Privacy Policy (POPIA Compliant)

This Privacy Policy describes how FacilityNexa ("we", "us", "our", or "the Responsible Party") collects, uses, discloses, and protects personal information when you use our application and services. This policy is compiled in accordance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa and applicable data protection laws.

1. Information We Collect

• Account & company information: Your name, email address, company name, and contact details provided during registration.
• Employee data: Employee names, positions, departments, employment dates, and training records managed by your company administrators. This is personal information processed on behalf of the responsible company (the Data Controller).
• Certificates & documents: Training certificates and supporting documents uploaded by authorised users within your organisation.
• Payment information: Subscription and billing data processed securely by PayFast. We do not store credit card or banking details — these are handled entirely by PayFast, our payment service provider.
• Usage data: App activity logs, audit trails, and system monitoring data used to maintain security and service quality, and to produce the limited operational/usage report described in Section 11.

2. Lawful Basis for Processing

Under POPIA, we process personal information only where we have a lawful basis, including:

• Your consent to process personal information for the purposes of providing the service.
• The performance of a contract between you and FacilityNexa (your subscription agreement).
• Compliance with legal obligations, including labour and occupational health and safety regulations.
• Our legitimate interests in operating, securing, and improving the service.

3. How We Use Your Information

• To manage employee training compliance, certification tracking, and audit reporting.
• To send automated notifications about expiring or overdue training certificates.
• To process subscription payments and manage billing (R499/month or R4,990/year via PayFast).
• To provide role-based access control and multi-tenant data isolation between companies.
• To generate compliance reports for audit and regulatory purposes.
• To improve application performance, security, and user experience.
• To generate a limited, private weekly operational/usage report for service administration, security, capacity planning and product management, as described in Section 11.

4. Data Isolation & Security

Your data is strictly isolated by company (tenant). Users cannot access another company's data. Access within your organisation is controlled through role-based permissions: Administrator, Operations Manager, Technical Specialist, Shift Supervisor, Technician, and Read Only.

We implement appropriate technical and organisational measures to safeguard personal information, including:

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Secure authentication tokens with automatic session expiry.
• Regular security reviews and access audits.
• Row-level security policies enforced at the database level.

5. Sharing & Disclosure

We do not sell or rent your personal information. We share data only with:

• PayFast: Our payment service provider, for processing subscription payments. PayFast processes payment data in accordance with its own privacy policy and PCI-DSS compliance.
• Cloud infrastructure providers: For hosting and data storage, under strict data processing agreements.
• Legal authorities: Where required by South African law or a court order.

6. Data Retention

We retain personal information for as long as your account is active or as needed to comply with legal obligations. Upon account cancellation, your data is retained for 90 days (in a read-only state) to allow for resubscription, after which it may be permanently deleted. You may request earlier deletion of your data at any time by contacting support.

7. Your Rights Under POPIA

As a data subject, you have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate or incomplete personal information.
• Request deletion of your personal information (subject to legal retention requirements).
• Object to the processing of your personal information.
• Withdraw consent for processing at any time.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, please contact our Information Officer at supportfacilitynexa@gmail.com.

8. Children's Privacy

This application is intended for workplace training compliance management and is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a child has provided personal information, please contact us so we can delete it.

9. Cross-Border Transfers

Your data may be processed on cloud infrastructure located outside South Africa. Where this occurs, we ensure that adequate safeguards are in place in accordance with POPIA requirements for cross-border information transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the application or via email. Continued use of the service after changes constitutes acceptance of the revised policy.

11. Operational & Usage Reporting (Owner Reports)

As part of our legitimate operational interests in administering, securing and improving the Service, FacilityNexa generates a limited, private weekly operational report delivered solely to our authorised owner/support mailbox. This section describes that processing in accordance with POPIA's openness principle.

• Categories of personal information processed: Account information you provide on registration (name and email address) and existing platform activity logs already generated in the ordinary course of operating the Service (for example, records of employee, training and certificate entries created by authorised users within your organisation). Anonymous visitors are reported only as aggregate counts where such data is legitimately available.
• Purposes of processing: Service administration, security monitoring, capacity planning, product management, and identifying significant application or service issues already recorded in the system.
• Limited operational/usage reporting: The report contains simple, high-level metrics such as new registrations, active and inactive user counts, applications started and submitted/completed, and week-on-week changes. It is deliberately minimal and proportionate to the operational purpose.
• Aggregated statistics: Where identification is not genuinely required, information is presented in aggregate form only. Anonymous visitors are not identified.
• Use of authenticated account information for administration: Where identification is genuinely required for legitimate administration (for example, counting registered users), the minimum existing account information necessary (such as name and email) may be used. No new personal information is collected solely for the weekly report.
• Authorised recipient and access: The report is delivered only to our designated owner/support mailbox and is generated server-side as an explicitly authorised administrative operation. It is not accessible to ordinary users, to other tenants, or via any client-facing dashboard, page, or public URL. The report contains no per-tenant breakdown and cannot become a mechanism through which one tenant obtains another tenant's information.
• Security safeguards: Generation and aggregation occur server-side under our role-based access controls and existing tenant isolation (company_id) boundaries. The recipient address is configured server-side and is never supplied by a client request.
• No invasive tracking: The report does not use keystroke logging, screen recording, session replay, behavioural profiling, precise location tracking, device fingerprinting, private-message monitoring, password/authentication monitoring, or payment-data reporting.
• Retention: The weekly report is delivered as a transient email only. No detailed personal-information report is retained in the FacilityNexa application database. Retention of the delivered email in the recipient mailbox is governed by the owner's own email retention policy. Where detailed identity information is no longer required for the operational purpose, it is not stored in-app.
• Proposed lawful basis: Our legitimate interests in operating, securing and improving the Service. This is a proposed basis documented for transparency; it is not a legal determination or certification, and may be reviewed for professional legal assessment.

To raise a privacy query, request access, correction or deletion, or to lodge a complaint about this processing, please contact our Information Officer atsupportfacilitynexa@gmail.com. You also retain the right to lodge a complaint with the Information Regulator of South Africa (www.inforegulator.org.za). This reporting does not require you to waive any POPIA right.

12. Contact Us

For questions about this Privacy Policy, or to exercise your data protection rights, please contact our Information Officer:

• Email: supportfacilitynexa@gmail.com
• Or visit our Contact Support page.