Privacy Notice

About this notice

This Privacy Notice applies to the Shields services provided by CLEOSOFT (Pty) Ltd, including the Shields by cleoSoft mobile application, the Shields Admin by cleoSoft desktop application, backend services, APIs, reports, notifications, dashboards, subscriptions, support channels and related services that link to this notice.

Shields is designed for security operations, including inspections, patrols, employee duty attendance, site deployments, location management, incident and quick reporting, equipment tracking, access control, operational reporting and related administrative functions.

This notice explains what personal information may be processed, why it is processed, how it is protected and what rights users have under the Protection of Personal Information Act 4 of 2013 (POPIA).

Responsible party and operator roles

In many operational use cases, the client company or employer determines why and how employee and operational personal information is processed and may therefore act as the responsible party under POPIA.

CLEOSOFT / Shields may process that information as an operator or service provider on behalf of the client company according to lawful instructions, system configuration and the services provided.

CLEOSOFT / Shields may also act as a responsible party for information relating to account registration, billing, subscriptions, platform security, support, diagnostics, product improvement, legal compliance and communications with customers.

Personal information we may process

Company and account information

Company name, registration or business details, contact details, billing details, address information, subscription status, trial status, payment status and administrative contacts.

User and employee information

Name, surname, employee number, role, permissions, email address, contact number, gender where configured by the company, job function, employment status, site deployment, duty status, shift information and user account information.

Authentication and security information

Login details, authentication tokens, password reset records, multi-factor authentication status, device and session information, access logs, permission records and security audit information. Passwords are not intended to be stored in readable form.

Operational security information

Inspection records, inspection notes, occurrence book numbers, inspection times, employee snapshots, equipment snapshots, quick reports, patrol irregularities, patrol records, maintenance files, equipment movements, employee postings, duty-on and duty-off records, site deployment records, location records, access control events, access people, access vehicles, credentials, visitor records, permit records where applicable and operational reports.

Images and attachments

Images or files may be uploaded during inspections, patrol irregularities, quick reports, equipment records, maintenance records, access control records, permit records or other operational activities. These files may contain people, vehicles, property, equipment, access points, documents, security incidents, hazards or other information captured by the user.

Users should avoid uploading unnecessary personal or sensitive information unless it is required for a lawful operational purpose.

Location and GPS information

Shields may process GPS coordinates, accuracy information, timestamps, site boundaries, location coordinates, patrol or report coordinates and proximity or movement-related telemetry where required for operational functions.

Location information may be used to confirm where an inspection, quick report, patrol irregularity, duty event, employee posting, access control event or other operational activity occurred.

Device and technical information

Device type, operating system, application version, installation identifiers, sync status, crash or error logs, network status, API request metadata, IP address and diagnostic information may be processed to keep the service secure and functioning.

Billing and subscription information

Subscription plan, billing status, trial period, payment provider reference, payment status, subscription dates, grace period status and related account information may be processed.

Payment card or banking details should be handled by the payment provider and are not intended to be stored directly in Shields unless explicitly stated.

Why we process personal information

Personal information may be processed to:

• register and manage company accounts;
• create and manage users, employees, roles and permissions;
• control access to sites, locations, reports and operational features;
• record inspections, patrols, duty attendance, quick reports, access control events and irregularities;
• verify where and when operational activities occurred;
• manage employee site deployment and posting records;
• manage equipment, maintenance records and equipment movements;
• manage access control, visitor, vehicle, credential and permit records where applicable;
• generate operational, compliance, management and client reports;
• support offline-first operation and later synchronisation;
• prevent unauthorised access and protect system security;
• investigate errors, abuse, fraud, security incidents or technical issues;
• provide support and respond to user or company requests;
• manage billing, trial periods, subscriptions, grace periods and access status;
• comply with legal obligations, lawful requests, audit requirements and POPIA; and
• improve reliability, performance, usability and safety of the services.

