Vigia privacy statement
AI draft for legal review. This is a first draft prepared with AI assistance for 365solutions. It is not legal advice. It must not be published until a qualified South African attorney has reviewed it in full. Points the lawyer must confirm are marked [Lawyer: …] and listed in section 15. Facts about 365solutions in square brackets are placeholders.
Version 0.1 (draft) · 9 November 2026 · Website footer: Privacy
1. About this statement
1.1 This statement explains how 365 Solutions (Pty) Ltd ("365solutions", "we", "us") handles personal information when we decide why and how it is used — as the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA").
1.2 It covers:
- visitors to our website vigia.africa (and its sub-pages);
- people who ask for a trial, a demonstration or information ("prospects");
- the contact people at security companies that subscribe to Vigia (administrators, billing contacts, signatories) ("customer contacts");
- people who contact our support, sales or privacy teams;
- suppliers' and partners' contact people.
1.3 It does not cover the information inside a security company's Vigia account. When a security company (our customer) uses Vigia to record its staff's shifts, patrols, location, incidents, or its clients' details, that company is the responsible party and we are its operator (processor). If you are a guard, a staff member or a client of a security company, please read that company's privacy notice and contact it first. We will pass any request we receive about such information to the company concerned.
2. Who we are
| Responsible party | 365 Solutions (Pty) Ltd |
| Registration number | 2013/022266/07 |
| Address | 12 Etienne Street, Malanshof, Randburg, 2194 · [Postal address] |
| Telephone | [Telephone] |
| Company website | 365solutions.io |
| Product website | vigia.africa |
| Information Officer | Dirk Dhure, privacy@vigia.africa |
| Deputy Information Officer | Promise Makuwaza, privacy@vigia.africa |
| Privacy contact | privacy@vigia.africa |
3. What we collect and why
| Who | What we collect | Why we use it | Lawful basis (POPIA section 11) |
|---|---|---|---|
| Website visitors | Technical data: IP address, browser and device type, pages visited, time; cookie choices | To show the website securely, prevent abuse, and — only if you agree — understand how the site is used | Legitimate interests (security); consent (analytics cookies) |
| Prospects (trial request, "Talk to us") | Company name, country, security registration number (for example PSIRA), your name, role, work email and phone, number of guards and sites, your message | To answer you, check that the company is a registered security company before a trial starts, set up the trial, and follow up | Steps at your request before a contract; legitimate interests |
| Customer contacts | Name, role, work email and phone, sign-in details for the Vigia back office, acceptance of the subscription agreement (name, account, role, time, versions, a keyed hash of the IP address), billing contact and invoicing details, payment records, support history | To provide and bill the Service, manage the account, send service and security notices, keep records the law requires | Performance of a contract; legal obligation (tax records); legitimate interests |
| Support contacts | Name, contact details, ticket content | To help you | Contract; legitimate interests |
| Marketing | Name, work email, company, preferences | To send news about Vigia | Consent; or, for existing customers, similar products with an opt-out (POPIA section 69) |
| Suppliers and partners | Contact details, contract and payment records | To manage the relationship | Contract; legal obligation |
3.1 We do not ask for special personal information (for example health or biometric information) for any of these purposes.
3.2 Checking companies. Before a trial starts, we check the company against the public register of its security regulator (in South Africa, PSIRA). We use only the information needed for that check.
3.3 Children. Our website and sales services are for businesses. We do not knowingly collect information from children.
3.4 Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
4. Where we get it
4.1 Mostly from you (forms, emails, calls, the back office). Sometimes from your colleagues (when they name you as a billing contact or invite you), from public registers (the security regulator's register, the companies register), or from partners who refer you to us with your permission.
5. Who we share it with
5.1 We share personal information only as needed, with:
- our service providers who host and run our systems, deliver email and SMS, provide our accounting, customer-relationship and support tools — under contracts that require them to protect it;
- resellers or distributors who serve your company, where you buy through them;
- our professional advisers (lawyers, auditors) under confidentiality;
- authorities where the law requires it (for example the South African Revenue Service, or under a court order);
- a buyer or successor of our business, under confidentiality, if our business is sold or restructured.
