How SentraKaya protects the interaction data our clients entrust to us, and the commitments we make to the people behind every call, chat and email.
The laws and frameworks we build to, and who is accountable.
Our Privacy Policy is written to align with the Protection of Personal Information Act. For our clients' contact-centre interactions we act as the operator, on the client's written instructions. For website data we are the responsible party.
Where GDPR applies we act as processor for client interactions and controller for website data. Cross-border transfers use recognised safeguards, including Standard Contractual Clauses and strict data processing agreements.
The Omnichannel Transactional Platform is built with data-residency and compliance logic for POPIA, NDPA and GDPR requirements.
Our Information Officer and privacy contact is Walter Storey, reachable at privacy@sentrakaya.com.
Space reserved for the certifications and independent assessments we hold, with scope and dates.
If you are unhappy with our response you can complain to South Africa's Information Regulator (inforegulator.org.za) or, in the EU or UK, to your local data protection authority.
The technical and organisational measures that protect the service.
Encryption in transit (TLS 1.3) and encryption at rest.
Strict least-privilege access controls through identity and access management (IAM) and granular role-based access control (RBAC).
The Zero-Trust Communication Gateway verifies every call, chat and email, then routes, challenges or blocks.
Centralised infrastructure logging, and auditable telemetry with deterministic exception routing to human operators.
Core infrastructure is hosted in Cloudflare's secure cloud environments and on its global edge network.
Mandatory confidentiality obligations for staff.
How to report a vulnerability, and our penetration-testing approach.
Breach notification process, business continuity and availability commitments. We notify affected parties and regulators where the law requires.
What we process, what we never do, and how to exercise your rights.
Whether a call, chat or email is likely from an automated AI agent or a human, using metadata, acoustic features and protocol signatures. The output is a confidence score, a routing outcome and audit tags returned to the client.
No voice biometrics, speaker identification or voiceprints. No registration, enrolment or extra verification steps for end users. We do not sell personal information.
Interaction data is processed temporarily in memory. We store only transactional metadata such as interaction IDs, timestamps, confidence scores and audit tags. Raw audio and message content are not stored unless a client explicitly requests it for audit logging under a separate data processing agreement.
Providers may process information outside South Africa. Safeguards recognised by POPIA and, where it applies, GDPR are in place.
Ask us to confirm, access, correct or delete your personal information, object to processing, or withdraw consent. Under GDPR you can also ask for restriction and portability. If your data was processed through a client's contact centre, contact that client first. We will help them respond.
Write to privacy@sentrakaya.com. Full detail is in our Privacy Policy (effective 1 October 2026).
Reviewing us as a supplier? Start here.
The written agreement under which we process a client's interactions.
Answers to common vendor security reviews.
The providers that process data on our behalf.
How we handle personal information on our website and in the service.