Privacy Statement

Solution House Software (Pty) Ltd ("Solution House Software", "SHS", "we", "us" or "our") is a South African software developer and operator of cloud-based platforms. This Privacy Statement is the single privacy notice for this website and for every product, website, portal, mobile application and service that we develop, host or operate ("Products"). Each Product links to this statement instead of publishing its own. The Products include:

• MyIncidentDesk (https://www.myincidentdesk.com/)
• Incident Desk No-Code (https://www.myincidentdesk.com/no-code)
• Urban Management & Public Safety (https://www.myincidentdesk.com/urban-management-public-safety)
• CID CRM (https://cidcrm.myincidentdesk.com/)
• TakeActionAI (https://takeactionai.myincidentdesk.com/)
• MySecurityApp (https://mysecurityapp.co.za/)
• OB (Occurrence Book) (https://ob.myincidentdesk.com/)
• MySchoolFM (https://myschoolfm.myincidentdesk.com/)
• MySmartFM (https://mysmartfm.myincidentdesk.com/)
• FaceCamAlert (https://facecamalert.co.za/)
• FaceCamAlert Demographics (https://demographics.facecamalert.co.za/)
• AI Image Enhancer (https://aienhance.facecamalert.co.za/)
• OnboardPro (https://onboardpro.myincidentdesk.com/)

This statement is issued in terms of section 18 of POPIA. It should be read with our PAIA & POPIA Manual, Cookie Policy, Facial Recognition, CCTV & Licence Plate Notice and, for our clients, our Operator Data Processing Terms.

POPIA distinguishes between a "responsible party", who decides why and how personal information is processed, and an "operator", who processes personal information on behalf of a responsible party under a contract or mandate.

• As an operator: most personal information in our Products is captured by, or on behalf of, our clients, such as municipalities, City Improvement Districts, security service providers, property owners and managing agents, schools, retailers and other businesses. The client is the responsible party. We process that information only on the client's documented instructions, under a written agreement that complies with sections 20 and 21 of POPIA.
• As a responsible party: we decide how personal information is processed when we run this website, manage our own clients, suppliers, staff and job applicants, provide support and billing, market our services and operate any shared or centralised databases that we maintain ourselves (for example a centralised FaceCamAlert database used across subscribers).

Depending on the Product and how our client has configured it, we process the following categories of personal information:

Some of this information is "special personal information" under section 26 of POPIA, including biometric information, information about criminal behaviour (such as alleged offences recorded in incident reports, occurrence books or watchlists) and, where it appears in records, health information (for example injuries noted in an incident report) or race or ethnic origin.

Special personal information is processed only where a ground in sections 27 to 33 of POPIA applies, including the data subject's consent; where processing is necessary to establish, exercise or defend a right or obligation in law; where the data subject has deliberately made the information public; where processing is for historical, statistical or research purposes in the public interest; or where the Information Regulator has granted an authorisation. Information about criminal behaviour is processed only as permitted by section 33 of POPIA.

Where section 57 of POPIA requires it (for example when processing information on criminal behaviour on behalf of third parties, or linking unique identifiers to other information for a new purpose), the responsible party obtains prior authorisation from the Information Regulator before that processing starts.

Our Products are not directed at children. Where a client (such as a school using MySchoolFM) processes information about children, the client is the responsible party and must obtain the consent of a competent person or rely on another ground in section 35 of POPIA. We process such information only on the client's instructions.

• Directly from you, for example through contact forms, account registration, support requests and onboarding.
• From our clients and their authorised users, who capture information into the Products.
• From cameras, licence plate recognition devices, sensors and mobile devices that our clients configure.
• Automatically, through cookies, logs and similar technologies when you use our website or Products.
• From third parties such as group companies, service providers, verification services engaged by our clients, and public sources, where lawful.

Where we collect information from a source other than you, we do so only where permitted by section 12 of POPIA.

We process personal information only for these specific purposes, and further processing takes place only where it is compatible with the original purpose, as required by section 15 of POPIA.

Information marked as required in our forms and Products is needed to respond to you, provide the service or meet legal obligations. If you do not provide it, we or our client may be unable to respond to your enquiry, create your account, complete onboarding or deliver the service. Other information is voluntary.

Where a law requires or authorises the collection of information (for example the Financial Intelligence Centre Act 38 of 2001 for onboarding by an accountable institution, or tax legislation), we or our client will identify that law at the point of collection.

