Privacy Policy

1. Introduction

Compliance Radar ("we", "us", "our") is committed to protecting the personal information of our users and the data subjects whose information is processed through our platform. This Privacy Policy explains how we collect, use, store, and protect personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa.

2. Information We Collect

We process the following categories of personal information:

• Account Information: Name, email address, and password (hashed) for platform access.
• Employee Information: Names, email addresses, phone numbers, SA ID numbers (encrypted at rest), employment details, and position information.
• Credential Documents: Uploaded certificates, licenses, and compliance documents including issue and expiry dates.
• Vehicle Information: Registration numbers, make, model, and associated compliance documents.
• Company Information: Company name, contact details, and business compliance documents.
• Equipment Information: Asset details, service records, and compliance documentation.
• Payroll Information: Payslips and remuneration details uploaded by your employer for delivery to you, and the mobile number and consent record used to deliver them.
• Disciplinary Records: Charges, warnings, hearing documents and outcomes recorded by your employer.
• Hearing Recordings: Audio recordings of disciplinary hearings uploaded by your employer, and the transcripts and summaries made from them.
• Usage Data: Login activity, IP addresses, and audit logs for security purposes.
• Demo Requests: The name, work email, mobile number, company, company size and message you send through our Book a demo form, the record of your consent to be contacted, and the advertising campaign that brought you to the form, including Meta's ad-click and browser identifiers (the fbclid link parameter and the _fbc and _fbp cookies) where present.

3. Purpose of Processing

We process personal information for the following purposes:

• Tracking and managing employee, vehicle, and company credential compliance.
• Sending expiry reminders and renewal notifications via email and WhatsApp.
• Delivering payslips to employees over WhatsApp with their recorded consent.
• Managing disciplinary matters for your employer, including transcribing and summarising hearing recordings.
• Generating compliance reports and risk assessments.
• Providing calendar integration for expiry tracking.
• Authenticating users and maintaining platform security.
• Maintaining audit trails for accountability and regulatory compliance.
• Contacting people who ask us for a demo, and measuring which of our adverts bring them.

4. Lawful Basis for Processing

We process personal information on the following lawful bases under POPIA Section 11: (a) the data subject consents to the processing; (b) processing is necessary for the performance of a contract to which the data subject is a party; and (f) processing is necessary for pursuing the legitimate interests of the responsible party.

5. Data Security

We implement the following technical and organisational measures to protect personal information:

• Encryption at Rest: Sensitive fields such as SA ID numbers are encrypted using AES-256-GCM.
• Encryption in Transit: All communications use HTTPS/TLS encryption.
• Password Security: Passwords are hashed using bcrypt with a cost factor of 12.
• Session Management: Sessions expire after 24 hours with automatic cleanup.
• Rate Limiting: API endpoints are rate-limited to prevent abuse.
• Audit Logging: All data access and modifications are logged for accountability.
• Multi-Tenant Isolation: Each company's data is strictly isolated at the database level.
• Data Storage: Records and uploaded documents are stored on AWS in the af-south-1 (Cape Town) region; section 9 covers processing outside South Africa.

6. Data Subject Rights

Under POPIA, data subjects have the right to:

• Access: Request confirmation of what personal information we hold and obtain a copy.
• Correction: Request correction or deletion of inaccurate personal information.
• Deletion: Request permanent deletion of personal information where retention is no longer necessary.
• Object: Object to the processing of personal information on reasonable grounds.
• Data Portability: Request an export of personal information in a machine-readable format.

To exercise any of these rights, please contact your company administrator or reach out to us directly using the contact details below.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. When a subscription ends, we keep the account's data for at least 30 days so it can be restored if the customer comes back. Records deleted in the app stay recoverable until they are permanently removed on request. Company administrators may ask us at any time to permanently delete specific records or all of their account's data, and we will confirm the deletion in writing. Demo-request details are kept only for as long as we need them to arrange and follow up your demo; you can ask us at any time to delete them.

