Privacy Policy
Draft revision: 7 October 2026
1. Who this policy covers
I.S.S. (Pty) Ltd provides guarding, direct camera monitoring, and technical services to clients in North West and Gauteng. This notice explains how personal information is handled through our website, enquiries and service delivery under the Protection of Personal Information Act, 4 of 2013 (POPIA). It covers prospective and existing clients, their representatives, visitors to protected premises, suppliers and people who contact us. Employment and recruitment processing may also require a separate staff or applicant notice.
2. Our role and client responsibilities
We are the responsible party when we decide why and how information is used for our own enquiries, administration and business records. When we handle information on a client’s instructions, for example monitoring the client’s cameras, we may act as an operator. The relevant agreement must identify responsibilities, permitted uses, security requirements and retention arrangements. Site-specific privacy notices and access rules should explain the client’s processing at that premises. This website notice does not replace those notices or an operator agreement.
3. Information we may collect
Depending on the service, information may include names, business and contact details, site addresses, quotation and contract records, billing information and correspondence; visitor and vehicle entry records; CCTV images, timestamps and incident footage; occurrence-book entries, incident reports and information about witnesses or affected people; and technical system details or support logs. Biometric templates, identity documents, or information about alleged offences require additional safeguards and are handled only where necessary and lawfully authorised. These categories do not mean that every service collects all of this information.
4. How we obtain information
Information may come directly from you through our forms, email, telephone or meetings; from an authorised client, property manager or employer; from cameras and access systems at a serviced site; or from reports compiled during security duties. Website and hosting systems may record IP addresses, browser information, access times and security events. Collection must be limited to information relevant to a defined purpose.
5. Why we use information
We use relevant information to respond to enquiries, assess site requirements, prepare quotations, deliver and manage agreed services, coordinate incident escalation, investigate reported events, provide technical support, administer accounts and comply with applicable legal obligations. Processing requires an applicable lawful basis, such as consent, necessary contract performance, a legal obligation or a legitimate interest recognised by POPIA. Visiting the website or submitting an enquiry is not blanket consent to unrelated processing. Where information is optional, you may decline to provide it. Without essential contact or service information, we may be unable to respond or deliver the requested service.
6. CCTV, access control and incident records
Security information must be used for the authorised security purpose and accessed only by people who need it for their duties. Camera placement, access permissions, recording features and site notices must be appropriate to that purpose. Requests for footage should identify the site, date, approximate time and reason for the request. Release requires verification of authority and consideration of other people’s privacy, investigations and legal requirements. Footage should not be circulated publicly or on social media without a lawful basis. Biometric processing and any recording of sound require a separate assessment of necessity, authorisation and applicable legal restrictions.
7. Who may receive information
Relevant information may be shared with authorised personnel, the client or property manager, service providers supporting the work, and professional advisers where necessary. Enquiries about technical services may be routed to ATS, BFGM or Access Tech Pro according to the requested service; the relevant business’s own privacy obligations also apply. Information may be disclosed to SAPS, emergency services, courts, regulators or insurers where lawfully required or justified. Service providers processing information on our behalf must be subject to appropriate confidentiality and data protection obligations. Personal information must not be sold or used for unrelated purposes without a lawful basis.
8. Retention and disposal
Information must be retained only for as long as necessary for its purpose or as required or permitted by law. CCTV retention and automatic overwrite periods must be set for each site and system rather than assumed to be the same for every client. Incident extracts may be preserved longer for an investigation, insurance matter or legal claim. Enquiries, contracts, financial records and support logs require appropriate retention periods for their purposes. At the end of the applicable period, records must be securely deleted, destroyed or de-identified, subject to any lawful preservation requirement. Contact us for the retention arrangements relevant to your information.
9. Security and technical support
Appropriate technical and organisational safeguards must protect information against loss, unauthorised access, misuse or disclosure. These include proportionate access restrictions, confidentiality requirements, secure handling and suitable protection of systems and records. Support access to client networks, servers, hosting or software must be authorised and limited to the agreed task. Do not send passwords, alarm codes, identity documents or sensitive footage through an ordinary website enquiry form. A suitable channel can be arranged when that information is necessary. No system can guarantee absolute security. Where a security compromise occurs, notification to the Information Regulator and affected people will be handled as required by POPIA.
10. Hosting and transfers outside South Africa
Hosting, email, software or support providers may process information in other countries. Any such transfer must meet POPIA’s cross-border requirements, including an applicable lawful transfer basis and appropriate protection. You may contact us for information about providers and locations relevant to a particular service. This notice does not assume that all information is stored within South Africa.
11. Website cookies and third-party links
Cookies and similar technologies may be used for website operation, security and preference settings. Where optional cookies are used, applicable choices should be offered through the cookie controls. You can also manage cookies through your browser, although disabling essential cookies may affect functionality. Links to other websites are governed by those websites’ privacy notices. Specific analytics, advertising or embedded services should be disclosed when they are introduced or confirmed.
12. Marketing
An enquiry does not automatically subscribe you to marketing. Electronic direct marketing must comply with POPIA’s consent or qualifying existing-customer requirements. You may object or opt out of marketing at any time. Necessary responses to your enquiry and operational service communications are separate from promotional messages.
13. Your privacy rights
Subject to applicable law, you may ask whether we hold your personal information, request access, request correction or deletion where appropriate, object to qualifying processing, and withdraw consent where processing relies on it. Withdrawal does not invalidate earlier lawful processing or prevent processing under another lawful basis. We may verify your identity and authority before releasing records, and consider other people’s rights and lawful retention duties. For information controlled by a client, we may refer your request to that responsible party. Access to records may also follow the Promotion of Access to Information Act (PAIA) and applicable procedures.
14. Privacy requests and complaints
For now, send enquiries marked “Privacy request” to sales@iss-grp.co.za or call 012 250 5055 so the request can be directed to the appropriate person. You may also complain directly to the Information Regulator; contacting us first is not a condition of doing so. Visit inforegulator.org.za/complaints/ for current complaint channels and forms.
15. Changes to this notice
We will update this notice when our services, processing activities or legal requirements change. The revision date will identify the current version. Material new processing may require additional notice or consent; updating this page alone does not provide that consent.