Privacy Policy

As responsible party for information about the people who use CompliancePro — account holders, their contact details, login and billing information. This policy covers that information.

As operator for the information our customers store in CompliancePro about their workers, contractors, incidents and sites (“Customer Data”). Each customer is the responsible party for that information and decides why and how it is processed; we process it only on the customer’s instructions under the Operator Agreement. If you are a worker or contractor and want to access or correct your information, please contact the organisation that recorded it. We will help them respond.

• Account details: name, work email address, organisation name, role, and a password (stored only as a one-way hash — we cannot read it).
• Acceptance records: when a user accepts these documents, the date, time, version, user and IP address.
• Activity records: an audit trail of actions taken in the Service (who did what, when).
• Technical data: IP addresses and request logs kept for security and troubleshooting.
• Billing details: plan, invoices and payment status. Card payments, when enabled, are handled by our payment provider; we never see or store full card numbers.
• Messages you send us, for example support or privacy requests.

We use one essential cookie, cp_session, to keep you signed in. It cannot be read by scripts in the page and expires after 12 hours. We do not use advertising, analytics or tracking cookies.

• To provide the Service, create accounts and sign users in — performance of our contract.
• To send service emails: verification, password reset, invitations, alerts and reports — contract.
• To bill and keep tax records — contract and legal obligation.
• To secure the Service, prevent abuse and investigate problems, including disputes about what happened in an account — our legitimate interests and legal obligations.
• To tell customers about important changes to the Service. We do not send marketing to account holders without the consent the law requires, and every marketing email includes an opt-out.

The CompliancePro database, uploaded files and backups are hosted by Amazon Web Services in its Cape Town, South Africa region. We use the following service providers (operators), each bound to protect the information:

• Amazon Web Services — hosting, storage and backups (South Africa).
• Resend — sending service emails. Email content and recipient addresses pass through its servers outside South Africa.
• Anthropic — generating “Ask AI” answers. Only a summary of the organisation’s dashboard and the question asked are sent, and only when a user uses that feature. Processed outside South Africa.
• Paystack — card payments, only once card billing is enabled for an account.

Where information leaves South Africa, we rely on the provider’s binding contractual commitments to protect it to a standard substantially similar to POPIA, as section 72 requires. We do not sell personal information.

• Account and activity records: while the organisation’s account is active.
• After an account is closed: deleted from the live system after the 30-day export period; backup copies expire within about 30 days after that.
• Acceptance records, invoices and payment records: for as long as tax and company law require (usually 5 years).
• Security logs: for a limited period, normally no longer than 90 days.

• Encrypted connections (HTTPS) and encrypted storage for files and backups.
• Each customer’s data is separated from every other customer’s at the database level.
• Role-based access inside each organisation, hashed passwords and rate-limited sign-in.
• The database is not reachable from the internet; production access is limited to authorised staff.
• Daily backups and an append-only audit trail.

Under POPIA you may ask whether we hold information about you, request access to it, ask us to correct or delete it, and object to certain processing. Contact our Information Officer at banelengubane107@gmail.com. We may need to confirm your identity first.

If you are unhappy with our response you may complain to the Information Regulator (South Africa): inforegulator.org.za.

If we have reasonable grounds to believe personal information has been accessed or acquired without authorisation, we will notify affected customers without undue delay so that they can meet their own obligations under section 22 of POPIA, and we will notify the Information Regulator and data subjects where we are the responsible party.

Information Officer: the Director of NorthStar Digital Solutions (Pty) Ltd. Email: banelengubane107@gmail.com. Address: 12 Massachusetts Crescent, Cosmo City, Randburg, Gauteng, 2188.

The Service is meant for businesses and is not directed at children. We will post changes to this policy here and notify account holders of material changes.