fitness for a particular purpose and neither us nor any of our representatives (including information providers, suppliers, officers, employees, agents or telecommunications or internet service providers) shall be liable to you or any person claiming through you for any direct, indirect, incidental, special, or consequential damages arising out of the use of our Services.
Warning
- Even with the use of encryption, the Internet is not a secure medium and privacy cannot be ensured and, whilst we make every effort to protect your information and Personal Information in particular, it must be appreciated that it is nevertheless possible for information on our Services to be accessed without our permission.
Changes to Privacy Policy
- We may, in our sole discretion, update this Privacy Policy at any time. When we do, we will revise the update date at the top of this Privacy Policy document. We encourage you to check frequently for any changes to this Privacy Policy and to stay informed about how we are helping to protect the Personal Information we collect. You acknowledge and agree that it is your responsibility to review this Privacy Policy periodically and become aware of modifications.
- For users of the Bridge platform, material changes to this Privacy Policy will be communicated directly — you will be asked to review and accept the updated version before continuing to use the Services.
Children
- Neither our Services, nor the Services are directed at children. We do not knowingly accept online Personal Information from children under the age of 18.
- If you are under the age of 18 or otherwise would be required to have parent or guardian's consent to share Personal Information with us, you must ensure that you obtain the necessary parent or guardian's consent before you share Personal Information with us. Alternatively, you must not send any information about yourself to us.
Information Regulator
- If you believe we have processed your personal information contrary to this Privacy Policy or applicable law, we encourage you to contact us first at online@projectexodus.net so we can attempt to resolve your concern.
- If you remain unsatisfied, you have the right to lodge a complaint with the Information Regulator of South Africa:
Information Regulator (South Africa)
Physical: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Postal: PO Box 31533, Braamfontein, Johannesburg, 2001