Legal basis for processing

Depending on the circumstances, personal information may be processed because:

• the user or company has accepted the applicable notice or terms;
• processing is necessary to perform the requested service;
• processing is necessary for employment, operational, contractual or client-security purposes;
• processing is necessary to protect legitimate interests such as security, accountability, fraud prevention or service reliability;
• processing is required by law or lawful instruction; or
• processing is necessary for billing, subscription, audit, dispute or compliance purposes.

Where consent is required, Shields may request consent or acknowledgement through the application, desktop system, registration process or another suitable channel.

Privacy notice acceptance

Before registration can continue, the registering user may be required to accept the current Shields privacy notice and confirm that they are authorised to register the company or account where applicable.

Shields may store the accepted privacy notice version, acceptance date and time, acceptance source and related account details as proof of acknowledgement.

If the privacy notice changes materially, users may be required to accept the updated version before continuing to use the service.

Use of GPS and location data

Because Shields is used for security operations, location data is an important part of the service. It may be used to verify inspections and reports, show where quick reports or patrol irregularities occurred, support duty and operational site scope, confirm that operational records relate to the correct site or location, and assist supervisors and managers with accountability, safety, compliance and reporting.

Some coordinates may be locked after first save to preserve the integrity of operational reports.

Shields should not be used as hidden surveillance. Employers and companies using Shields should ensure that employees are properly informed about location-related processing.

Offline use and synchronisation

Shields may store information locally on a device so that inspections, reports, duty records, images, equipment records, access records and other operational data can be captured while offline.

When connectivity becomes available, the application may synchronise that data with the backend. Users should not uninstall the application, clear application data or take other actions that may remove critical unsynchronised data unless instructed by an authorised administrator or support person.

Sharing of information

Personal information may be shared with:

• authorised users within the same company;
• supervisors, administrators, managers or control-room users;
• client representatives where the company has configured reports or access for client-facing purposes;
• service providers that help operate Shields, including hosting, email, payment, analytics, support, storage or security providers;
• law enforcement, regulators, courts or public authorities where legally required; and
• professional advisers where needed for legal, audit, accounting or compliance purposes.

We do not sell personal information.

Data security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration, disclosure and destruction.

Security measures may include authentication, permissions, encryption, secure communication channels, database protection, access controls, audit logs and operational safeguards.

No system can be guaranteed completely secure. Users and companies must also follow good security practices.

Data retention

Personal information and operational records may be retained for as long as necessary for security operations, client reporting, employment, payroll, attendance, duty records, access control, legal, audit, tax, contractual or compliance requirements, dispute resolution, fraud prevention, backup and recovery, and legitimate business purposes.

Retention periods may differ according to the type of data and the lawful requirements of the relevant company.

Where information is no longer required, it may be deleted, anonymised, archived or restricted where appropriate. Some records may be preserved to maintain audit integrity and prevent tampering with operational history.

Data subject rights

Subject to POPIA and applicable law, a data subject may have the right to:

• ask what personal information is held about them;
• request access to their personal information;
• request correction of inaccurate information;
• request deletion or restriction where legally appropriate;
• object to certain processing;
• withdraw consent where processing depends only on consent; and
• submit a complaint to the company, CLEOSOFT / Shields or the Information Regulator.

Some requests may need to be handled by the employer or client company where that company is the responsible party.

Reports and client visibility

Shields may generate reports containing employee names, times, sites, locations, inspection records, duty records, patrol irregularities, quick reports, equipment records, access control records, permit records, images, notes, GPS coordinates and other operational information.

Companies are responsible for ensuring that reports are shared only with authorised people and only for lawful purposes.

Communications

We may send administrative, security, support, billing, subscription, password reset, email verification, privacy or service-related communications.

Some communications are necessary for the service and cannot be opted out of while using Shields. Users and companies must keep account contact details accurate.

Changes to this notice

We may update this notice from time to time. If the notice changes materially, users may be required to accept the updated version before continuing to use Shields.

Contact and data requests

For privacy, access, correction, erasure or other POPIA-related requests, users may contact their employer or company administrator, or CLEOSOFT / Shields support.

Companies using Shields should also provide their own internal privacy or HR contact where they act as the responsible party for employee and operational data.