POPIA (Protection of Personal Information Act)
The Protection of Personal Information Act, 2013 (POPIA) is South Africa’s data protection law. This page explains EvTrack’s role under POPIA and how the service helps customers meet their obligations.
Roles under POPIA
POPIA involves three parties:
| POPIA term | Who it is | Example |
|---|---|---|
| Data subject | The person the information is about | A visitor to a customer’s site |
| Responsible party | Decides why and how the information is processed | The customer using EvTrack |
| Operator | Processes the information for the responsible party | EvTrack |
EvTrack processes personal information as an operator, on behalf of its customers and on their instructions. The customer, as the responsible party, decides what is collected, why, and for how long. See the Privacy Policy for what the service processes.
How EvTrack helps customers comply
POPIA sets eight conditions for lawful processing. These EvTrack features help customers meet them:
- Processing limitation and minimality: customers choose which visitor details are required, and can leave optional fields switched off. Saving ID document images is off by default.
- Openness: the kiosk can show a privacy notice, with text the customer controls, before a visitor registers. It is on by default; the Privacy Policy explains when it appears.
- Retention: customers set how long visit records, visitor data and audit logs are kept, and EvTrack deletes them automatically. See Retention and Deletion.
- Security safeguards: encryption, access control, single sign-on and audit logs. See Data Storage and Security.
- Data subject participation: customers can find, correct and delete a person’s records. Some records remain after a delete; Retention and Deletion lists them.
Requests from data subjects
Requests to access, correct or delete personal information, or to object to its processing, should go to the responsible party: the organisation the person visited or works for. EvTrack helps the responsible party respond, on its instruction. If you can’t reach the responsible party, email legal@evtrack.com.
Security compromises
As an operator, EvTrack notifies the affected customer if it has reasonable grounds to believe that personal information it processes for that customer has been accessed or acquired by an unauthorised person, as POPIA requires. The customer then notifies the Information Regulator and the people affected.
Transfers outside South Africa
Customers can choose a hosting region outside South Africa, and some sub-processors may process data in other countries (see Sub-processors). The basis for these transfers under section 72 of POPIA is to be confirmed.
Information Officer
EvTrack’s Information Officer is Nathan Bearman, who oversees EvTrack’s compliance with POPIA and handles data protection queries.
Email: legal@evtrack.com
Further information
Configure this in EvTrack
- Privacy and retention: what EvTrack holds, consent, retention and handling requests