Privacy Policy

1. Who we are and our role

1. 1.1 Responsible party. For personal information we collect about website visitors, prospective customers, account holders, billing contacts and Resellers, RedCore Group is the responsible party.
2. 1.2 Operator. For personal information that our customers upload to or create in their RedCore360 workspace (for example, their employees' names, their own clients' details, or task content) ("Customer Data"), the customer is the responsible party and RedCore Group acts as an operator that processes it only on the customer's instructions. If you are an individual whose information is held in a customer's workspace, please contact that organisation directly. We will assist them in responding to you.
3. 1.3 Information Officer. RedCore Group has appointed an Information Officer as required by POPIA. You can reach the Information Officer through the contact form at https://redcore360.co.za, marked for the attention of the Information Officer, or by post at:
   • REDCORE GROUP (Pty) Ltd — Information Officer, 1055 Frederick Avenue, Eldoraigne, Centurion, Gauteng, 0157, South Africa

2. Personal information we collect

1. We do not intentionally collect special personal information (such as health, religious beliefs, race or biometric information) or personal information of children. Customers must not upload such information to the Service unless they have a lawful basis to do so under POPIA.

3. Why we use it and our lawful basis

1. We process personal information only for specific, lawful purposes (section 13 of POPIA) and on the grounds set out in section 11.

4. Direct marketing

1. 4.1 We will send electronic direct marketing only (a) with your consent, or (b) if you are an existing customer and the marketing relates to our own similar products or services, as permitted by section 69 of POPIA.
2. 4.2 Every marketing message will include an easy way to opt out. You can also unsubscribe at any time through the contact form at https://redcore360.co.za. Opting out does not affect essential service communications (such as security notices or invoices).

5. Who we share it with

1. We do not sell personal information. We share it only as follows:
   • Service providers (operators) that help us run the Service, including cloud hosting and infrastructure, payment processing, email delivery, analytics and support tools. They are bound by written agreements requiring them to protect the information and use it only on our instructions (sections 20 and 21 of POPIA). You may request a current list of the categories of service providers we use through the contact form on our website.
   • Resellers, where you bought the Service through one, limited to what is needed to manage your subscription and support.
   • Professional advisers (auditors, attorneys, accountants) under confidentiality obligations.
   • Authorities, where required by law, court order or to protect rights, property or safety.
   • A buyer or successor in a merger, acquisition or sale of the business, subject to the same protections.

6. Cross-border transfers

1. 6.1 We host the Service with third-party cloud infrastructure providers and aim to keep Customer Data within South Africa where practicable.
2. 6.2 Some of our service providers may process personal information outside South Africa. Where this happens, we transfer it only in accordance with section 72 of POPIA, for example where the recipient is subject to laws, binding corporate rules or a binding agreement providing an adequate level of protection, or where the transfer is necessary to perform our contract with you. You may ask us where your data is currently hosted at any time.

7. How we protect it

1. We take appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction and unlawful access (section 19 of POPIA), including:
   • encryption of data in transit using TLS, and encryption of data at rest on our hosted infrastructure;
   • per-client workspace separation;
   • role-based access controls and individual user credentials;
   • passwords stored only as salted hashes, never in plain text;
   • restricted, logged staff access on a need-to-know basis;
   • regular backups and security updates; and
   • written confidentiality and data processing obligations for staff and operators.
2. No system is completely secure, but we regularly review and improve our safeguards.

8. Security compromises

1. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, as required by section 22 of POPIA. Where the compromise affects Customer Data, we will notify the relevant customer without undue delay so they can meet their own obligations.

9. How long we keep it

1. We keep personal information only as long as necessary for the purpose collected, or as required by law (section 14 of POPIA). After this, we delete, destroy or de-identify the information.

10. Your rights

1. Under POPIA you have the right to:
   • be told that your personal information is being collected, and be notified of a security compromise;
   • ask whether we hold your personal information and request access to it (see our PAIA Manual for the formal process and any prescribed fee);
   • ask us to correct, update or delete inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading or unlawfully obtained information;
   • object, on reasonable grounds, to processing based on legitimate interests;
   • object to, and opt out of, direct marketing at any time;
   • withdraw consent where processing is based on consent (this does not affect processing already done); and
   • lodge a complaint with the Information Regulator.
2. To exercise these rights, contact our Information Officer (clause 1.3). We will verify your identity before acting and respond within a reasonable time. Our PAIA Manual is available on request through the contact form on our website.

11. Cookies

1. 11.1 We use cookies and similar technologies that are:
   • Essential — required for login, security and core functionality. These cannot be switched off.
   • Analytics — help us understand how the website and Service are used, on an aggregated basis.
   • Preference — remember settings such as your view (board or list).
2. 11.2 You can block or delete cookies through your browser settings. Blocking essential cookies may stop the Service from working.
3. 11.3 We do not use cookies to serve third-party advertising.

12. Automated decision-making

1. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, as contemplated in section 71 of POPIA.

13. Links to other sites

1. Our website may link to third-party websites and integrations. This Policy does not apply to them. Please read their privacy policies.

14. Changes to this Policy

1. We may update this Policy from time to time. The latest version will always be available on our website, with the "Last updated" date. We will notify account holders by email or in-app notice of material changes.

15. Complaints

1. Please contact us first, through the contact form at https://redcore360.co.za, so we can try to resolve your concern. If you are not satisfied, you may complain to the Information Regulator (South Africa):
   • Website: https://inforegulator.org.za
   • Complaints: POPIAComplaints@inforegulator.org.za
   • General enquiries: enquiries@inforegulator.org.za

Questions about your privacy?

Contact our Information Officer through the contact form at https://redcore360.co.za or by post at REDCORE GROUP (Pty) Ltd, 1055 Frederick Avenue, Eldoraigne, Centurion, Gauteng, 0157, South Africa.