Select Page

Privacy Policy

Easy Does It Social Media (Pty) Ltd and its division Easy Lead Engine × EasyAgent

Effective date: 22 October 2026

This policy tells you how we look after personal information.

Personal information is any fact about a person, such as a name, an email address or a phone number. In South Africa, a business’s details can also count as personal information.

South Africa’s privacy law is called POPIA, the Protection of Personal Information Act 4 of 2013. This policy follows POPIA.

1. Who we are

We are Easy Does It Social Media (Pty) Ltd, a private company registered in South Africa. In this policy we call ourselves “we”, “us” or “our”.

Easy Lead Engine × EasyAgent is a division of Easy Does It Social Media (Pty) Ltd. It is not a separate company. It delivers our lead generation, AI agent, website and CRM services. EasyCRM and EasyBuild are its products.

Under POPIA, we are the responsible party for our own information. This means we decide why and how it is used.

  • Company: Easy Does It Social Media (Pty) Ltd
  • Registration number: 2020/131676/07
  • VAT number: 4150316109
  • Address: 114 13th Avenue, Unit 2 Sunset Place, Fairland, Johannesburg, Gauteng, 2030, South Africa
  • Phone: +27 82 782 7145
  • Email: admin@easydoesitsocial.com
  • Websites: www.easydoesitsocial.com and easyleadengine.io

Information Officer: Diani Gernandt (director)

Deputy Information Officer: Ferdinand Gernandt

For any privacy question or request, contact the Deputy Information Officer:

2. Where this policy applies

This policy applies when you:

  • visit www.easydoesitsocial.com or easyleadengine.io
  • use one of our apps, such as crm.easyleadengine.io, onboard.easyleadengine.io or eb.easyleadengine.io
  • fill in one of our forms, including our free audit form
  • answer one of our ads on Facebook or Instagram
  • get an email, message or call from us
  • become our client, or work for one of our clients or suppliers

3. Our two roles

We do two different jobs with personal information. The rules are a little different for each.

Role 1: We are the responsible party

This is information we use for our own business. For example:

  • people who visit our websites
  • people who fill in our forms or answer our ads
  • people we contact to offer our own services
  • our clients and their staff, for contracts and invoices
  • people who log in to our apps (their login details)
  • our suppliers

Role 2: We are an operator for a client

Our clients hire us to run work for them. This includes email campaigns, websites and forms, CRM systems, AI phone and chat agents, missed-call text-back and review requests.

When we do this work, we use the client’s information about their customers and prospects. We only use it the way the client tells us to. POPIA calls us an operator in this role. The client is the responsible party.

Did you hear from one of our clients? Please contact that client first. They decide how your information is used. You can also contact us. We will pass your request to the client within 2 business days, and we will help them answer you.

Business contact lists

Sometimes a client pays us to put together a list of business contacts for them. We build these lists from public sources and data providers (see section 4).

When we hand a list to a client, that client becomes the responsible party for it. They must follow the same rules we do, including the “one ask” rule in section 8.

We never put the details of people who contacted us, filled in our forms or answered our ads on a list for anyone else.

4. What we collect, and where it comes from

Contact details. Your name, job title, business name, work email, phone number and business website.

  • We get these from you.
  • For business contacts we have not met yet, we may get them from public places. These include your business website, public business directories, Google Maps listings and LinkedIn. We may also get them from a business data provider such as Apollo.io.
  • When we contact you, we always tell you where we got your details.

What you tell us. Your answers in forms, emails, calls, chats and WhatsApp messages. This includes our free audit form.

Answers to our Facebook and Instagram lead forms. See section 9.

Client and billing details. Company name, registration and VAT numbers, address, contact person, agreements, invoices and payments. We do not see or keep your full card number. Paystack handles card payments.

App account details. Your name, email, role and login activity when you use EasyCRM, EasyBuild or our onboarding app.

Call and message records. When we run AI phone or chat agents for a client, we may keep phone numbers, call recordings, transcripts and messages. We do this as the client’s operator.

Website and device details. Your IP address, browser, device and the pages you visit. Some of this comes from cookies. Our Cookie Notice explains this: easyleadengine.io/cookies (and www.easydoesitsocial.com/cookie-notice).

Email campaign details. Whether an email was delivered or bounced, replies, and whether you asked us to stop.

What we do not ask for. We do not ask for special personal information. That means health, religion, race, sex life, politics, union membership, biometrics or criminal records. We also do not ask for children’s information. If you send us any of this by mistake, we delete it unless we truly need it to help you.

5. Why we use it, and our legal reason

POPIA says we need a lawful reason to use personal information. Here is what we do and why.