5.2 We do not sell personal information.
6. Cross-border transfers
6.1 Our systems are hosted on Microsoft Azure, with our primary region in South Africa [confirm: planned]. Some of our providers (for example email delivery and customer-relationship tools) may process information outside South Africa.
6.2 We transfer personal information outside South Africa only as POPIA section 72 allows — normally where the recipient is bound by a law, binding corporate rules or a binding agreement that gives an adequate level of protection, or where the transfer is needed to perform a contract with you or at your request. You may ask us which providers and countries are involved.
7. How we protect it
7.1 We use appropriate technical and organisational measures (POPIA section 19): encryption in transit and at rest, multi-factor authentication for staff, access on a need-to-know basis, logging and monitoring, and provider contracts. See our security statement.
7.2 If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as POPIA section 22 requires.
8. How long we keep it
| Information | Kept for |
|---|---|
| Website technical logs | [90] days |
| Prospects who do not become customers | 24 months after the last contact, then deleted or anonymised |
| Customer contacts and account records | For the life of the account, then 12 months, except as below |
| Agreement acceptance records | For the life of the contract plus [the prescription period — confirm, e.g. 3 years] |
| Invoices and financial records | As tax law requires (in South Africa, at least 5 years under the Tax Administration Act [confirm]) |
| Marketing preferences | Until you unsubscribe, then a suppression record so that we do not contact you again |
9. Your rights
9.1 Under POPIA you have the right to:
- ask whether we hold personal information about you and access it (section 23; the process is in our PAIA manual);
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
- object to processing based on legitimate interests (section 11(3)), and at any time to direct marketing (section 11(3)(b) and section 69);
- withdraw consent where we rely on it, without affecting earlier processing;
- not be subject to certain decisions based solely on automated processing (section 71);
- complain to the Information Regulator (section 74).
9.2 How to ask. Email privacy@vigia.africa or write to the Information Officer at the address in section 2. We may ask you to prove your identity. We answer within 30 days. Access requests may carry the fee allowed by PAIA; we will tell you before any fee is charged.
9.3 Unsubscribing. Every marketing email has an unsubscribe link (Electronic Communications and Transactions Act section 45). You can also email us.
10. Information Regulator
If you are not satisfied with our answer, you may complain to the Information Regulator of South Africa:
| Website | inforegulator.org.za |
| Complaints | POPIAComplaints@inforegulator.org.za [confirm current address] |
| General enquiries | enquiries@inforegulator.org.za [confirm current address] |
| Physical address | [Information Regulator — current physical address, from its website] |
If you are in another country, you may also complain to your country's data protection authority.
11. Cookies
11.1 Our website uses only strictly necessary cookies unless you agree to more. We do not set analytics or advertising cookies before you consent. The Vigia apps use a secure sign-in cookie to keep you signed in. Details and how to change your choice are in our cookie notice.
12. Links to other websites
12.1 Our website may link to other sites (for example a regulator's register). We are not responsible for their privacy practices.
13. Changes
13.1 We may update this statement. The version and date are at the top. We will tell customer contacts of material changes by email.
14. Contact
Dirk Dhure, privacy@vigia.africa · privacy@vigia.africa · [Telephone] · [Postal address]
15. Points for legal review
- Retention periods in section 8 (website logs, agreement records, tax records under the Tax Administration Act and Companies Act).
- Whether the trial-request check against the security regulator's register needs any additional notice.
- Information Regulator contact details (confirm current emails and physical address before publication).
- Whether 365solutions processes any customer-contact information outside South Africa, and the section 72 basis for each provider (CRM, email, support tools to be named).
- Whether the statement must also address data subjects in other countries (for example Zimbabwe's Cyber and Data Protection Act) once country packs launch.
- Whether the Information Officer must be registered with the Information Regulator before publication (it must; confirm registration).