Privacy Policy

This privacy notice for SouthSync (Pty) Ltd (doing business as "SouthSync") ("we," "us," or "our") describes how and why we collect, store, use, and/or share your personal information when you:

• Visit our website at https://www.southsync.co.za, or any other SouthSync website that links to this notice.
• Sign up for, or use, our Fibre, LTE, Hosting, or other Services, including the SouthSync client portal and mobile app.
• Engage with us for sales, support, marketing, or billing.

Questions or concerns? If you do not agree with this notice, please do not use our Services. If you have questions, contact our Information Officer at privacy@southsync.co.za.

TABLE OF CONTENTS

• 1. What information do we collect?
• 2. How do we process your information?
• 3. When and with whom do we share your personal information?
• 4. Do we use cookies and other tracking technologies?
• 5. How long do we keep your information?
• 6. How do we keep your information safe?
• 7. Do we collect information from minors?
• 8. What are your privacy rights?
• 9. Do we transfer information outside South Africa?
• 10. Your rights under POPIA and the Information Regulator
• 11. Do we make updates to this notice?
• 12. How can you contact us about this notice?
• 13. How can you review, update, or delete the data we collect from you?

1. What information do we collect?

Personal information you disclose to us

We collect personal information that you voluntarily provide when you sign up for a Service, place an order, register on the client portal or mobile app, or otherwise contact us. Depending on how you interact with us, this may include:

• Full name
• Phone number
• Email address
• Installation, billing, and postal address
• VAT number (business clients)
• Username and password (your password is stored as a one-way cryptographic hash; SouthSync staff cannot see your actual password)
• Billing and payment references (see Payment Data below)
• Support requests, ticket messages, and any files you attach to them

Providing your name, contact details, and installation address is necessary to enter into a Service Order with you; without them, we cannot provide the Service. We do not collect your ID number at the enquiry or order stage. Once your Service has been successfully set up, we will send you a separate, dedicated verification request to confirm your identity before the Service goes live; if you choose not to complete that step, we may not be able to activate your Service.

Sensitive information. Your South African ID number is sensitive (special) personal information under the Protection of Personal Information Act, 4 of 2013 ("POPIA"). We only request it after a Service has been successfully set up, as part of a dedicated identity-verification step, and only with your consent, given at that time. We process it solely for identity verification, fraud prevention, and billing purposes.

Payment Data. Card payments are entered directly into PayFast's secure, hosted payment page. SouthSync does not collect or store your full card number or CVV. If you choose to save a card for recurring billing, PayFast provides us with a payment token (not your card number) that we use to request future charges. You may find PayFast's privacy notice at https://payfast.io/privacy-policy/.

Information automatically collected

Some information is collected automatically when you use our website, client portal, or mobile app, such as your IP address, browser and device characteristics, operating system, and an approximate location derived from your IP address. We use this to operate, secure, and troubleshoot the Services, and for internal analytics. We do not use precise GPS-based location tracking.

• Log and usage data. Our servers record diagnostic and performance information such as timestamps, pages/endpoints accessed, and error reports.
• Service usage data. For active Fibre/LTE Services, we record connection and bandwidth usage data from our network equipment so we can show you usage statistics and manage the network fairly.

2. How do we process your information?

We process your personal information to:

• Create and administer your account, including authentication and 2-factor login.
• Deliver and support the Service you have ordered.
• Verify your identity and prevent fraud before activating a Service.
• Bill you and process payments.
• Respond to support requests and other enquiries.
• Send administrative communications, such as invoices, service, and maintenance notices.
• Send marketing communications, where permitted by law, with an easy way to opt out (see Section 8).
• Evaluate and improve our Services.
• Comply with our legal obligations and enforce our legal rights.