  • To answer you when you contact us or ask for a free audit. Reason: you asked us to, and we need the information to reply.
  • To give you our services when you are our client. Reason: we need it to carry out our agreement with you.
  • To send invoices and keep tax records. Reason: the law requires it.
  • To ask a new business contact, once, if they want to hear from us. Reason: our legitimate interest in finding clients, used within the “one ask” limit in POPIA section 69. See section 8.
  • To send marketing after you said yes. Reason: your consent.
  • To send marketing about similar services to our existing clients. Reason: POPIA section 69(3). You can say no every time.
  • To run Meta ads and the Meta Pixel. Reason: your consent through our cookie banner.
  • To keep our systems safe, stop fraud and fix our websites. Reason: our legitimate interest.
  • To protect our legal rights. Reason: our legitimate interest, or the law.
  • To run campaigns, sites and apps for our clients. Reason: the client’s instructions. The client must have its own lawful reason.

How we use AI. We use AI tools to help draft messages, sort leads, summarise calls and answer calls or chats for clients. A person checks important work. We never let a computer alone make a decision about you that has a legal effect or a similar serious effect (POPIA section 71). Where an AI provider lets us choose, we switch off the use of your information to train its models.

6. Do you have to give us your information?

Mostly, no. It is your choice.

  • On our forms, fields marked with a star (*) are needed so we can reply. If you leave them out, we cannot help you.
  • If you become our client, we need your billing details. The tax laws require them for invoices. Without them, we cannot sign an agreement with you.

7. Laws that require us to keep some information

These laws make us keep financial and company records:

  • the Tax Administration Act 28 of 2011
  • the Value-Added Tax Act 89 of 1991
  • the Companies Act 71 of 2008

8. Marketing: our “one ask” rule

POPIA has strict rules for marketing by email, SMS, WhatsApp and automated calls. We follow them for our own marketing, and for the campaigns we run for clients.

We only send you electronic marketing if:

  • you said yes, or
  • you are already our client, and we are telling you about similar services. You can say no in every message.

If neither is true, we may contact you once. That one message only asks if you would like to hear from us. It says who we are, where we got your details, and how to say no.

  • If you say yes, we may send you more.
  • If you say no, or do not reply, we stop. We never ask again.
  • We keep your email address or phone number on our stop list, so we never contact you by mistake.

When we run a campaign for a client, the same rule applies. The single ask goes out in the client’s name.

How to stop marketing at any time. It is free.

  • Reply STOP to any email or message, or
  • click the unsubscribe link, or
  • email ferdinand@easyleadengine.io.

We act on it within 1 business day.

The national opt-out registry. The National Consumer Commission (NCC) runs a register where people can block direct marketing. We are registering with the NCC as a direct marketer, as the law requires before 31 December 2026. Once the NCC lets marketers check their lists, we check ours every month before we market. We never market to anyone who has blocked us there.

When we contact you. We only send marketing Monday to Friday, between 09:00 and 17:00 South African time. We never send it on a weekend or a public holiday. This is stricter than the law requires.

Every marketing message shows our name, physical address, email address and phone number.

9. Our Facebook and Instagram lead forms

If you fill in a lead form on one of our ads on Facebook or Instagram, Meta sends us your answers. This is usually your name, business name, email address, phone number and website. We also see which ad and form you answered.

We use this only to contact you about what you asked for, and to know which ad brought you. We do not sell it. We never put it on a list for anyone else. We only share it with the service providers in section 12 who help us run our business.

Meta also keeps a copy, under Meta’s own privacy policy.

How to delete your information

Email ferdinand@easyleadengine.io with the subject “Delete my information”.

  • Send it from the email address you gave us, or tell us the phone number you gave us.
  • We delete what we hold about you and tell you when it is done. This normally takes no more than 30 days.
  • The law may make us keep a few records, such as invoices or signed agreements. If so, we tell you which ones and why.
  • To remove what Meta holds, use the privacy settings in your Facebook or Instagram account.

10. Cookies

Cookies are small files a website saves in your browser. We use a few that our websites need to work.

We only turn on marketing cookies, like the Meta Pixel, after you click Accept on our cookie banner. You can change your choice at any time with the Cookie settings link at the bottom of each page.

Read our Cookie Notice for the full list: easyleadengine.io/cookies (and www.easydoesitsocial.com/cookie-notice).

11. Who we share information with

We only share what is needed. We share with:

  • the client a campaign was run for. They get the replies, leads and results from that campaign.
  • our service providers (operators). They help us run our business. They may only use the information to do work for us. They must keep it safe and confidential. Section 12 lists them.
  • our professional advisers, such as our accountant, auditor or lawyer. They must keep it confidential.
  • authorities, such as SARS, a court or the Information Regulator, when the law makes us.
  • a buyer of our business, if we ever sell all or part of it. The buyer must protect your information in the same way.

We do not sell personal information to data brokers or to the public.

12. Our service providers, and where they keep data

Most of these providers keep data outside South Africa. Section 13 explains how we protect it.

