Privacy Notice

This notice explains how [registered entity name], registration number [company registration number], of [registered address] ("ACS", "we") collects and processes personal information when you visit this website, ask us for a demonstration, or use the ACS access control platform. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

1. What we collect, and why

Website enquiries

When you submit the form on this website we collect your name, work email address, telephone number, organisation, the facility type you select and any message you add. We record the page you submitted from, the moment you accepted this notice, and your IP address and browser identification so we can investigate abuse of the form and prove the consent you gave. We use this information only to answer your enquiry and to follow up about ACS.

Customer accounts and the access control platform

• Account information: user names, email addresses, roles and the client each user is linked to.
• Access events: vehicle registration numbers, vehicle identification numbers, driver licence details, identity numbers and photographs of access documents captured by the scanning devices at the gates, together with the entry or exit event, time, and the device that recorded it.
• Watchlists and reports: the entries an administrator or client creates, and the reports generated from captured events.
• Billing information: the subscription, invoice and payment records for the account. Card payments are processed by a payment service provider; we store only the last four digits of the card and the provider's reference, never the full card number.
• Audit records: who changed what in the platform, and when.

Information captured on devices

Scanning devices on a customer's site store captured records locally so that gates keep working when the network is unavailable. Local records are uploaded to the platform when a connection is available and are removed from the device afterwards. Devices do not store data for longer than the retention configured for that customer.

2. Lawful basis for processing

• Your consent for website enquiries and for any marketing follow-up. You may withdraw it at any time, and every message we send includes a way to opt out.
• Performance of a contract for customer accounts, licence administration, support and billing.
• Legitimate interests in keeping the platform secure: access logging, abuse prevention, fraud prevention and troubleshooting.
• Legal obligation where we must retain records for tax, accounting or lawful requests from authorities.

3. Cookies and third-party requests

This website does not set advertising or analytics cookies and does not profile visitors. It loads its two typefaces from Google Fonts, which means Google receives your IP address when the page loads; we do not send any other information with that request. Customers may ask us to self-host the fonts instead.

4. Who we share information with

We do not sell personal information. We share it only with operators who help us run the service, under contract and only for the purposes above:

A customer's own administrators and, where the customer configures it, its security staff can see the access events recorded for that customer. Our support staff can access a customer's data only where the customer asks for assistance, or where we must do so to keep the service working, and every such action is logged.

5. Cross-border transfers

Some operators listed above may store or process information outside South Africa. Where that happens we rely on POPIA section 72: the recipient is subject to a law, binding agreement or corporate rules that provide a comparable level of protection, and the transfer is necessary to perform our agreement with the customer or to deliver the service to you.

6. How long we keep information

• Website enquiries: 24 months from the last contact, then deleted, unless you become a customer.
• Access events: for the retention period agreed with the customer, and never longer than the customer instructs. Retention is configurable per customer.
• Billing and tax records: 5 years from the end of the tax year, as required by law.
• Security and audit logs: 12 months, then deleted or aggregated.

7. Your rights

You may ask us to:

1. tell you whether we hold personal information about you, and give you a copy of it;
2. correct or delete information that is wrong, misleading or no longer needed;
3. stop using your information for direct marketing, or withdraw consent you previously gave;
4. explain how the information was collected and who has received it.

If your information was captured at a customer's gate, that customer is the responsible party for it and we will refer your request to them and assist them in answering it. Send requests to [privacy contact email] or [support telephone number]. We respond within 30 days.

If you are not satisfied with our answer you may complain to the Information Regulator (South Africa): inforegulator.org.za, complaints.IR@justice.gov.za.

8. How we protect information

Access to the platform requires an authenticated account, every request is authorised against the role and the client the user belongs to, records are transmitted over encrypted connections, and administrative actions are written to an audit trail. See the security overview for detail.

9. Changes to this notice

We review this notice at least annually. When we change it we update the version and date at the top, and we will tell customers and subscribers directly if a change affects how their information is used.

10. Contact

Information Officer: [information officer name]
Email: [privacy contact email]
Telephone: [support telephone number]
Postal address: [registered address]