Privacy Policy

The responsible party is Arke Technologies (Pty) Ltd t/a Server Hub (registration 2017/386810/07), a private body with its registered office at 8 Greenstone Place, Stoneridge Office Park, Greenstone Hill, 1609, South Africa. Our Information Officer is Janelle Kettle, Chief Financial Officer, contactable at info@serverhub.co.za or +27 10 447 2446.

• Contact & account details — name, e-mail address, telephone number, delivery and billing addresses, and, for business customers, company name and VAT number.
• Order & transaction data — the products you buy, quotes you request, and payment confirmations (we never store full card details; these are handled by our payment providers).
• Usage, traffic and device data — pages and products you view, searches, cart activity and a first-party site identifier, collected to run and improve the store (see our Cookie Policy); and, when you open an email we have sent you, when it was opened, the email program used and an approximate location (see section 6).
• Enquiry & chat content — messages you send us by e-mail, the contact form or live chat, including any details you choose to provide and any attachments.

POPIA protects information about companies and other juristic persons as well as individuals. We apply this policy to both, so your company’s details are protected in the same way as your own.

We process personal information to:

• fulfil your orders and provide the products and services you ask for (performance of a contract);
• verify the identity of customers who contact us, and manage our relationship with you, including telling you about products and offers where you are an existing customer or have opted in (legitimate interest / consent);
• carry out risk assessment, statistical and trend analysis, and to secure, maintain and improve the site (legitimate interest);
• monitor and record communications for quality, training and fraud prevention (legitimate interest); and
• meet our legal, regulatory and compliance obligations (legal obligation).

Our first-party, pseudonymous site analytics run on the basis of legitimate interest (POPIA s11(1)(f)) to keep the store working well and to understand what our customers need. No advertising cookies are set without your agreement, and you may object at any time — see Cookies.

We send marketing e-mails only where you have opted in, or to existing customers about similar products as permitted by POPIA s69. Every marketing e-mail carries an unsubscribe link, and you can opt out at any time by e-mailing info@serverhub.co.za. If we switch on advertising audiences, only the email addresses of people who have given us their explicit consent to marketing are shared with the advertising platforms named in section 6, and only in hashed (scrambled) form.

We share personal information only as needed to run our business: with Arke Technologies (Pty) Ltd, of which Server Hub is a trading division; with the cloud, email-hosting and infrastructure providers that run our systems; with AI and cloud service providers acting as our operators (see section 6); with couriers, tracking and payment providers; with other operators that process information on our behalf, on the terms on which they provide their services to us; with professional advisers; and with regulators or other parties where disclosure is required or permitted by law. We do not sell your personal information.

We use artificial intelligence (AI) tools to help our team work faster. We use them for:

• reading and sorting enquiries, emails and attachments (such as specification sheets, tenders and purchase orders);
• preparing quotations, technical proposals and replies;
• helping our team find and work with your customer, quotation and order records;
• product, availability and price research;
• the Sales Advisor in our website chat, which tells you it is an AI whenever it is the one answering;
• suggesting builds in our PC builder and server configurator from what you enter, which are indicative until they appear on a quotation; and
• tracking shipments and keeping you updated on delivery.

The information these tools may process is:

• contact details — name, email address, telephone number, company name and delivery address.
• what you send us — enquiries, emails, chat messages and attachments.
• quotation, order and delivery details — the products you ask about or buy, tracking numbers and destination city.

What runs today.The AI built into our website and business systems — sorting emails, drafting, the Sales Advisor in our website chat and the build suggestions — runs on Google Cloud’s Vertex AI, using Google’s own AI models, such as Gemini. Google processes your information as our operator, and Google’s published terms for Vertex AI state that it will not use our data to train its AI models without our permission.

Our team’s AI assistants.Our team also uses AI assistants from Anthropic (Claude) and Cognition (Devin). They connect to our business systems through a secure, key-controlled connection that we run, and can see what our systems hold about you, including the messages you send us. On work a member of our team gives them, they read customer records, email threads, quotations and orders, and draft quotations, replies and notes, which that person reviews. Anthropic and Cognition process what they receive in the United States, as our operators, and keep it for the periods their terms set for the services our team uses; you may ask our Information Officer which terms apply. The steps we list below, under “Before we use another AI provider”, are for providers we do not use yet; they are not applied to these assistants.

Card payments are made directly with our payment providers, so card details from a payment never reach us or our AI tools. Please do not send card details by email or chat: whatever you send us is handled as this section describes.

