GDPR Privacy Statement
This statement explains how the European Union General Data Protection Regulation applies to personal data processed through the public AO Group website. It sits alongside the Website Privacy Notice and the Cookie Policy, which describe website processing in more detail.
GDPR does not necessarily apply to every interaction with every AO entity. Beyond the website processing described here, the applicable law depends on the entity, location, processing activity and relationship involved. Where an entity-level GDPR statement for a specific AO entity has not yet been published, AO will confirm the applicable detail on request.
Controller for the AO Group website
For personal data processed through this website — including general contact and discovery enquiries, website analytics, and cookie and consent management — the controller is AO Group Holdings (Pty) Ltd.
AO Group Holdings (Pty) Ltd (South African company registration number 2026/639738/07; business and contact address: Ground Floor, Buildings 2 and 3, Centurion Gate Office Park, 1951 Akkerboom Street, Zwartkop, Centurion, 0157, South Africa; telephone +27 (0) 12 035 1530) is the responsible party (under POPIA) and controller (under the GDPR, where it applies) for the public AO Group website at weareao.group, its website analytics, its cookie and consent management, general contact and discovery enquiries submitted through this website, the public Privacy Centre, and the publication of this notice.
Whether the GDPR applies, and whether an EU representative under Article 27 is required, depends on the specific processing activity and the AO entity involved. Enquiries about GDPR applicability or representation can be sent to info@aogroup.co.za.
You can contact AO's Information Officer, Pieter Hendrik du Toit, at info@aogroup.co.za.
“AO Group” is a collective brand used by a number of affiliated legal entities operating in different countries.
AO Group Holdings (Pty) Ltd controls the public group website at weareao.group and its general website analytics, consent management and website enquiry handling.
An enquiry submitted through this website may be referred internally to the AO entity best placed to respond to it.
Where you enter into a contract, an employment relationship, a supplier relationship or another direct interaction with an AO subsidiary, that subsidiary may be the responsible party or controller for that specific processing.
The relevant entity is identified in the applicable contract, proposal, invoice, application, employment document, collection notice or correspondence.
Principles that guide our approach
Where GDPR applies, AO's approach is guided by principles including:
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
Personal data processed through the website
- Contact and enquiry details submitted through the website, such as name, job title, organisation, email address, telephone number and country.
- Discovery-call and sampling/campaign information volunteered through website forms.
- Careers and recruitment information submitted through the website, including any document attached.
- Technical and usage information, such as IP address, approximate location derived from it, device and browser type, and pages viewed.
- Where you consent to analytics or advertising, interaction analytics, session information and advertising identifiers or conversion events.
Why the website processes personal data
- Responding to enquiries submitted through the website and routing them internally to the appropriate AO entity.
- Arranging discovery conversations and progressing recruitment applications submitted through the website.
- Operating, securing, maintaining and improving the website.
- Measuring website usage and advertising performance, where you have consented to the relevant category.
- Keeping records of consent choices and privacy requests.
- Meeting legal, regulatory and governance obligations, and establishing or defending legal claims where necessary.
Lawful bases for website processing
- Consent — optional analytics, optional advertising measurement and optional third-party content embedded in the website. None of these are treated as strictly necessary, and consent may be withdrawn at any time.
- Performance of a contract, or steps taken at your request before entering into one — for example, responding to a proposal request or progressing a discussion you initiate through the website.
- Legal obligation — where AO must retain or disclose information under applicable law.
- Legitimate interests, where applicable and balanced against your rights — for example, responding to business enquiries, securing the website and preventing abuse.
Who may receive website personal data
- Affiliated AO entities, where an enquiry falls within their area of responsibility.
- Hosting, content-delivery, security and email-delivery providers engaged to operate the website.
- Microsoft, as the provider of Clarity analytics and Microsoft Advertising UET, where you have consented to the relevant category.
- Professional advisers, auditors and regulators, where required or permitted by law.
International transfers and safeguards
Some website service providers, including Microsoft, may process personal data outside your country. Where this occurs, AO seeks to ensure an appropriate basis or safeguard is in place for the transfer, where applicable.
This statement does not assert that any specific adequacy decision, standard contractual clauses, binding corporate rules, EU representative or provider data-processing agreement is in place. Confirmed detail will be published once it has been verified.
How long website data is kept
- Information is kept only for as long as needed for the purpose it was collected for, or as required by law.
- Enquiry and discovery records are kept for as long as needed to respond and to maintain a reasonable business record of the interaction.
- Consent records are kept for a limited period, after which you are asked again.
- Analytics and advertising information is retained by the relevant provider according to its own retention settings; see the Cookie Policy for the technologies used and their duration.
Exercising rights under GDPR
Where GDPR applies to website processing, you may have rights of access, rectification, erasure, restriction, objection and portability. These rights are not absolute and may be limited by legal, contractual, regulatory or evidential requirements.
Where processing relies on consent — including optional analytics, optional advertising measurement and optional third-party content — you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
AO does not make automated decisions about you that produce legal effects or similarly significant effects through this website.
Providing information through the website is generally voluntary; however, some information is necessary to respond to an enquiry, progress a discovery conversation, or take contractual or pre-contractual steps you request.
You may also have the right to lodge a complaint with the competent supervisory authority.
Related privacy pages
This document is designed to support alignment with POPIA, the GDPR (where it applies) and applicable cookie-consent requirements. It is not a certification or a guarantee of compliance, and it remains subject to review by AO's Information Officer and legal adviser.