• The client on whose behalf the information was collected (the responsible party) and that client's authorised users.
• Other companies in the Solution House Holdings group, where necessary to deliver the Products.
• Service providers acting as our sub-operators, such as cloud hosting and storage, email and SMS delivery, mapping, AI and image-processing and IT support providers. They are bound by written agreements requiring confidentiality and appropriate security measures.
• The South African Police Service and other law-enforcement or regulatory authorities, where required by law or where our client lawfully reports a crime.
• Professional advisers such as attorneys, auditors and insurers, who are bound by duties of confidentiality.
• A purchaser or successor in the event of a sale, merger or restructuring of our business, subject to equivalent protection.

We do not sell personal information.

Some of our service providers host or process information outside the Republic of South Africa. We transfer personal information outside South Africa only where section 72 of POPIA permits it: where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection; where you have consented; or where the transfer is necessary to perform a contract with you or is for your benefit.

Special personal information and children's information is not transferred to a country without adequate protection unless prior authorisation has been obtained from the Information Regulator under section 57 of POPIA.

We keep personal information only for as long as needed to achieve the purpose for which it was collected, unless a longer period is required or authorised by law, a contract or the client's documented instructions (section 14 of POPIA).

• Client data in our Products: for the term of the client agreement and the retention periods set by the client, after which it is deleted or returned.
• CCTV footage, facial recognition alerts and licence plate reads: for the retention period configured by the client for that purpose, unless needed for an investigation or legal proceedings.
• Website and contact enquiries: up to 24 months after our last interaction with you.
• Financial and company records: for the periods prescribed by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011 (generally five to seven years).

When information is no longer needed, we destroy, delete or de-identify it in a way that prevents it from being reconstructed.

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, unauthorised destruction of, and unlawful access to or processing of personal information, as required by section 19 of POPIA. These include:

• Encryption of data in transit and, where supported, at rest.
• Logical separation of each client's data in our multi-tenant platforms.
• Role-based access controls, unique user accounts and multi-factor authentication where available.
• Audit logs, regular backups and disaster recovery.
• Vulnerability management and security monitoring.
• Confidentiality undertakings and POPIA training for our staff.
• Due diligence on, and written agreements with, our sub-operators.
• Privacy impact assessments for new or high-risk processing, such as biometrics.

If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in terms of section 22 of POPIA. Where we act as operator, we notify the affected client immediately, as required by section 21(2), so that the client can notify the Regulator and data subjects.

Some Products use automated technology, such as facial recognition or licence plate recognition, to generate alerts. These alerts are indicators only. No decision that has legal consequences for you, or affects you to a substantial degree, is based solely on automated processing: alerts are reviewed by a trained person before any action is taken. Where section 71 of POPIA applies, you may make representations about such a decision and ask for information about the underlying logic.

We send electronic direct marketing only in accordance with section 69 of POPIA: to persons who have given their consent, or to existing customers about our own similar products or services. Every marketing message includes our details and a free way to opt out. You may withdraw your consent at any time by using the unsubscribe link or emailing us.

Subject to POPIA, you have the right to:

• Be told that your personal information is being collected, and be told if it has been accessed or acquired by an unauthorised person.
• Ask whether we hold personal information about you and request access to it (section 23), following the procedure in our PAIA & POPIA Manual.
• Request correction, destruction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
• Object, on reasonable grounds, to processing based on legitimate interests, and object at any time to processing for direct marketing (section 11(3)).
• Withdraw your consent at any time, without affecting processing that took place before you withdrew it.
• Not be subject to decisions based solely on automated processing (section 71).
• Lodge a complaint with the Information Regulator and institute civil proceedings (section 99).

To exercise a right, contact our Information Officer. Objections may be submitted on Form 1 and requests for correction or deletion on Form 2 of the POPIA Regulations, and access requests on Form 2 of the PAIA Regulations. The forms are available on the Information Regulator's website and from us on request. We will verify your identity before acting on a request and respond within a reasonable time and any period prescribed by law.

Our use of cookies, local storage and similar technologies is explained in our Cookie Policy.

Our website and Products may link to third-party websites and services. We are not responsible for their privacy practices, and we encourage you to read their privacy notices.

We may update this statement from time to time. The current version, with its "last updated" date, is always available at https://shs.myincidentdesk.com/legal/privacy.

Questions, requests and complaints about privacy can be sent to our Information Officer:

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator: