Privacy Policy

Last updated: 2026-10-19

This policy explains how EvTrack (Pty) Ltd (“EvTrack”, “we”) processes personal data in the EvTrack visitor management and access control service: the web application, the EvTrack FrontDesk kiosk app and the EvTrack Guard app.

This policy does not cover the evtrack.com website or EvTrack’s sales and marketing activities.

Who we are and our role

EvTrack provides its service to organisations (“customers”) that manage visitors, contractors, employees and other people entering their sites.

The customer decides what personal data to collect and why. Under South Africa’s Protection of Personal Information Act (POPIA), the customer is the responsible party and EvTrack is the operator. Under the EU and UK General Data Protection Regulation (GDPR), the customer is the controller and EvTrack is the processor. EvTrack processes personal data only to provide the service to the customer and on the customer’s instructions.

If you visited a site that uses EvTrack, the organisation you visited is responsible for your data. Their own privacy notice applies, and they are your first point of contact.

What personal data the service processes

What is collected depends on how each customer sets up EvTrack. Only the fields a customer switches on are collected. Depending on that set-up, the service can process:

  • Identity and contact details: name, phone numbers, email address, company, address, date of birth, gender and nationality.
  • Identity documents: ID or passport number, country of issue and driver’s licence details. Identity numbers are encrypted in the database. An image of the ID document is kept only if the customer switches on saving ID copies, which is off by default.
  • Photos and signatures: a photo taken at check-in, and signatures given on agreements.
  • Visits and access: who was visited, check-in and check-out times, doors and gates used, vehicles and number plates, and answers to the customer’s own questions, such as health or safety declarations.
  • Credentials: QR codes, PINs and access cards issued to a person.
  • Biometric data, only where the customer uses it for access control: face templates created from a person’s profile photo, and fingerprint templates.
  • Employee records: details of the customer’s own staff who host visitors or use access control.
  • User accounts: names, email addresses and sign-in activity of the customer’s staff who use EvTrack.

Why it is processed

EvTrack processes this data to provide the service to the customer, including to:

  • register, check in and check out visitors, and issue them with passes and credentials
  • control access to the customer’s sites through connected doors, gates and readers
  • send invitations, access codes and notifications by email, SMS, WhatsApp or push notification
  • keep records and reports for the customer, including audit logs of changes
  • keep the service secure, find and fix faults, and provide support to the customer

EvTrack does not use the data for its own purposes, such as marketing.

The customer is responsible for telling people how their data is used and, where needed, for obtaining their consent. EvTrack provides tools for this:

  • The kiosk can show a privacy notice, with text the customer controls, before a visitor registers. It is on by default and the customer can switch it off. When the visitor starts from the on-screen buttons, nothing is scanned or captured until they accept. When a visitor presents an ID document at the kiosk’s idle screen instead, the document is read and checked with the server before the notice appears, and a document that matches an existing visit can complete check-in or check-out without the notice. The kiosk does not record whether the visitor accepted the notice.
  • Customers can ask visitors to accept agreements or declarations, such as terms of entry. EvTrack keeps a record of each one, including any signature.
  • Customers can add a terms and conditions checkbox to visitor pre-registration.

Who receives the data

Personal data is shared with:

  • the customer, and the customer’s staff who have the right permissions in EvTrack
  • EvTrack’s sub-processors, listed on the Sub-processors page
  • services the customer chooses to connect to EvTrack, such as its own email server or access control system

EvTrack may also disclose personal data where the law requires it.

Where it is stored and how it is protected

The service’s application and databases are hosted in the region the customer chooses at sign-up. Some sub-processors, listed on the Sub-processors page, may store or process data elsewhere. See Data Storage and Security for hosting, encryption and access controls.

How long it is kept

Each customer sets how long EvTrack keeps visit records, visitor data and audit logs. See Retention and Deletion for the default periods, what deleting a visitor removes, and what happens when a customer leaves EvTrack.

Your rights

Depending on where you are, you may have the right to ask for access to your personal data, to have it corrected or deleted, or to object to how it is used. Because the customer is responsible for your data, please send your request to the organisation you visited. EvTrack helps the customer respond on the customer’s instruction.

If you are not sure which organisation holds your data, or the organisation does not respond, contact us at legal@evtrack.com and we will pass your request on.

You also have the right to complain to a data protection authority, such as the Information Regulator in South Africa.

Changes to this policy

We update this policy when the service or the law changes. The date at the top of the page shows when it last changed.

Contact

EvTrack (Pty) Ltd
159 Buitenkant St, Gardens, Cape Town, 8001, South Africa
Company registration number: to be confirmed

Information Officer: Nathan Bearman
Email: legal@evtrack.com

Configure this in EvTrack

Back to top

Copyright EvTrack (Pty) Ltd. All rights reserved.