Privacy & data protection

Purpose

This policy outlines how nVisionIT Group Companies comply with the Protection of Personal Information Act, 4 of 2013 (POPIA), including how personal information is collected, processed, stored, safeguarded and disposed of. Our organisation has long valued the confidentiality of personal information and voluntarily implemented POPIA-aligned controls prior to the Act’s enforcement date.

Scope

This policy applies to all nVisionIT Group Companies (South Africa and Mauritius); all employees, contractors, interns and temporary staff; all client, supplier, partner and employee information processed by nVisionIT; and all systems, platforms, websites and digital tools where personal information is processed. It sits alongside our internal governance documents, including our AI usage and security policies, records-management standards, data-protection notices, and the terms in our contracts, SLAs and NDAs.

POPIA principles

nVisionIT adheres to the eight conditions for lawful processing of personal information:

• Accountability: we are accountable for complying with POPIA in everything we process as responsible party, and for meeting our operator obligations under contract where we process personal information on a client’s behalf.
• Processing limitation: information is processed lawfully, minimally, only for defined explicit purposes, and with consent where required.
• Purpose specification: information is collected for legitimate business, operational, contractual or legal purposes only.
• Further processing limitation: information is not used for purposes incompatible with the original purpose of collection.
• Information quality: we take reasonable steps to ensure information is accurate, complete, relevant and up to date.
• Openness: data subjects are informed of what is collected, why, how it will be used and with whom it may be shared.
• Security safeguards: appropriate organisational and technical measures protect personal information, including access controls, encryption and secure tenant-bound environments (Microsoft 365, Azure), with no unauthorised disclosure or transfer to AI tools or external systems.
• Data-subject participation: data subjects may request access, correction or deletion, and may withdraw consent where applicable.

Lawful basis & security of processing

Depending on context we may process identity, contact and employment information, client data within systems we manage, supplier information and website interaction data, applying data minimisation throughout. Security controls include secure Microsoft 365 and Azure environments, controlled access to systems and project assets, internal data-protection and record-control procedures, encryption in transit and at rest, no use of public or unapproved AI tools for personal or client data, logging and monitoring of system access, and incident-response protocols.

Sharing & cross-border transfer

Personal information may only be shared with authorised employees, service providers under contract with POPIA clauses, and legal or regulatory authorities where required. nVisionIT does not sell or share personal information with external parties for marketing purposes. Cross-border transfers occur only where necessary for service delivery, where equivalent data-protection measures exist, where contracts include cross-border POPIA clauses, and where explicit consent is obtained where required.

Cookies and website analytics

This website uses Google Analytics 4 to understand how visitors use our pages. It sets cookies in your browser and sends usage data, including a truncated IP address and device information, to Google, which processes it outside South Africa and Mauritius under its standard contractual terms. We use this only to improve the site. We do not use it for advertising and we do not link it to any personal information you send us through the contact form. Analytics cookies are off until you choose to accept them in the banner shown on your first visit. You can change your choice at any time through the Cookie settings link at the foot of every page, block the cookies in your browser settings, or install the Google Analytics opt-out add-on. Our pages also load fonts from Google Fonts, which means your browser sends its IP address to Google when a page loads; no cookie is set for this.

Insights subscriptions and emailed results

If you subscribe to our Insights articles, we use your email address, and the first name and sector you choose to give us, only to send you new articles. We ask for your consent on the form and confirm it with a link we email to you. We keep a register of subscribers on our own web server, recording when you confirmed and, if you unsubscribe, when you did, so that we never email you again. Every email we send you carries a one-click unsubscribe link, and you can also withdraw consent at any time by writing to info@nvisionit.co.za. We send these emails through SendGrid, the same service that delivers our contact-form messages. We do not track whether you open our emails or which links you click.

If you ask the AI readiness check to email your result, we use your address only to send that result and keep it no longer than we need to. We do not add you to any mailing list. If you tick the box allowing us to contact you about your result, we also send your result and contact details to our team so that someone can follow up.

Visitors in the European Union and the United Kingdom

Where the EU or UK General Data Protection Regulation applies to our processing of your personal data, we rely on your consent for Insights emails and analytics cookies, on taking steps at your request before entering a contract when you make an enquiry, and on our legitimate interests for running and securing this website. You have the rights to access, correct and erase your data, to restrict or object to processing, to data portability, and to withdraw consent without affecting earlier processing. Personal data is processed in South Africa and Mauritius and by the service providers named in this policy, some of which are outside the EU and UK. Where data is transferred, we rely on appropriate safeguards such as standard contractual clauses. You may complain to the data protection authority in your country. Requests go to info@nvisionit.co.za, marked for the attention of Stephen Jordaan, Infrastructure Specialist.

Retention, disposal & data-subject rights

Personal information is retained only for the period necessary to fulfil the purpose for which it was collected or as required by law, governed by nVisionIT’s Control of Records standards. Data subjects have the right to request access, correction or deletion, to object to processing, to withdraw consent, and to submit a complaint to a regulator. A complaint may be lodged with the Information Regulator in South Africa or the Data Protection Commissioner in Mauritius. Requests should be marked for the attention of Stephen Jordaan, Infrastructure Specialist, and sent to info@nvisionit.co.za, or posted to Stephen Jordaan, Infrastructure Specialist, nVisionIT, 28 Pelican Drive, Rooihuiskraal, Centurion 0157. We acknowledge every request within five business days. Data subjects in Mauritius may use the same address or contact our Mauritius office at info@nvisionit.mu.

Breach notification

Any suspected or actual data breach must be reported immediately. If personal information is compromised, nVisionIT will notify the affected data subjects and the relevant regulator: the Information Regulator under POPIA in South Africa, and the Data Protection Commissioner within 72 hours under the Data Protection Act 2017 in Mauritius.

Roles & responsibilities

Governance oversees POPIA compliance and maintains policies, notices and procedures; IT & Security teams enforce technical safeguards and manage access control and secure environments; employees and contractors must follow this policy and all related controls, must not expose personal or client data to unauthorised systems, and must report suspected breaches immediately.