3. When and with whom do we share your personal information?

We may share personal information with:

• PayFast (payment processing and card tokenization).
• Google (Firebase Cloud Messaging), to deliver push notifications to the SouthSync mobile app.
• WhatsApp Business (Meta), if you choose to contact our support team via WhatsApp.
• The network and infrastructure providers that carry your Fibre or LTE Service (e.g. Openserve, Octotel, Vodacom, MTN, or other partners relevant to your package), to the extent necessary to provision and maintain the Service.
• Our hosting and IT infrastructure providers.
• Legal or regulatory authorities, where required by law.
• A buyer or successor, in the event of a merger, acquisition, or sale of business assets.

We do not sell your personal information, and we do not purchase personal information about you from third-party data brokers. In connection with provisioning a Fibre or LTE Service, we may receive confirmation of installation or line status from the relevant network provider.

4. Do we use cookies and other tracking technologies?

Our website uses essential cookies/local storage needed for login sessions, and may load fonts and icon libraries from third-party CDNs (such as Google Fonts and Font Awesome), which can receive your IP address when those resources load. We do not use third-party advertising trackers. Most browsers let you block or delete cookies; doing so may affect login and other features.

5. How long do we keep your information?

We keep account and support information for as long as you have an active Service, and for up to 6 months after your account is closed, to handle any follow-up queries, disputes, or fraud checks.

Financial records — invoices, payment records, and related billing data — are kept for 5 years, as required by the Companies Act, 71 of 2008, and the Tax Administration Act, 28 of 2011. Where we have no further legitimate business or legal need to keep personal information, we delete or anonymize it, or securely isolate it until deletion is possible (e.g. where it sits in backups).

6. How do we keep your information safe?

We use reasonable technical and organizational security measures appropriate to the nature of the information we hold, including access controls, encrypted password storage, and restricted administrative access. No system can be guaranteed 100% secure, so we cannot promise that unauthorized third parties will never defeat these measures.

7. Do we collect information from minors?

Our Services are not directed at, and we do not knowingly collect personal information from, children under 18. POPIA places extra conditions on processing a child's personal information, and we do not knowingly do so without the consent of a competent person (such as a parent or guardian). If you believe we hold information about a child without appropriate consent, contact privacy@southsync.co.za so we can investigate and, where appropriate, delete it.

8. What are your privacy rights?

• Withdrawing consent. Where we rely on your consent (e.g. to process your ID number, or for marketing), you can withdraw it at any time by contacting us. This does not affect processing already carried out.
• Direct marketing. In line with Section 69 of POPIA, you can object to receiving direct marketing communications at any time, free of charge, by using the unsubscribe link in our emails or by contacting privacy@southsync.co.za. We will still send you Service-related communications (e.g. invoices, outage notices) that are necessary to administer your account.
• Account access. You can review and update most of your account information directly in the client portal, or by contacting us.

9. Do we transfer information outside South Africa?

Some of the service providers listed in Section 3 — such as Google (Firebase Cloud Messaging) and Meta (WhatsApp Business) — are based outside South Africa, including in the United States. Where we transfer personal information to these providers, we rely on their own data protection commitments and contractual terms, consistent with Section 72 of POPIA.

10. Your rights under POPIA and the Information Regulator

At any time, you have the right to request access to, or correction of, your personal information by contacting us (see Section 13 below).

SouthSync's Information Officer, responsible for POPIA compliance, is Dewet Riaan, contactable at privacy@southsync.co.za.

If you are unsatisfied with how we have handled a complaint about our processing of your personal information, you may contact the Information Regulator:

• The Information Regulator (South Africa)
• General enquiries: enquiries@inforegulator.org.za
• Complaints (POPIA/PAIA form 5): PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za

11. Do we make updates to this notice?

We may update this notice from time to time. The "Last updated" date at the top will change, and if we make material changes we will let you know by posting a notice on our website or contacting you directly.

12. How can you contact us about this notice?

If you have questions or comments about this notice, email our Information Officer at privacy@southsync.co.za.

13. How can you review, update, or delete the data we collect from you?

You may have the right to request access to, correction of, or deletion of the personal information we hold about you, subject to our legal obligations (for example, we must keep financial records for the periods described in Section 5). To make a request, log in to the client portal at https://southsync.co.za/client or email privacy@southsync.co.za.