Privacy notice

Who is responsible

VESSEY AND VESSEY (PTY) LIMITED, registration number 2021/822256/07, is the responsible party for the personal information described in this notice. Our registered address is 99 Conrad Drive, Blairgowrie, Johannesburg, South Africa, 2194. Privacy questions and requests can be sent to concepts@vessey.co.za.

Information we collect

We collect the information you provide in the client and project brief, including contact and organisation details, billing address, customer VAT number where applicable, product requirements, project decisions, uploaded files, brand references, correspondence and support requests. We also keep invoice, payment-allocation and accounting records.

The website may collect technical and usage information such as IP address, browser and device information, referral or campaign data, page interactions, form progress, timestamps and security logs. The form uses browser storage to preserve brief progress and attribution data on your device.

Please provide only information that is relevant to the product project. Do not upload identity documents, health information, biometric information, children’s information or personal information about another person unless it is necessary and you are authorised to do so.

How and why we use information

We use information to review a brief, prepare and send an invoice, communicate with you, administer payment, create and deliver concept stages, record approvals, answer support requests, keep business and tax records, secure the service, prevent misuse, measure website performance and improve our process.

Our processing is based on the steps needed to enter into and perform the requested service, legitimate operational and security interests, compliance with legal duties, and consent where the law requires it. We do not use project information to make a decision about you that has legal or similarly significant effects.

AI processing and model training

The concept workflow uses a custom Vessey language model developed and trained using NVIDIA computing technology together with selected models accessed through the OpenAI API. Authorised Vessey personnel manually prepare prompts, select suitable project information, review outputs and assemble the final stage documents.

Prompt text, approved reference material, project requirements and generated responses may be processed through these AI components. We minimise personal information before processing and do not use a customer’s confidential brief, uploads or outputs to train or fine-tune the custom Vessey model without separate, explicit written permission.

OpenAI states that API inputs and outputs are not used to train its models by default. OpenAI may retain standard API abuse-monitoring records for up to 30 days unless a different approved data-control setting or legal requirement applies. Further information is available in the OpenAI API data controls.

NVIDIA computing technology is used to develop or run the custom model. Use of NVIDIA hardware does not by itself mean that NVIDIA receives customer project content; disclosure depends on the specific hosted service used for the project.

Service providers and disclosure

Information is available only to authorised Vessey personnel and providers that need it for the following roles:

• the custom Vessey model and supporting NVIDIA computing infrastructure;
• OpenAI API services used for selected language, reasoning or generation tasks;
• website hosting, secure storage, backup and authenticated email delivery;
• banking, invoicing, accounting and professional advisory services;
• Google advertising measurement and website analytics; and
• security, legal or regulatory recipients where disclosure is required or permitted by law.

Providers receive only the information reasonably required for their role and must handle it under applicable confidentiality, security and data-protection obligations. We do not sell personal information, disclose project content for unrelated advertising or allow optional model training without explicit written permission.

Processing outside South Africa

OpenAI, cloud, hosting, email, analytics or other providers may process information outside South Africa. Vessey uses contractual and organisational safeguards intended to provide protection consistent with POPIA and limits transfers to information required for the service. By requesting the service, you understand that authorised international processing may be necessary to generate and deliver the project.

Cookies, browser storage and analytics

The website uses browser storage to preserve a brief in progress and campaign attribution on the device. It also loads the Google tag for Google Ads account AW-18270798112 to measure visits and campaign conversions. Google and the browser may use cookies or similar identifiers for this purpose.

You can control cookies in your browser and clear locally stored brief data from that device. Blocking storage or scripts may affect saved form progress or measurement but does not prevent you from submitting a brief by email.

Retention and deletion

The following default retention schedule applies unless a longer period is required by law, a current dispute, an active support arrangement or a written customer agreement:

At the end of the applicable period, records are deleted, securely destroyed or de-identified. A valid early deletion request will be honoured unless Vessey must retain the record for law, payment reconciliation, security, an unresolved dispute or the establishment or defence of legal rights.

Security and confidentiality

We use proportionate technical and organisational safeguards designed to protect information against loss, misuse, unauthorised access and disclosure. These include HTTPS on production pages, role-based access, authenticated email, restricted project storage, strong credential controls, protected backups and service-provider access limitations.

No internet transmission or storage system is completely secure. Protect project links and account access, and tell us promptly at concepts@vessey.co.za if you suspect unauthorised access. We investigate and respond to a personal-information security compromise in accordance with applicable law.

Your privacy rights

Subject to POPIA and other applicable law, you may ask whether we hold personal information about you, request access, ask us to correct or delete inaccurate or unlawfully retained information, object to certain processing, withdraw consent where processing depends on consent, and object to direct marketing.

Send a request to concepts@vessey.co.za. We acknowledge requests promptly, may ask for reasonable proof of identity and authority, and respond within the period required by applicable law. Withdrawing consent does not invalidate earlier lawful processing and may affect a service that cannot be delivered without the relevant information.