8. Third-Party Sharing

We do not sell personal information. We share data only with the service providers needed to run the platform, under appropriate data processing agreements: database and document storage (Amazon Web Services), application hosting (Render), website and front-end hosting and content delivery (Vercel), email delivery (Resend), WhatsApp delivery of payslips (Meta Platforms) and of reminders (Meta Platforms, or Twilio through your employer's own Twilio account, as your employer selects), payment processing (Paystack, billing data only), and error monitoring (Sentry, technical error details only). We also use three AI model providers: Anthropic, which reads uploaded documents, payroll files and spreadsheets to extract their data, answers assistant questions, including by looking up employee and vehicle records, such as disciplinary warnings and cases, in your employer's account, and summarises disciplinary hearing transcripts; OpenAI, which transcribes disciplinary hearing recordings; and Voyage AI, which creates search embeddings of assistant questions, legal texts and the policies, handbooks, contract templates and other documents a customer adds to its knowledge library so the assistant can find relevant passages. Anthropic and OpenAI process this data under their API terms, which do not permit use of the data to train their models; Voyage AI processes it under its API terms. All of these providers are contractually bound to protect personal information in accordance with POPIA. Separately, our public website uses the Meta Pixel to measure our advertising; Meta receives that data under its Business Tools Terms, not a data processing agreement with us (see section 13).

9. Cross-Border Transfers

Records and uploaded documents are stored on Amazon Web Services in the af-south-1 (Cape Town) region. The application runs on Render in Frankfurt, Germany (EU). Assistant, extraction, embedding and transcription processing by Anthropic, Voyage AI and OpenAI may happen in the United States. The website and the application's front end are served by Vercel, messages are sent through Meta Platforms (WhatsApp Cloud API), Twilio and Resend, the Meta Pixel on our public website sends data to Meta Platforms, error monitoring runs through Sentry, and payments are processed by Paystack; these providers may also process data outside South Africa. Where cross-border transfers occur, we ensure an adequate level of protection as required by POPIA Section 72.

10. Security Breach Notification

In the event of a security breach that compromises personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible in accordance with POPIA Section 22.

11. Contact Information

For any privacy-related enquiries, data access requests, or complaints, please contact us at:

You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

12. Information Officer

As required by section 55 of POPIA, Compliance Radar (Pty) Ltd has an Information Officer, designated in writing by its director, who is responsible for POPIA compliance and for requests under the Promotion of Access to Information Act (PAIA). Registration of the Information Officer with the Information Regulator under section 55(2) is being completed.

Our PAIA manual sets out the records we hold, how to request access to them, and the fees and timelines that apply.

13. Cookies and Local Storage

Apart from the Meta Pixel on our public website, described below, we set no advertising or analytics cookies and load no third-party tracking scripts. The application stores a sign-in token in your browser's local storage because it is needed to keep you signed in to the service. We rely on POPIA section 11(1)(b) where you are party to the contract with us, and on section 11(1)(f) (legitimate interests: giving authorised users secure access to the platform) where you use it as an employee or other user of one of our customers and are not party to that contract. The application also stores interface preferences, such as display settings, on the basis of our legitimate interest in a usable product (section 11(1)(f)); you can clear both by signing out or clearing your browser data. We use Sentry, an error-monitoring service hosted outside South Africa, which records technical details of application errors (browser type, page, stack trace) and basic page-load timings to keep the service reliable; it does not profile you or follow you across sites. Our website and the application load their fonts from Google Fonts, so your browser sends your IP address to Google when a page loads; Google may process it outside South Africa. If we ever add other page-view analytics it will be cookieless, and this section will say so.

Meta Pixel. Our public website (the home page with its pricing, and the about, contact, demo, security, legal and guide pages) uses the Meta Pixel to measure our advertising on Facebook and Instagram. It is never loaded inside the application, so no screen that holds employee information is sent to Meta. The Pixel records page views and a few actions: opening a plan's checkout, sending the demo form, and returning from Paystack after you subscribe. With each one your browser sends Meta the page address, the address of the page that sent you to ours, your IP address, browser details and Meta's cookie identifiers (the _fbp cookie, and _fbc if you came from a Meta ad). If you are signed in to Facebook or Instagram in the same browser, Meta can also use its own cookies to link these visits to your account. We do not send Meta your name, email address or phone number. Meta Platforms receives this information under its Business Tools Terms and its own privacy policy, and may process it outside South Africa. We rely on our legitimate interest in measuring our advertising (section 11(1)(f)). You can block or clear these cookies in your browser settings, and choose how Meta uses this information for ads in your Facebook or Instagram ad preferences.