Privacy Policy

1. Legal framework

This Privacy Policy explains how Deis Technologies (Pty) Ltd ("Deis Technologies", "we", "us" or "our") collects, uses, stores and protects personal information through GovernIQ. We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other relevant data protection legislation.

• Responsible party: the organisation that subscribes to GovernIQ (the customer). It decides why and how the personal information of its clients, employees and other data subjects is processed.
• Operator: Deis Technologies, which processes that information on the customer's behalf and instructions to provide GovernIQ.
• Data subject: any person whose personal information is processed, including a customer's users, employees, clients and the owners and controllers of its clients.

2. Information we process

Which of these apply depends on the modules a customer has enabled.

• User accounts and sign-in data: name, email address, role, tenant membership, credentials (stored as hashes, never in plaintext), two-factor (TOTP) enrolment, sign-in through Microsoft Entra ID where the customer enables it, and records of acceptance of the terms of use.
• Employee roster data: employee records and the declarations, screening results and training records the customer captures about its staff.
• Client, KYC and beneficial-ownership data: client and company details, ownership structures, verification and identity-check results, and identity numbers. Identity numbers are encrypted at rest and masked in the user interface.
• Screening and anti-money-laundering data: screening results, alerts, cases, transaction records and regulatory report submissions.
• Compliance and risk records: registers (such as representatives, key individuals, gifts, debarment and licences), obligations, risks, controls and their tests, incidents, complaints, issues and actions, policies and attestations.
• Documents and evidence that users upload to GovernIQ.
• Audit logs: a record of security-relevant actions, including who did what and when.
• Technical data needed to run the service, such as session information and request logs.

3. How we use information

We do not sell personal information, and we do not use customer data for advertising.

• To provide GovernIQ to the customer and carry out the customer's instructions.
• To secure the platform, detect misuse and keep an audit trail.
• To support customers and resolve incidents.
• To comply with our legal obligations.
• To improve the reliability and performance of GovernIQ.

4. Customer responsibilities

GovernIQ is a decision-support tool. The customer is the responsible party for the personal information it captures. It must have a lawful basis to collect it, must tell its data subjects how it is used, and must meet the obligations that apply to it under POPIA, the Financial Intelligence Centre Act 38 of 2001 and any other law that applies to its business.

5. How we protect information

• Each customer's data is isolated from other customers' data.
• Sensitive fields, including identity numbers and two-factor secrets, are encrypted at rest with authenticated encryption (AES-GCM) using a key per customer. Those keys are wrapped by a key held in Microsoft Azure Key Vault.
• Traffic to GovernIQ is protected with TLS.
• Access is controlled by roles and permissions, supported by two-factor authentication, and security-relevant actions are written to audit logs.
• No system is completely secure. To report a suspected incident, write to [email protected].

6. Retention

We keep personal information only for as long as needed to provide GovernIQ to the customer, to meet our legal obligations, or as the customer's agreement requires. This policy does not set fixed retention periods. Customers must also meet the record-keeping periods that apply to them. To ask for deletion, see the data deletion page.

7. Service providers and hosting

GovernIQ is hosted on Microsoft Azure. See the data residency page for the region. We disclose personal information to regulators, law enforcement or courts only where the law requires it.

8. Cookies

GovernIQ sets a session cookie to keep you signed in. It is strictly necessary for the service to work and cannot be turned off while you use GovernIQ.

9. Personal information breaches

If personal information is accessed or acquired without authorisation, we will notify the affected customer without undue delay and give it what it needs to meet its own duties to the Information Regulator and to data subjects, as POPIA requires.

10. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request access to it;
• ask us to correct inaccurate or incomplete personal information;
• ask us to delete personal information, subject to legal retention requirements;
• object to the processing of your personal information in certain circumstances;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator.

Requests about information held for a customer

Where the information is held for a customer, we may refer your request to that customer, who is the responsible party. Some requests may require us to verify your identity.

11. Changes to this policy

We may update this policy. The date at the top of the page shows when it last changed.

12. Contact us about privacy

Information Officer:

Yasvanth Singh (Managing Director)

Email:

[email protected]

Phone:

+27 78 872 6405

Address:

24 Sand Olive Close, Sagewood, 1685, South Africa

Support:

[email protected]

Complaints

Regulator:

Information Regulator (South Africa)

Address:

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Phone:

010 023 5200

Email:

[email protected]

Website:

www.inforegulator.org.za