Access Track

Privacy Policy

Welcome to our privacy policy. We are Access Track (Pty) Ltd (Registration number: 2013/236447/07) and this is our plan of action when it comes to protecting your privacy. We respect your privacy and take the protection of personal information very seriously. The purpose of this policy is to describe the way that we collect, store, use, disclose, retain, and protect information that can be associated with you or another specific natural or juristic person and can be used to identify you or that person (personal information). This policy applies to our website, our customer online portal, the Access Track scanner mobile application, the Access Track customer mobile application, and our access control and visitor management services used at residential complexes, commercial office parks, schools and similar controlled-entry environments in South Africa.

Audience

This policy applies to you if you are:

a visitor to our website;
a user of our customer online portal, scanner mobile application, or customer mobile application;
a representative, administrator, employee, contractor, learner guardian, resident, tenant, or other authorised user of one of our customers;
a visitor, driver, pedestrian, contractor, supplier, or service provider whose personal information is processed through our access control or visitor management services; or
a customer who has ordered or requested the goods or services that we provide.

What is personal information?

Personal information includes:

certain information that we collect automatically when you visit our website;
certain information collected on registration (see below);
geolocation information (see below);
certain information collected on submission; and
optional information that you provide to us voluntarily (see below);

but excludes:

information that has been made anonymous so that it does not identify a specific person;
permanently de-identified information that does not relate or cannot be traced back to you specifically;
non-personal statistical information collected and compiled by us.

Common examples

Common examples of the types of personal information which we may collect and process include your:

identifying information – such as your name and surname and, where necessary for the relevant use case, limited identity document, driver's licence, passport, or vehicle licence information;
contact information – such as your phone number or email address;
account and profile information – such as your username, password, portal role, permissions, customer account details, and support history;
access event and visitor management information – such as the site being visited, host or resident details, date and time of entry and exit, purpose of visit, vehicle registration number, and related access logs;
images and scan information – such as photographs of a person or vehicle where the visitor freely allows this, and scan extracts or images captured from identity, driver's licence, or vehicle licence cards where used for lawful access-control purposes;
device and technical information – such as device identifiers, IP address, operating system information, application logs, and usage information; and
communications and form information – such as information included in enquiries, support requests, visitor manual entry forms, and acknowledgements or acceptances of indemnity forms where a customer has enabled that functionality.

Geolocation information

Depending on the service being used, our mobile applications may request limited location access from your device where this is necessary for features such as identifying the relevant site, supporting security workflows, assisting with troubleshooting, or improving the reliability of app functions. We do not require precise location for every use case, and where location access is optional you may decline it, although some features may then be limited or unavailable.

Sensitive personal information

Access Track does not collect or store biometric information of visitors through its services at this time, including fingerprint templates, fingerprint scans, facial recognition templates, or facial scan data. Depending on the services used and the configuration chosen by a customer, we may process limited categories of information that require additional care, such as:

official document information – such as information visible on an identity document, driver's licence, passport, or vehicle licence disk where scanned or captured for a lawful and customer-authorised access control purpose;
incident and security information – such as information linked to an access dispute, incident report, investigation, or complaint, where lawful and necessary.

Acceptance

Acceptance required

You must accept all the terms of this policy when you order our goods or request our services. If you do not agree with anything in this policy, then you may not order our goods or request our services.

Legal capacity

If you are using our services on behalf of a customer, you confirm that you have authority to do so. If you are under 18 years old, any use of our services involving your personal information must be authorised by a parent, guardian, school, or other competent person where required by applicable law.

Deemed acceptance

By accepting this policy, you are deemed to have read, understood, accepted, and agreed to be bound by all of its terms.

Your obligations

You may only send us your own personal information or the information of another data subject where you have their permission to do so.

How do we collect personal information?

On submission of an enquiry or registration

When you submit an enquiry, request a demo, register on our website, or are set up as a user on our customer portal or mobile applications, you will no longer be anonymous to us.

This personal information may include:

your name and surname;
your email address;
your telephone number;
your company or organisation name and related account details;
your username, password, role, permissions, and authentication details;
your billing, support, and account administration information where applicable; and
any other information you choose to provide in your enquiry or registration.

We will use this personal information to fulfil your account, provide additional services and information to you as we reasonably think appropriate, and for any other purposes set out in this policy.

On order or request

When you order our goods or request our services from us, or when our services are used at a customer site, you may be asked to provide additional information relevant to the service. Depending on the site configuration and the lawful purpose for processing, this may include visitor details, access authorisation details, vehicle details, limited document information, optional mobile numbers freely provided by the visitor, or confirmation that a visitor has read and accepted an indemnity presented on screen where that functionality has been enabled by the customer.

