This notice explains AO's general approach to personal-data processing where the European Union General Data Protection Regulation applies to a relevant AO entity or processing activity.
GDPR does not necessarily apply to every AO interaction. Its application depends on factors including the responsible entity, its establishment, the location of individuals, the services offered and the processing involved.
AO Group Holdings (Pty) Ltd (registration number 2026/639738/07) is the controller for the public group website. For other processing, the responsible AO entity is identified in the applicable contract, proposal or notice. Whether the GDPR applies, and whether an EU representative under Article 27 is required, depends on the specific processing activity and AO entity involved. Enquiries can be sent to info@aogroup.co.za.
GDPR, where applicable
The framework that applies to a specific interaction depends on the AO entity involved, the service and the processing activity.
Where GDPR applies, AO's approach is guided by principles including:
Where third parties process personal data on AO's behalf, AO seeks to use appropriate contractual, confidentiality and security arrangements.
AO seeks to apply organisational and technical safeguards appropriate to the information and the risk involved, including access control, authentication, secure communications where appropriate, monitoring, backup and recovery processes, supplier due diligence, confidentiality obligations and controlled retention and disposal.
Where personal data is transferred outside the European Economic Area, the relevant AO entity seeks to apply an appropriate lawful transfer mechanism and supporting safeguards where required.
Depending on the circumstances, rights may include:
These rights are not absolute and may be restricted by applicable legal, contractual, regulatory or evidential requirements.
Email info@aogroup.co.za with:
AO may request reasonable proof of identity or authority before processing the request. Please do not attach identity documents until AO confirms a secure channel for them.
Only approved documents are published for download. Pending items are listed for transparency.
How AO Group Holdings (Pty) Ltd processes personal data through the public group website where the GDPR applies.
Web page · Version 1.0
Full privacy notice for entity-level processing to which the GDPR applies, beyond the group website.
Final approved document pending publication. For assistance, contact info@aogroup.co.za.
Guidance on exercising GDPR rights where they apply.
Final approved document pending publication. For assistance, contact info@aogroup.co.za.
Contractual data-processing terms for European customers.
Final approved document pending publication. For assistance, contact info@aogroup.co.za.
List of subprocessors, if AO decides to publish one for European processing.
Final approved document pending publication. For assistance, contact info@aogroup.co.za.
Contact our privacy team if you wish to exercise a privacy right, raise a concern or need assistance identifying the relevant AO legal entity.
The public AO Group website at weareao.group is controlled by AO Group Holdings (Pty) Ltd, which is the responsible party or controller for website analytics, cookie and consent management, and general enquiries submitted through the website.
Optional analytics, advertising measurement and embedded third-party content are switched off until a visitor accepts them, and consent can be withdrawn at any time. Every cookie and storage item, with its purpose and duration, is listed in the Cookie Policy.
Where you go on to contract with, apply to, supply or otherwise interact directly with the AO entity operating in Europe, that entity may become the responsible party or controller for that specific processing, as described on this page.
A discovery session is a working conversation about scope, constraints and what a credible first release looks like.
