Privacy & POPIA Notice

Last updated: 18 September 2026

MicroSec Group respects privacy and processes personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law. This notice applies to microsec.co.za, MicroSec Helios services, enquiries, customer accounts, orders, technical-service workflows and related interactions where MicroSec determines the purpose and means of processing.

Who is responsible

MicroSec Group is the responsible party for personal information it processes for its own business purposes. Where MicroSec processes information solely on a customer’s documented instructions, the applicable contractual roles may differ. Privacy enquiries and data-subject requests may be sent to info@microsec.co.za.

What we may collect

Depending on your interaction with us, we may process identification and contact details, account and authentication information, company and billing information, order and transaction records, correspondence, service and support records, site or equipment information supplied for a technical service, uploaded files and evidence, device/browser and security logs, IP addresses, and information needed to operate Helios or fulfil a requested service. We aim to collect only information that is adequate, relevant and reasonably necessary for the stated purpose.

Why we process information

We process information to respond to enquiries, provide quotations and contracted services, operate accounts and Helios functionality, fulfil orders, provide support, maintain security, prevent abuse or fraud, keep required business records, comply with legal obligations, and pursue legitimate business purposes permitted by law. Where consent is the appropriate lawful basis, consent may be withdrawn subject to applicable law and legitimate retention requirements.

Helios and technical AI privacy

Ask Me Anything Technical and other Helios intelligence functions are intended for technical assistance. Private MicroSec information, personal or family information, internal methods and recipes, confidential architecture, prompts, credentials, pricing formulas, customer or prospect information, commercial strategy and confidential intellectual property are not authorised as public knowledge sources. Technical AI retrieval must be limited to approved public technical sources and information or tenant documents that are explicitly authorised for that user and purpose. Access controls, tenant separation and least-privilege principles apply to protected information.

Sharing and operators

We may use authorised operators and service providers where necessary to host, secure, communicate, deliver, process payments, fulfil orders or provide requested functionality. They should receive only information reasonably required for their role and are expected to protect it appropriately. We do not sell personal information.

Cross-border processing

Some technology or cloud providers may process information outside South Africa. Where personal information is transferred internationally, MicroSec will apply the requirements of POPIA, including appropriate safeguards or another lawful transfer basis where required.

Security safeguards

We use reasonable technical and organisational safeguards appropriate to the information and risks involved. These may include encrypted HTTPS connections, access controls, protected administrative areas, authentication controls, security monitoring, backups, restricted database and API access, and separation of public and confidential information. No internet-connected system can be guaranteed absolutely secure.

Security compromises

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, MicroSec will assess the incident and follow applicable POPIA notification requirements, including notification to the Information Regulator and affected data subjects where required by law.

Retention and deletion

Personal information is retained only for as long as necessary for the purpose for which it was collected, for legitimate business or security requirements, or where retention is required or permitted by law. When information is no longer required, it will be deleted, destroyed or de-identified as appropriate.

Your POPIA rights

Subject to POPIA and applicable exceptions, you may ask whether we hold personal information about you, request access to it, request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information, object to certain processing, or request that processing cease where the law provides that right. We may need to verify your identity before acting on a request.

Direct marketing

Electronic direct marketing will be handled in accordance with applicable consent and opt-out requirements. Marketing communications should provide a practical way to opt out where required.

Cookies and analytics

Our websites and connected services may use necessary cookies for login, security, cart, account and service functionality and may use analytics or similar technologies. Non-essential tracking should be managed in accordance with applicable privacy and consent requirements. Third-party services may have their own privacy terms.

Children’s information

We do not intentionally use our public services to solicit personal information from children where processing would require authorisation under POPIA. Where children’s information is legitimately required for a service, appropriate authorisation and safeguards must be applied.

Complaints

Please contact MicroSec first at info@microsec.co.za so that we can investigate a privacy concern. Data subjects also have the right to lodge a complaint with South Africa’s Information Regulator in accordance with POPIA.

Changes to this notice

We may update this notice as our services, operators or legal requirements change. The current version will be published on this page.

This notice describes MicroSec’s operational privacy approach and is not a substitute for legal advice. Contract-specific processing terms may apply to enterprise or operator relationships.