Events

You may provide us with personal information when you attend an event that we host, but this is not a core part of our services, and we will only collect what is reasonably necessary for the event.

From browser

We automatically receive and record Internet usage information on our server logs from your browser, such as your Internet Protocol address (IP address), browsing habits, click patterns, version of software installed, system type, screen resolutions, colour capabilities, plug-ins, language settings, cookie preferences, search engine keywords, JavaScript enablement, the content and pages that you access on the website, and the dates and times that you visit the website, paths taken, and time spent on sites and pages within the website (usage information). Please note that other websites visited before entering our website might place personal information within your URL during a visit to it, and we have no control over such websites. Accordingly, a subsequent website that collects URL information may log some personal information.

Cookies

For information on how we deal with cookies, please refer to our Cookie Policy available at www.accesstrack.co.za/trust-centre.

Web beacons

Our website may contain electronic image requests (called a single-pixel gif or web beacon request) that allow us to count page views and to access cookies. Any electronic image viewed as part of a web page (including an ad banner) can act as a web beacon. Our web beacons do not collect, gather, monitor or share any of your personal information. We merely use them to compile anonymous information about our website.

Optional details

You may also provide additional information to us on a voluntary basis (optional information). This may include content submitted through our website, support requests, optional app permissions, optional photographs, optional mobile numbers, survey responses, or other information you choose to provide when using optional features. Where information is genuinely optional, we will try to make that clear to you.

Through the scanner mobile application

When the Access Track scanner mobile application is used at a customer site, personal information may be collected by scanning an identity document, driver's licence, passport, or vehicle licence disk, by capturing limited details manually, or by retrieving information from a pre-authorised visitor record. The scanner application can also be used to capture a photograph of a person or vehicle where the visitor freely allows this and can collect a mobile number only where it is freely provided by the visitor. Where enabled by the customer, the application may display an indemnity form on screen for the visitor to read and accept.

Manual entry alternative

If a visitor does not want an identity document or driver's licence to be scanned, or does not have the relevant card available, the scanner application can provide a manual entry form that can be completed instead. We aim to support practical alternatives so that personal information collected for access control is adequate, relevant, and not excessive for the purpose.

Recording calls

We may monitor and record any telephone calls that you make to us, unless you specifically request us not to.

Who are our data subjects?

We process the personal information of the following categories of people:

customers and their authorised users, administrators, employees, representatives, and support contacts;
prospects or leads;
visitors, drivers, pedestrians, residents, tenants, contractors, suppliers, and service providers whose information is processed through our access control or visitor management services;
employees and job applicants;
contractors, vendors, or suppliers; and
directors and shareholders.

Purpose for processing

We may use or process goods or services information, access control information, and optional information that you provide to us for the purposes that you indicated when you agreed to provide it to us, or for other lawful purposes compatible with the original reason for collection. We generally collect and process personal information for the following purposes:

goods or services purposes – such as:
- providing and supporting our website, customer portal, scanner application, customer mobile application, and related services;
- managing visitor registration, access authorisations, access logs, and site-specific workflows;
- processing customer requests, incidents, complaints, and support matters;
- maintaining customer accounts, user permissions, billing, reporting, and service administration;
- providing manual entry alternatives, document scanning functionality, optional indemnity acceptance workflows, and related audit trails; and
- improving the reliability, usability, and security of our services;
security and risk management purposes – such as:
- helping our customers manage controlled entry to their sites;
- supporting incident investigation, access dispute resolution, fraud prevention, and abuse detection; and
- protecting our systems, premises, personnel, customers, and users;
business purposes – such as:
- internal administration, finance, audit, governance, training, record keeping, and business planning; and
- managing suppliers, contractors, employees, and prospective customers;
legal and compliance purposes – such as:
- complying with POPIA, PAIA, contractual obligations, lawful requests, and other applicable legal or regulatory requirements; and
- establishing, exercising, or defending legal rights and claims; and
limited marketing purposes – such as responding to enquiries, sending service-related updates, and sending direct marketing where permitted by law and where you have not opted out.

We may use your usage information to:

remember your information so that you will not have to re-enter it during your visit or the next time you access the website or applications;
monitor service performance, reliability, and security;
maintain audit records for account and application activity; and
generate de-identified or aggregated usage statistics.

Consent to collection

We will obtain your consent to collect personal information in accordance with applicable law and when you provide us with any registration information or optional information.

Lawful justifications for processing

Depending on the context, we process personal information because it is necessary to conclude or perform a contract, because it is necessary for our or our customer's legitimate interests in managing security and controlled access, because it is required to comply with law, because you or another competent person have consented where consent is the appropriate justification, or because another lawful justification under POPIA applies. We seek to process personal information in a manner that is specific, lawful, reasonable, and not excessive in relation to the purpose for which it is collected.