The AI providers we use, or may use, for this work, whether each is in use today, and where they process your information, are:

• Google Cloud (Google LLC) (in use) — Vertex AI, which runs the AI built into our website and business systems using Google's own AI models, such as Gemini, and may also run Anthropic's Claude models for us. Google Cloud also hosts our website, database and business systems. Where: Google data centres worldwide for AI processing; our main database and servers are in the United States.
• Anthropic PBC (in use) — Claude, an AI assistant our team uses (in Claude Code and Claude Desktop) to work in our business systems through a secure, key-controlled connection that we run. On work a member of our team gives it, it reads customer records, email threads, quotations and orders, and drafts quotations, replies and notes for that person to review. We may also use Anthropic's Claude models directly as a standby if the Google Cloud service is unavailable. Where: United States.
• Cognition AI, Inc. (Devin) (in use) — Devin, an AI assistant our team uses to work in our business systems through the same secure connection. On work a member of our team gives it, it reads customer records, email threads and quotations, and drafts quotations, replies and notes for that person to review. Where: United States.
• Anysphere, Inc. (Cursor) (may be used) — Cursor, an AI assistant our team may connect to our business systems in the same way, to read the same records and draft work for a person to review. Where: United States.
• OpenRouter, Inc. (may be used) — a routing service that would pass a request to a model host such as Fireworks AI, Together AI, DeepInfra, Amazon Web Services or Microsoft Azure. Where: United States, with model hosts in the United States and the European Union.
• Meta Platforms, Inc. (Muse AI models) (may be used) — Meta's Muse AI models. Where: United States.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) (may be used) — DeepSeek AI models. Where: People's Republic of China.
• Moonshot AI (Moonshot AI Pte. Ltd.) (may be used) — Kimi AI models. Where: Singapore.

These other operators also process your information for us:

• Contabo GmbH (in use) — hosts our email server. The emails you send us, and the emails we send you, pass through it and are stored on it. Where: Germany (European Union).
• Meta Platforms, Inc. (WhatsApp, Messenger and Instagram) (in use) — carries your messages and calls when you choose to contact us on WhatsApp, Messenger or Instagram. Where: United States.
• Cloudflare, Inc. (in use) — relays the connection for voice calls with us over WhatsApp. The call audio is encrypted while it passes through. Where: Cloudflare's worldwide network, including Johannesburg; Cloudflare, Inc. is in the United States.
• Apple Inc. (Apple Push Notification service) (in use) — rings our team's iPhones when you call us on WhatsApp. It receives the caller's name as we hold it, never your phone number. Where: United States.
• IPinfo (IPinfo Inc.) (in use) — when you open an email our team has sent you, looks up the approximate location (town, region and country) of the internet (IP) address it was opened from, so our team can see that it was read. It receives that address only. Where: United States.
• DataForSEO (DataForSEO OÜ) (in use) — search-engine research — keyword volumes for our website, and web search results for product, availability and price research. It receives search terms only, with email addresses and phone numbers removed, never your contact details. Where: Estonia (European Union), with servers in Germany and the United States.
• Elastic Email (Elastic Email Inc.) (may be used) — an email-sending service we may switch on to send our emails, including marketing emails. If we do, the emails we send you, with your name and email address, pass through it. Where: Canada, with processing in the United States and the European Union.
• Meta, Google and LinkedIn advertising (Meta Platforms, Inc., Google LLC and LinkedIn Corporation) (may be used) — if we switch it on, we upload the email addresses of people who have given us their explicit consent to marketing, scrambled with a one-way code (hashed) so that they are never sent in readable form, so that these platforms can show those people our adverts. Where: United States.
• Brave Search API (Brave Software, Inc.) (may be used) — a standby web search for product, availability and price research. It receives search terms only, never your contact details. Where: United States.
• Ship24 (planned) — parcel tracking. It would receive tracking numbers and the destination city, to follow your delivery. Where: European Union.

Before we use another AI provider. Before we route any of your information to an AI provider that is not shown as in use above, we will:

• strip secrets from it first, such as card numbers, bank account numbers, South African ID numbers, passwords, one-time PINs and access keys;
• keep commercial pricing data (supplier names, costs and margins) away from any provider whose terms allow it to use what it receives to train or improve its models (DeepSeek, Moonshot AI and Meta's discounted Muse service);
• switch off request and response logging wherever the setting can be controlled, and instruct routing services to use only model hosts that do not keep, or train on, what they receive; and
• show that provider as in use in the Server Hub Privacy Policy and PAIA Manual.

Some of these providers’ terms allow them to use what they receive to train or improve their models: DeepSeek, Moonshot AI and Meta’s discounted Muse service. We do not use them today.

Protection in other countries. These countries may not have laws that protect personal information to the same standard as POPIA (we tell you this as required by POPIA s18(1)(g)). Where you have asked us for a quotation, an order or another service, we transfer your information because the transfer is necessary to respond to you or to perform our contract with you (s72(1)(c)). Each provider processes it as our operator, to do the work we ask of it, on the data-processing terms it publishes for its business customers, which we rely on. Before we route your information to a provider we do not use today, we will confirm which basis in POPIA s72 applies to that transfer: terms that bind the provider to protection substantially similar to POPIA (s72(1)(a)), or the transfer being necessary to respond to your request or to perform our contract with you (s72(1)(c)).

How long providers keep it.Google may keep what it receives from our AI requests in memory for up to 24 hours to answer faster, and keeps a request that its abuse-monitoring systems flag for up to 90 days. When we use Google’s AI with Google Search to research a product or availability question, Google keeps that request and its answer for 30 days; we remove email addresses and phone numbers from those questions before they are sent. Anthropic and Cognition keep what our team’s AI assistants send them as described above. If we use the other AI providers, their published periods will apply: typically up to 30 days for security and abuse monitoring, and longer if a request is flagged for review (up to two years at Anthropic). DeepSeek and Moonshot AI do not publish a fixed period and keep content for as long as they consider necessary to provide their service.

A person stays in charge. A member of our team reviews every AI-assisted quotation, proposal and email before it is sent to you. There are three exceptions: the automatic acknowledgement we send when your enquiry arrives (it confirms receipt and may ask one question, and contains no prices); the Sales Advisor in our website chat, which answers you directly when it is switched on, says it is an AI, and gives indicative answers that are confirmed only on a quotation; and the builds that our PC builder and server configurator suggest from what you enter, which AI prepares and shows to you straight away, and which are indicative until they appear on a quotation. We do not make any decision that has legal consequences for you, or that affects you to a similar degree, based solely on automated processing (POPIA s71).

Your choices. You may ask us which AI providers have processed your information, and you may object to your enquiries being handled with AI assistance. Contact our Information Officer at info@serverhub.co.za. Once we have recorded your objection, a member of our team will prepare your quotations and replies, and research your requests, without AI drafting or AI research. Some steps run automatically and continue after an objection: every email that reaches us is sorted with AI assistance on Google Cloud as it arrives, our systems may use Google Cloud’s AI to keep our team’s notes on your quotations up to date, and the Sales Advisor in our website chat answers anyone who uses the chat while it is switched on.

Our website, database and business systems run on Google Cloud, with our main database and servers in the United States, and the AI built into our systems runs on Google Cloud, which may take place in its data centres worldwide. Our team’s AI assistants from Anthropic and Cognition process information in the United States. Our email server is hosted by Contabo GmbH in Germany. The other operators in section 6, where we use them, process information in the United States, Canada, the European Union, Singapore and the People’s Republic of China.

Where personal information is transferred outside South Africa, we do so only as POPIA s72 permits: where the transfer is necessary to perform a contract with you or to respond to your request for a quotation or service, or where the recipient is bound by terms that give protection substantially similar to POPIA. We rely on the data-processing terms our operators publish for their business customers.

We apply appropriate, reasonable technical and organisational measures to protect personal information, including access control and authentication, network and endpoint security, encryption where appropriate, secure backups and internal information-security policies, and we review these regularly.

We keep personal information only for as long as necessary for the purposes above or as required by law. Pseudonymous site-analytics records are retained for a limited period and then deleted or aggregated. Information sent to an AI provider is kept by that provider only for the periods described in section 6.

Under POPIA you have the right to be notified of, and to request access to, the personal information we hold about you; to request that it be corrected or deleted; to object to its processing on reasonable grounds; to object to direct marketing; and to lodge a complaint with the Information Regulator.

To exercise these rights, contact our Information Officer at info@serverhub.co.za. The prescribed objection and correction forms are attached to our PAIA Manual.

The Information Regulator (South Africa) can be reached at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; +27 10 023 5200; enquiries@inforegulator.org.za; complaints to POPIAComplaints@inforegulator.org.za; www.inforegulator.org.za.

We may update this policy from time to time. The version and date at the top show when it last changed; material changes will be reflected on this page.