AI Governance Statement

Blancor Intelligence (Pty) Ltd is governed by its two co-founders, who collectively constitute the governing body of the firm. All strategic decisions, including those relating to data, AI systems, and technology, are made jointly, with explicit allocation of accountability by role.

Accountability structure

Governance decisions affecting AI systems, including the selection of new AI models, changes to data processing arrangements, and the addition of subprocessors, require joint approval by both co-founders before implementation. Before any client deployment, the system will be reviewed against Blancor's four-layer risk framework (see Section 5).

The governing body reviews this governance statement at least annually and on any material regulatory change. The next scheduled review is June 2027.

Blancor Intelligence processes personal information as a Responsible Party under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is Tristan Malan (registered); our Deputy Information Officer is Matt Eichweber (registered). Information Regulator registration number: 2026-013800.

What we collect

In our prospect and client operations, we collect business contact information (name, job title, company, email, LinkedIn profile), operational process data provided while we scope a project, and system configuration information provided for the systems we build. We do not collect special personal information as defined in POPIA s.26, payment card data, or personal information about minors.

Who has access

Only Matt Eichweber and Tristan Malan have access to client data. No third party has access to client data except the subprocessors listed in Section 6 of this statement. Data is not shared with third parties for any commercial purpose.

Retention and disposal

Personal information is retained only for as long as required for the lawful purpose for which it was collected. On termination of an engagement, client operational data is deleted or returned. Engagement terms are issued in the written scope and quote for each project. Prospect data is archived after 24 months of inactivity.

Where personal information is processed through Anthropic's Claude API for analysis or report generation, that processing may occur on infrastructure located in the United States. This transfer is conducted under POPIA s.72 on the basis of a binding written agreement requiring an adequate level of protection (s.72(1)(a)), supported by contractual necessity (s.72(1)(c)) and, where applicable, data subject consent (s.72(1)(b)). Clients may request that their data not be processed through the Claude API, in which case the relevant analysis is completed manually.

King V Principle 10, recommended practice 109(c), expects the governing body to oversee that artificial intelligence adheres to ethics, human centricity, accountability, transparency, explainability, security, privacy, fairness and trustworthiness, and that automated technologies are subject to human oversight and override mechanisms commensurate with the level of risk to the organisation and its stakeholders. The following commitments reflect how Blancor operationalises these expectations.

Before any client deployment, we will assess the system against a four-layer risk review: Data, Decision, Operational and Regulatory. No client deployment has taken place yet.

Systems assessed as High on any layer will require explicit client disclosure before deployment, written consent in the applicable Statement of Work, a documented incident response plan, and human override capability confirmed before go-live.

Subprocessors

WhatsApp (Meta Platforms) is listed for transparency. It is a third-party communication channel that processes messages under Meta's own terms. It is not an operator acting on our behalf, and Blancor has no data processing agreement with Meta.

For the canonical, continuously updated operator list see /subprocessors.

Client rights under POPIA

Clients whose personal information is processed by Blancor have the right to request access to their information (POPIA s.23), request correction or deletion of inaccurate information (s.24), object to processing (s.11(3)), and lodge a complaint with the Information Regulator through its eServices portal at inforegulator.org.za/complaints.

“The governing body governs data, information and technology in a way that enables the organisation to sustain and optimise its strategy and objectives.”

King V Code on Corporate Governance for South Africa 2025, Principle 10

King V was published by the Institute of Directors in South Africa on 31 October 2025 and is effective for financial years beginning on or after 1 January 2026, under an “apply and explain” regime. The following is Blancor Intelligence's alignment statement.

Proportionality note

King V applies proportionally to the size and complexity of an organisation. As a two-person firm, Blancor's governing body performs the technology and data governance committee function directly; no separate committee is warranted at current scale. All other Principle 10 recommended practices are implemented as described above.

How Blancor helps clients achieve Principle 10 alignment

Every system we build is handed over with written documentation of what it does, what data it uses, who is accountable for it and how its outputs are reviewed. That documentation is the starting point for the Principle 10 disclosure questions: what AI systems are in operation, what material risks they present, who is accountable, what evidence exists that risks are managed, and where the gaps are.

AI Governance Statement v1.4 · Effective 17 October 2026 · Next review June 2027 · Information Regulator reg. 2026-013800