Privacy Policy

Effective date: October 7, 2026
View the previous version

1. Who we are

This Privacy Policy explains how Vinewave (Pty) Ltd, trading as OneDirectory ("OneDirectory", "we", "us" or "our"), collects and uses personal data when you visit our websites, use the OneDirectory app, contact us or do business with us.

Vinewave (Pty) Ltd is a private company registered in the Republic of South Africa (registration number 2016/349220/07), with its registered address at Thornhill Office Park, 94 Bekker Road, Midrand, Gauteng, 1685, South Africa. We are the controller of the personal data described in this policy.

You can contact us about privacy at privacy@onedirectory.com. Use of the OneDirectory app is governed by our Terms of Service, and use of our websites by our Terms of Use.

2. What this policy covers

This policy covers personal data that we decide how to use, including data about:

• visitors to onedirectory.com and our other websites
• people who start a trial, book a demo or contact us
• administrators and users of customer accounts, in relation to their account, billing and support
• people who receive emails from us

It does not cover Customer Data: the directory and profile data that our customers sync from Microsoft Entra ID or add to the OneDirectory app. For that data, our customer is the controller, and we process it only on their instructions under our Data Protection Addendum. If your employer uses OneDirectory and you have a question about your profile data, please contact your employer. We will pass on any such request we receive.

3. Personal data we collect

We collect the following personal data, either from you directly or automatically when you use our websites and app.

We do not ask for special categories of personal data, such as health or religious data, and ask that you do not send us any.

4. How we use personal data

We use personal data to:

• Provide the Service: create and manage accounts and trials, sign you in, and provide support, including through our AI support agent, which answers questions from our help content and hands over to our team when needed.
• Run billing: manage subscriptions and invoices with Paddle, and keep records required by tax and accounting law.
• Improve and develop: understand how our websites and app are used, fix problems and build new features. We may create aggregated and anonymised data, from which no individual can be identified, and use it for research and benchmarking.
• Communicate with you: send service and account messages, and marketing emails about OneDirectory, which you can opt out of at any time.
• Measure our advertising: measure LinkedIn ad campaigns and show our ads to people who visited our website, only with your consent.
• Keep things secure and legal: prevent fraud and abuse, enforce our terms, and comply with legal obligations.

We do not sell personal data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Cookies and similar technologies

We only use non-essential cookies, such as analytics and advertising cookies, if you accept them in our cookie banner. You can change your choice at any time through the Cookie settings link at the bottom of every page.

6. How we share personal data

We share personal data only as described below.

• Service providers that help us run our business, under contracts that require them to use the data only on our instructions: Microsoft (hosting), Cloudflare (security and delivery), Fin, formerly Intercom (support chat), Amplitude (product analytics), WorkOS (trial sign-in), Calendly (demo booking), Google (website analytics and fonts), Zapier (workflow automation), Close (customer relationship management), Slack (internal notifications) and Ghost (newsletters).
• Paddle, our reseller and merchant of record, which processes payments and invoices as a separate controller under its own privacy policy.
• LinkedIn, if you accept advertising cookies. LinkedIn uses this data under its own privacy policy.
• Microsoft, when you sign in with your Microsoft account, under Microsoft's privacy statement.
• Professional advisers, such as lawyers and accountants, where needed for the services they provide to us.
• Authorities, where required by law or to protect our rights, our customers or others.
• Business transferees, if our business or assets are reorganised, merged, sold or transferred, including to a successor company, and to their advisers during that process.

7. Your choices and rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it
• correct inaccurate or incomplete data
• ask us to delete your data
• ask us to restrict how we use your data
• object to our use of your data based on legitimate interests, and to direct marketing at any time
• receive your data in a portable, machine-readable format
• withdraw your consent at any time, where we rely on consent, without affecting earlier processing
• complain to a data protection authority (see section 11)

To exercise any of these rights, email privacy@onedirectory.com. We will respond within one month and may ask you to confirm your identity first. Some rights have legal limits, and if we cannot fully meet a request we will explain why.

You can unsubscribe from marketing emails using the link in any of them, and change your cookie choices through the Cookie settings link on our website. Requests about Customer Data go to the customer who controls it (see section 2).

8. Security and retention

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and multi-factor authentication. No system is completely secure, but we work to keep these measures current.

We keep personal data only as long as we need it for the purposes in this policy:

We may keep data longer where the law requires it or to establish or defend legal claims. When we no longer need personal data, we delete or anonymise it.

9. International transfers

Some of our hosting and service providers are located in the United States and other countries outside the European Economic Area (EEA) and the UK.

When we transfer personal data from the EEA or UK to a country without an adequacy decision, we protect it using:

• the EU-U.S. Data Privacy Framework and its UK extension, where the recipient is certified
• the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum

You can request a copy of these safeguards at privacy@onedirectory.com.

10. Children, changes and contact

Children. Our websites and app are for businesses and are not directed at children. You must be at least 13 years old to use them (16 years for individuals in the EU). If you believe a child below that age has given us personal data, contact us and we will delete it.

Changes. We may update this policy by publishing a new version with a new effective date. If we make material changes, we will also notify account administrators by email.

Contact. Email privacy@onedirectory.com with any question or request about your personal data.

11. Notice to individuals in the EEA, UK and South Africa

Data protection law requires a legal basis for each way we use personal data. These are the bases we rely on:

Complaints. If you are unhappy with how we handle your personal data, please contact us first. You also have the right to complain to a data protection authority:

• Ireland: the Data Protection Commission. Elsewhere in the EEA, you can contact your local authority.
• UK: the Information Commissioner's Office.
• South Africa: the Information Regulator.