Privacy Policy (POPIA)

Please note: this version of the policy has not yet had its final legal review, so its wording may still change. The version and date above identify the text you are reading. Until an Information Officer is named here, send any privacy question or request to support@securityhub.global.

1. Who we are and our role

SecurityHub processes personal information in line with the Protection of Personal Information Act, 2013 (POPIA). Our role depends on what you use:

Company workspaces. When a company (a security provider, installer, manufacturer or distributor) uses SecurityHub to run its business, that company is the responsible party for the personal information it captures about its staff, clients and sites. SecurityHub acts as an operator on its behalf.
Shield ID accounts, the public directory and enquiries. When you create a Shield ID, claim or edit a directory listing, or send an enquiry or quote request through the public site, SecurityHub is the responsible party for that information.

2. What we process

Account details (name, email, phone), authentication data, and the operational data entered into a company workspace (clients, sites, guards, PSIRA registrations, shifts, incidents, invoices and so on). For a Shield ID we also hold your ID or passport number, your PSIRA details, a photo of your PSIRA certificate and a photo of your face where you provide them, and location readings when you clock in, scan a patrol checkpoint or send an SOS. We ask for your consent before collecting your identity number and a photo of your face.

3. Why we process it

To provide and secure the Service, to let an employer check and manage the people it employs, to pass enquiries to the companies they are meant for, to bill subscribers, to meet legal and regulatory obligations (including PSIRA-related record-keeping), and to support you.

4. Security

Data is logically isolated per company, transmitted over TLS, passwords are hashed (BCrypt), and privileged access supports two-factor authentication. Access is logged.

5. Your rights (data subjects)

You may ask for access to, correction of, or deletion of your personal information, and you may object to its processing. If you hold a Shield ID you can download a copy of what we hold about you from your profile once you are signed in. Company administrators can export their company's data from Company Settings → Your data (POPIA export). For information a company holds about you as its employee or client, ask that company first; for anything else, or if you get no answer, write to us at the address under Contact. You also have the right to complain to the Information Regulator of South Africa.

6. Retention

We retain data for as long as the account it belongs to is active or as required by law. On termination, data may be deleted after a reasonable export window.

7. Sharing and processing outside South Africa

We do not sell personal information. A Shield ID is shared with the employer that invited you or that you apply to. Enquiries and quote requests are passed to the companies they are addressed to or matched with. Beyond that we share information only with the service providers needed to run the Service — hosting and web security, e-mail delivery and payment processing — and, for a company workspace, only as that company instructs.

Some features are optional and use an artificial-intelligence service provided by Anthropic. When that service is switched on and you use such a feature (for example “Polish with AI” on a report, or the Doris assistant), the text you submit and the operational information needed to answer is sent to that provider and processed outside South Africa. Do not put names, ID numbers or other personal details into those features unless you need to.

8. Contact

Privacy questions and requests about a Shield ID, a directory listing, an enquiry or the platform itself: support@securityhub.global. For information held by a company that uses SecurityHub, contact that company's Information Officer.