  • SmartLead and SmartProspect: email sending and business contact data. USA.
  • Apollo.io: business contact data. USA.
  • MillionVerifier: checks that email addresses work. Outside South Africa.
  • InboxKit and Google Workspace: our email inboxes, files and calendars. USA and other countries.
  • Google (Fonts and YouTube): website fonts and videos. USA and other countries.
  • Netlify: website hosting and website forms. USA.
  • Lovable and Supabase: they build and run our websites and apps, including EasyCRM and EasyBuild, and store app data and logins. EU and USA.
  • Cloudflare: website hosting and security. USA, with servers worldwide.
  • Resend: sends system emails, like form alerts and login links. USA.
  • Tally: online forms and surveys. EU.
  • Paystack: card payments. South Africa and Nigeria.
  • QuickBooks (Intuit): invoices and accounts. USA.
  • Meta (Facebook and Instagram): ads, lead forms and the Meta Pixel. Ireland and USA.
  • Apify: collects business details from public websites. EU.
  • ElevenLabs: AI voices for phone agents. USA and EU.
  • Anthropic (Claude): AI text tools that help us write and sort. USA.

We may change providers. When we do, we update this list.

13. Sending information outside South Africa

POPIA section 72 only lets us send personal information to another country in certain cases. We rely on these:

  • The provider is bound by an agreement that protects your information as well as POPIA does. For every provider above, we use their data processing terms. This is our main reason.
  • It is needed to carry out a contract with you, or a contract made in your interest. For example, Paystack must process your payment, and QuickBooks must hold your invoice.
  • You agreed. For example, the Meta Pixel only runs after you click Accept.

14. How long we keep information

We keep information only as long as we need it, or as long as the law says.

  • Business contacts who never replied to our one ask: we delete or anonymise their details 12 months after the ask. We keep only the email address or phone number on our stop list.
  • People who said yes, leads and clients: for as long as we work together, plus 24 months.
  • Proof that you said yes to marketing: for as long as we market to you, plus 24 months.
  • Our stop list: we keep it for as long as we do marketing, so we never contact you again by mistake. It holds only the email address or phone number.
  • Invoices, payments and tax records: 7 years (Companies Act).
  • Information we handle for a client (as operator): we give it back to the client or delete it within 30 days after our agreement ends, unless the law says we must keep it.
  • Cookie data: see our Cookie Notice.

When we no longer need information, we delete it or make it anonymous, so it can no longer point to you.

15. How we keep information safe

POPIA section 19 says we must protect personal information. We:

  • give staff and contractors access only to what they need for their work
  • use strong passwords and two-step login on our main systems
  • use secure (HTTPS) connections on our websites and apps
  • make staff and contractors sign confidentiality terms
  • only use service providers who agree to protect your information
  • keep our computers and software up to date
  • check our safety steps every year

If something goes wrong. If we believe someone got your personal information without permission, we tell the Information Regulator and you as soon as reasonably possible (POPIA section 22).

When we act as a client’s operator, we tell that client within 72 hours of finding out. The client then tells the Regulator and the people affected.

16. Your rights

Under POPIA you have the right to:

  • know if we hold personal information about you, for free
  • get a copy of it, and know who has seen it
  • ask us to correct it if it is wrong, out of date, incomplete or misleading
  • ask us to delete it if we no longer have a good reason to keep it
  • object to us using it, for example for our legitimate interests
  • stop marketing at any time
  • withdraw your consent at any time. This does not undo what we did before.
  • not have a computer alone make a serious decision about you
  • complain to the Information Regulator (see section 20)
  • go to court if you suffered harm

How to ask

Email the Deputy Information Officer at ferdinand@easyleadengine.io, or call +27 83 357 4302.

  • Tell us what you want, and how we can reach you.
  • We may ask you to prove who you are. This stops other people getting your information.
  • POPIA has forms for some requests: Form 1 to object, and Form 2 to correct or delete. You can use them, but a simple email is fine too. We can send you the forms.
  • Asking if we hold your information is free. For a copy of records, the access-to-information law (PAIA) may allow a small fee. If so, we tell you the amount before we start.
  • We reply within 30 days. If we need more time, we tell you why.

Our PAIA manual explains how to ask for records: easyleadengine.io/paia (and www.easydoesitsocial.com/paia-manual).

17. Children

Our services are for businesses. We do not aim our websites, ads or services at anyone under 18. We do not knowingly collect children’s information.

If we find out we hold a child’s information without a parent’s or guardian’s consent, we delete it.

18. Other websites

Our websites link to other sites, like Facebook, YouTube and LinkedIn. We do not control those sites. Please read their privacy policies.

19. If you live outside South Africa

We are a South African business and we follow POPIA. If the law where you live gives you more rights, contact us and we will help you use them.

20. How to complain to the Information Regulator

Please talk to us first. We want to fix any problem. If you are still not happy, you may complain to the Information Regulator.

Information Regulator (South Africa)

21. Changes to this policy

We may update this policy. When we do, we change the effective date at the top. If a change is important, we also tell our clients by email.

22. Contact us

Easy Does It Social Media (Pty) Ltd, and its division Easy Lead Engine × EasyAgent