POPIA data subject notice

Version 1.0 · Last updated 12 October 2026

This notice is for the person whose driver's licence, vehicle licence disc or identity document is scanned at a gate that uses ACS, and for contractors and visitors whose entry is recorded. It explains what is captured, who is responsible for it, and what you can ask for.

1. Who is responsible for your information

The organisation that controls the gate — the estate, body corporate, office park, logistics operator or security provider — is the responsible party under POPIA. It decides why your information is captured and how long it is kept. ACS supplies the scanning software and platform and acts as an operator: it processes your information only on that organisation's instruction, and it may not use it for its own purposes.

Because of this, requests to see, correct or delete the record of your access must be made to the organisation that runs the gate. If you contact ACS instead, we will pass the request to that organisation and help it respond, but we cannot decide the outcome.

2. What is captured at the gate

Driver's licence: the name, identity number, date of birth, gender, licence code, restrictions, PrDP status, licence number and issue and expiry dates encoded on the licence barcode, and whether the digital signature on the barcode verified.
Vehicle licence disc: the registration number, vehicle identification number, engine number, make, model, variant, colour and disc expiry date encoded on the disc barcode.
Pedestrian access: the name and identity number from the identity document or licence presented, and the entry or exit event.
Event information: whether the record is an entry or an exit, the time, the gate and the device that captured it, and the outcome (allowed, denied, or referred to the operator).

Where the scanning device is configured to keep a photograph of the document, that image is stored with the access event.

3. Why it is captured

To verify that the person and vehicle at the gate are who and what they claim to be.
To enforce the access rules of the property, including watchlists and expired documents.
To keep an accurate record of who entered and left, which is a security and safety requirement of the property.
To allow the property to respond to an incident or a lawful request from the South African Police Service.

4. Where the information goes

A record is created on the scanning device at the gate and is then transmitted over an encrypted connection to the ACS platform, where it is stored in the responsible party's account. Everyone who can see it is limited by their role: gate operators see the records they capture, and the responsible party's administrators and authorised client users see the records for their own organisation only. Client organisations are technically separated from one another in the platform.

5. How long it is kept

The responsible party sets the retention period, and the platform enforces it. Records held on the scanning device itself are removed once they have been uploaded. Ask the organisation that runs the gate for its retention period; if it cannot tell you, we will confirm the configuration we hold on its behalf.

6. Your rights

Ask whether your information was captured, and receive a copy.
Ask for information that is wrong or incomplete to be corrected.
Ask for your information to be deleted where there is no longer a lawful reason to keep it.
Object to the processing, and complain to the Information Regulator.

Address the request to the organisation that runs the gate. If you need help identifying it, contact us at [privacy contact email] with the date, approximate time and gate, and we will tell you which account the record belongs to and forward your request.

The Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za, 010 023 5200.

7. What ACS does not do

We do not sell, rent or trade access information.
We do not use it to build profiles for marketing.
We do not use it to train models or share it with parties who are not involved in running the service.
Our support staff cannot browse a customer's records: access is granted only for a specific support request and is logged.

This notice summarises the platform's data protection position for people who are scanned. The privacy notice covers the website, customer accounts and billing, and the security overview describes the technical controls that protect these records.