Version 1.0

SafetyHub Software Consulting, a private company registered in the Republic of South Africa, respects privacy and processes personal information in accordance with the Protection of Personal Information Act 4 of 2013. This Policy explains what we process, why, how long we keep it, who receives it and how individuals may exercise their rights.

1 Scope and Our Privacy Roles

This Policy applies to the SafetyHub website and Platform, including users, client contacts, employees, contractors, visitors and other persons whose information is processed through a Client workspace.

For workforce, contractor, visitor, incident and other Client controlled information, the Client company decides why and how the information is processed and is the Responsible Party. SafetyHub acts as its Operator. Requests concerning that information should normally be directed to the Client first.

SafetyHub is a Responsible Party for information it collects and uses for its own purposes, including account registration, Client administration, billing, enquiries, support, service security, audit logs and website operation.

2 Information We Process

• Identity and contact information, including names, work contact details, job titles, employee or contractor numbers and site assignments.

• Account and authentication information, including password hashes, multi factor settings, roles, permissions and session records.

• Employment, competency, training, appointment and certificate information.

• Hazard, incident, investigation, inspection, risk, action, permit and legal compliance records.

• Contractor and visitor prequalification, induction, access, host and check in or check out records.

• Occupational health and other special personal information enabled by a Client, such as fitness outcomes, restrictions and surveillance schedules.

• Photographs, documents, signatures, comments and other evidence uploaded through the Platform.

• Technical and usage information, including device, browser, IP address, timestamps, audit events, diagnostics and security logs.

• Commercial and support information, including Order Forms, invoices, communications and support requests.

3 Sources

Information may be provided directly by the individual, entered by a Client or its authorised users, generated through use of the Platform, received from approved integrations or service providers, or created when SafetyHub provides support and security services.

4 Purposes and Lawful Processing

• provide, administer, secure, support and improve the Platform;

• authenticate users and enforce roles, permissions and company separation;

• enable Clients to manage occupational health, safety, environmental and operational processes;

• generate dashboards, notifications, records and Client instructed exports;

• manage subscriptions, billing, communications and support;

• prevent fraud, investigate misuse, maintain security and establish or defend legal rights; and

• comply with applicable legal and regulatory obligations.

Depending on the context, processing may be necessary to perform a contract, comply with law, pursue a legitimate interest, protect a legitimate interest of the Data Subject, or be based on consent or another ground permitted by POPIA. The relevant Client is responsible for the lawful basis and notices relating to Client controlled information.

5 Special Personal Information

SafetyHub processes occupational health and other special personal information only when enabled and lawfully instructed by a Client, subject to restricted permissions and additional safeguards. Clients must ensure they have the required legal authority and must avoid uploading medical details that are unnecessary for workplace safety management.

6 Sharing and Sub Operators

Information may be shared with authorised Client users, SafetyHub personnel and professional advisers, regulators or law enforcement where legally required, and approved service providers needed to operate the Platform. Current core providers include Cloudways for managed hosting, DigitalOcean for cloud infrastructure and Cloudflare for DNS, content delivery and web traffic security. We do not sell personal information.

7 Hosting and Cross Border Transfers

SafetyHub is hosted through Cloudways on DigitalOcean infrastructure, with Cloudflare providing an additional content delivery and security layer. These providers may process information outside South Africa. SafetyHub applies mechanisms permitted by section 72 of POPIA, including contractual protection designed to provide an adequate level of protection, another applicable statutory basis, or valid consent where appropriate.

8 Retention and Deletion

• Client controlled information is retained during the subscription according to Client settings and applicable legal requirements.

• After termination, Client Data is available for export for 30 days unless the applicable Order Form states otherwise.

• Client Personal Information is deleted or irreversibly anonymised from active systems within 60 days after the export period ends.

• Residual backup copies expire within a further 90 days through the protected backup cycle and are not restored except for recovery, security investigation or legal compliance.

• Account, billing, security and legal records are retained only for as long as reasonably necessary for the purpose collected or as required by law.

• A legal hold or mandatory retention requirement may delay deletion; affected information is restricted and deleted when the requirement ends.

9 Security

SafetyHub uses technical and organisational safeguards appropriate to the risks, including encrypted connections, protected hosting and backups, role based access, server side authorisation, company scoped tenant isolation, private file storage, security logging, vulnerability management, monitoring and incident response. Access to occupational health information is restricted through dedicated permissions. No system eliminates every risk, but SafetyHub continually reviews safeguards and responds to identified threats.

10 Security Compromises

When SafetyHub acts as Operator and has reasonable grounds to believe Client Personal Information was accessed or acquired by an unauthorised person, it will notify the relevant Client immediately and assist with investigation and legally required notifications. When SafetyHub acts as Responsible Party, it will notify the Information Regulator and affected Data Subjects as soon as reasonably possible after discovery, subject to the needs of law enforcement and measures reasonably necessary to determine the scope and restore system integrity.

11 Data Subject Rights

Subject to POPIA and applicable record keeping duties, a Data Subject may request confirmation and access, correction or deletion, object to certain processing, withdraw consent where processing depends on consent, and complain to the Information Regulator. SafetyHub may need to verify identity before acting. Requests about Client controlled information will normally be referred to the relevant Client Responsible Party.

12 Required Information and Consequences

Some information is required to create an account, provide contracted services, meet security requirements or complete a Client configured safety process. If required information is not provided, an individual may be unable to access the Platform or complete the relevant process. Optional fields should be identified by the Client or interface where reasonably practicable.

13 Cookies and Similar Technologies

SafetyHub uses necessary cookies and similar technologies for authentication, security, session management and core functionality. Any optional analytics or functional technologies will be identified in an up to date cookie notice and used with consent where required. Users can control optional cookies through available settings, but necessary cookies cannot be disabled while using authenticated services.

14 Children

SafetyHub is designed primarily for workplace use by adults. A Client may record limited information about a child where the child is a lawful visitor, affected person or otherwise connected to a workplace event. The Client must ensure the processing is necessary, lawful and appropriately authorised, and must limit the information to what is required.

15 Automated Assistance

The Platform may calculate scores, flag deadlines or assist users to classify and route records. SafetyHub does not make solely automated decisions that produce legal or similarly significant effects for individuals. Clients and authorised users remain responsible for workplace and employment decisions.

16 Changes

SafetyHub may update this Policy to reflect changes in the Platform, processing or law. The current version will be published, and material changes will be communicated to Clients through reasonable channels.

17 Contact and Complaints