How Trilogy BPO collects, uses, protects and respects personal data — aligned to UK GDPR and POPIA.
Last reviewed: October 2026
Trilogy BPO (“Trilogy”, “we”, “us”) is committed to protecting personal data and operating in line with the UK General Data Protection Regulation (UK GDPR) and South Africa’s Protection of Personal Information Act (POPIA).
This notice explains what personal data we collect, why we process it, how long we keep it, the rights available to individuals, and the safeguards we apply across our customer experience and technology operations.
We maintain a Record of Processing Activities (ROPA) that maps the personal data our organisation collects, where it is stored, how it flows through our systems and operations, and who has access.
This inventory is reviewed as services, systems and processors change so we understand our data footprint and can demonstrate accountability to clients and regulators.
For every instance in which we process personal data, we identify and document a lawful basis under Article 6 of the UK GDPR (and the equivalent requirements under POPIA). Depending on the activity, that may include:
Where we process special-category or high-risk data, we apply the additional conditions and safeguards required by law.
Depending on how you interact with us — for example through our websites, enquiry forms, recruitment channels, client programmes or service delivery — we may process:
We only collect personal data that is relevant to the stated purpose, and we do not use it for incompatible secondary purposes without a fresh lawful basis and appropriate notice.
We retain personal data only for as long as needed for the purpose it was collected, including to meet legal, accounting, contractual or regulatory requirements.
Retention periods are defined in our ROPA and related schedules. When data is no longer required, it is securely deleted, anonymised or returned in line with our agreements and legal duties.
Individuals have rights over their personal data. Subject to applicable law and any contractual role we hold (controller or processor), you may request to:
We maintain internal processes to receive, verify and respond to data subject requests, typically within one month. Complex or high-volume requests may take longer where the law allows; we will keep you informed.
To exercise your rights, contact us at info@trilogybpo.com with enough detail for us to identify your request. If we process your data only as a processor for a client, we will redirect or support the request via the relevant controller as required.
We apply technical and organisational measures appropriate to the risk, including measures aligned with our ISO 27001 certified information security management and PCI DSS compliant payment-data controls where relevant.
We maintain an incident response plan for personal data breaches. Where a breach is likely to result in a risk to individuals’ rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it.
Where the law requires, we will also inform affected individuals without undue delay, and we will work with clients when we act as a processor so contractual and regulatory notification duties are met.
Accountability for privacy sits with Trilogy leadership. Where our core activities involve large-scale or high-risk processing of personal data, we designate a Data Protection Officer (DPO) or equivalent privacy lead with the independence and resources needed to advise the business and monitor compliance.
Where required for processing related to individuals in the UK/EU while we operate from outside those territories, we appoint an appropriate representative and publish contact details for privacy enquiries.
Privacy enquiries can be sent to info@trilogybpo.com. Our registered operating address is Block B, Brightway Park, Salt River, Cape Town 7795.
Where vendors or sub-processors handle personal data on our behalf, we carry out appropriate due diligence and put Data Processing Agreements (DPAs) in place covering instructions, confidentiality, security, sub-processing, assistance with data subject rights, breach notification and deletion or return of data at the end of the engagement.
We only use processors that provide sufficient guarantees to implement appropriate technical and organisational measures. International transfers, where they occur, are supported by an approved transfer mechanism such as adequacy, standard contractual clauses or another lawful safeguard.
Our website uses essential cookies required for security and basic functionality. Where we use analytics or similar optional technologies, we will do so on a lawful basis and provide controls where required.
You can control cookies through your browser settings. Blocking some cookies may affect site functionality.
We may update this privacy notice as our services, systems or legal obligations change. The latest version will always be published on this page with an updated “last reviewed” date.
Trilogy BPO applies technical and organisational safeguards aligned with ISO 27001 certified information security management and PCI DSS compliant controls where relevant, including encryption, access controls, minimisation and staff privacy training.
Trilogy documents a lawful basis under Article 6 of the UK GDPR for each processing activity, which may include consent, contract, legitimate interests or legal obligation, plus additional safeguards for higher-risk data.
You can request access, rectification, erasure, restriction, portability or objection by emailing info@trilogybpo.com. Trilogy aims to respond within one month, subject to applicable law.
Trilogy maintains an incident response plan and, where required, notifies the relevant supervisory authority without undue delay and within 72 hours of becoming aware of a personal data breach, and informs affected individuals when the law requires.
Yes, where vendors handle personal data on Trilogy’s behalf. Trilogy carries out due diligence and puts Data Processing Agreements (DPAs) in place covering instructions, security, sub-processing, assistance with rights requests and deletion or return of data.
For privacy requests or questions, email info@trilogybpo.com. UK +44 7458 158591 · SA +27 73 668 6096.
Trilogy CX (Pty) Ltd · Block B, Brightway Park, Salt River, Cape Town 7795