POPI Act Privacy Policy

1. Introduction and Scope

OmniSafe ("we", "us", "our") is committed to protecting the privacy and security of the Personal Information we process. This Privacy Policy outlines our practices regarding the processing of Personal Information on our marketing website, application portal (app.omnisafe-risk.co.za), and associated omnichannel interfaces (including our WhatsApp compliance hub).

This policy is aligned with South Africa's Protection of Personal Information Act, No. 4 of 2013 ("POPIA") and the regulations issued thereunder. By accessing our platform, website, or using our compliance consulting services, you acknowledge that your personal information will be processed as set out in this policy.

2. The Responsible Party & Information Officer

OmniSafe is the "Responsible Party" (as defined under POPIA) in respect of the personal information collected directly through our website. For personal information uploaded by our business clients (Tenants) onto the digital SHEQ platform, OmniSafe acts as the "Operator" processing data on the client’s behalf.

For inquiries regarding this policy or to exercise your statutory rights under POPIA, please contact our designated Information Officer:

3. Definitions under POPIA

• "Data Subject" means the person to whom personal information relates (e.g. website users, tenant administrators, employees of tenants, contractors).
• "Personal Information" means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person.
• "Processing" means any operation or activity, whether or not by automatic means, concerning personal information.
• "Operator" means a person who processes personal information for a responsible party in terms of a contract or mandate.

4. Types of Personal Information We Process

We process the following categories of Personal Information depending on your interaction with the platform:

5. Purpose of Processing Personal Information

We process personal information only for specific, explicitly defined, and lawful purposes related to our business operations:

• To provide and maintain the OmniSafe digital SHEQ application portal and fulfill our contractual commitments.
• To enable employers (Tenants) to meet statutory obligations under South Africa's Occupational Health and Safety Act 85 of 1993 (OHSA) and the Compensation for Occupational Injuries and Diseases Act (COIDA).
• To facilitate zero-data-barrier field compliance via the WhatsApp Hub, including transcription of hazard notes and identity verification through voice biometrics.
• To deliver SETA-aligned adaptive training and generate fraud-proof training certificates.
• To send platform notifications, expiry alerts (e.g. for driver PrDPs or medical cards), and security warnings.
• To comply with directives, audits, and orders from regulatory bodies such as the Department of Employment and Labour (DEL).

6. Lawful Basis for Processing

Under POPIA, we rely on the following lawful grounds for processing personal information:

• Consent: The Data Subject has provided clear and voluntary consent for processing (e.g., opting in to marketing communications or submitting biometrics for verification).
• Contractual Obligation: Processing is necessary to execute or perform a contract with you or your organization.
• Legal Obligation: Processing is required to satisfy OHS statutory and regulatory compliance mandates in South Africa.
• Legitimate Interests: Processing is necessary to protect your safety, evaluate compliance levels, or maintain our application's security integrity.

7. Information Sharing and Disclosure

We do not sell, rent, or trade personal information. We disclose information only under strict confidentiality terms in the following circumstances:

• Principal Contractors (Section 37.2): Where subcontractors utilize the platform, data might be compiled and made visible to the client principal contractor as authorized in agreements to check cascading compliance liabilities.
• Service Providers (Operators): We share information with trusted hosting infrastructure, SMS gateways, and WhatsApp API providers who act strictly as operators under written privacy agreements.
• Legal and Regulatory Bodies: We disclose information when required by law, court order, or when demanded by inspectors from the Department of Employment and Labour or the Compensation Commissioner.

8. Cross-Border Data Transfers & Cloud Infrastructure

As the Responsible Party, OmniSafe ensures that all personal information and data processing conducted on third-party cloud infrastructure strictly complies with Section 72 of POPIA.

Personal information, documents uploaded to Firebase Storage, and operational records managed via Firebase Data Connect (Cloud SQL Postgres) are processed and hosted on secure cloud servers operated by Google Cloud Platform (GCP) and Firebase. While these servers may be located outside South Africa:

• Data Processing Addendum (DPA): We operate under the Google Cloud and Firebase Data Processing Terms, ensuring Google processes data strictly in accordance with robust, standardized international privacy controls.
• Equivalent POPIA Standards: The foreign jurisdictions and cloud infrastructure facilities utilized provide security safeguards, data protection levels, and contractual commitments equivalent to or exceeding the requirements under POPIA Section 72.

9. Security Safeguards (Section 19 Compliance)

In accordance with Section 19 of POPIA, we implement appropriate, reasonable technical and organizational measures to secure the integrity and confidentiality of personal information under our control, preventing unauthorized access, loss, destruction, or disclosure:

• Data Encryption: All personal data and assets stored in Firebase Storage and Data Connect (Cloud SQL) are encrypted in transit using Transport Layer Security (TLS 1.2/1.3) and at rest using AES-256 standards.
• Gated Auth & Data Connect Directives: Database operations and queries are strictly gated via Firebase Authentication and fine-grained @auth directives within Firebase Data Connect GraphQL schemas.
• Storage Rules & Access Controls: Document uploads and media assets in Firebase Storage are governed by granular Firebase Security Rules, restricting read/write access to authenticated users within authorized tenant boundaries.
• Role-Based Access Control (RBAC): Application functionality, administrative privileges, and tenant data partitioning are enforced through tenant-isolated Role-Based Access Controls (RBAC) and custom claims.

10. Information Retention (Section 14)

In accordance with Section 14 of POPIA, we retain personal information only for as long as necessary to achieve the original purpose of collection, unless further retention is required by law (e.g. the 40-year retention rule for certain hazardous chemical exposure records under OHSA, or general tax records), or is required under contract. Once retention is no longer justified, we securely destroy, de-identify, or archive the records.

11. Your Statutory Rights

As a Data Subject, POPIA grants you specific rights. You have the right to request:

• Confirmation of whether we hold personal information about you.
• Access to or a copy of the personal information we hold.
• Correction, rectification, or deletion of personal information that is inaccurate, irrelevant, excessive, out-of-date, or obtained unlawfully.
• Objection, on reasonable grounds, to the processing of your personal information.
• Withdrawal of previously given consent (where processing relies on consent).

To submit a request regarding these rights, please email our Information Officer at the address provided in Section 2.

12. Lodging a Complaint with the Information Regulator

If you are unsatisfied with how we handle your personal information, or if you believe we have breached our POPIA obligations, you have the right to submit a complaint directly to the South African Information Regulator:

13. Cookies and Tracking Technologies

Our website uses cookies and similar tracking codes (such as Google tag tracking and Google Analytics) to improve user navigation experience, analyze traffic volumes, and track user engagement. You can choose to block or disable cookies within your web browser settings, although some features of our website may not function correctly as a result.

14. Changes to This Privacy Policy

We may update this policy periodically to reflect operational changes or evolving South African legal frameworks. We will notify users of any material changes by updating the policy on this page and updating the "Last Updated" date at the top of this document.