When we act for ourselves and when we act for customers

In some cases, Access Track determines the purpose and means of processing personal information for its own business activities, such as operating our website, managing customer accounts, invoicing, support, internal administration, and compliance. In other cases, we provide access control and visitor management technology to our customers and process personal information on their behalf and on their instructions in connection with the customer's site, rules, and workflows. In those cases, the customer remains responsible for ensuring that it has an appropriate lawful basis, notices, permissions, and procedures for the relevant processing, while we implement reasonable measures to process information securely and confidentially in line with our contractual and legal obligations.

Use

Our obligations

We may use your personal information to fulfil our obligations to you, to our customers, and to data subjects whose information is processed through our services, subject to applicable law and the role in which we are acting.

Messages and updates

We may send administrative messages and service updates to you about the website, portal, applications, your account, or the services. Where permitted by law, we may also send limited marketing communications, and you can opt out of those communications where applicable.

Targeted content

We do not sell personal information or disclose personal information to advertisers for their own marketing purposes. Where we use analytics or service improvement tools, we seek to do so in a manner that is appropriate, proportionate, and compliant with applicable law.

Reasons we share personal information

Sharing

We may share your personal information with:

other companies within our group where this is necessary for administration, support, governance, security, or lawful business purposes;
our hosting, cloud, support, communications, payment, technology, maintenance, and other service providers who assist us to provide and secure our services, subject to appropriate contractual controls;
our customers and their authorised users where this is necessary for the operation of the relevant access control or visitor management service;
professional advisers, auditors, insurers, or other parties who require the information for lawful business, compliance, or risk management purposes; and
other third parties where disclosure is required or permitted by law, contract, or a lawful instruction.

Regulators

We may disclose your personal information to regulators, supervisory authorities, or public bodies where required by law, lawful process, audit, or regulatory engagement.

Law enforcement

We may disclose personal information if required:

by a subpoena, court order, or other lawful process;
to comply with any law or lawful request;
to investigate, prevent, or address unlawful conduct, fraud, misuse, or security incidents;
to protect the safety of any individual or the public; and
to enforce our contractual or other legal rights.

No selling

We will not sell personal information. No personal information will be disclosed to anyone except as provided in this privacy policy.

Marketing purposes

We may disclose aggregated or de-identified statistics about service usage or customer populations, provided that this does not identify you personally.

Employees

We may need to disclose personal information to our employees, contractors, and authorised personnel who require it to perform their duties. Access is limited on a need-to-know basis and subject to confidentiality and security requirements.

Change of ownership

If we undergo a change in ownership, or a merger with, acquisition by, or sale of assets to, another entity, we may assign our rights to the personal information we process to a successor, purchaser, or separate entity. We will disclose the transfer on the website. If you are concerned about your personal information migrating to a new owner, you may request us to delete your personal information.

Security

While no environment can be completely secure, we take the security of personal information seriously and implement reasonable technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

Our security responsibilities

We seek to comply with applicable data protection laws by maintaining reasonable safeguards, which may include access controls, authentication measures, audit logging, secure transmission methods, system monitoring, backup and recovery processes, role-based permissions, staff training, and contractual controls with service providers and operators.

Our systems and hosting environments are designed to operate in secure environments using administrative, physical, and technical safeguards that are appropriate to the nature of the information and the risks involved. We authorise access to personal information only for those persons who require it to fulfil their responsibilities, and we maintain measures to help us detect, respond to, and recover from incidents.

Our security disclaimers

Please note the following:

The third parties whose systems we link to are responsible for the security of information while it is collected by, stored on, or passing through the systems under their control.

We will use all reasonable endeavours to ensure that our website and your information is not compromised. However, we cannot guarantee that no harmful code will enter our website (for example viruses, bugs, trojan horses, spyware or adware). You should be aware of the risks associated with using websites.

If you experience a problem or loss that is caused by information you provided to us, your computer being compromised in some way or by something beyond our control, we cannot take responsibility for causing the problem. We will, however, do our best to help you if we can.

Phishing

You must only log in to your account from a page that begins with our domain.

Automated processing and access decisions

Some functions of our services may use rules, matching, or automated workflows to assist with visitor registration, access authorisation, validation of credentials, or other operational steps. Access Track does not currently collect or store biometric visitor data. Where an automated function could materially affect a person, the relevant customer should ensure that appropriate notice, human oversight, and escalation procedures are available where required by law and appropriate to the context.

Accurate and current

We will try to keep the personal information we collect as accurate, current, complete, confidential and reliable for the purposes defined in this policy. From time to time we may request you to update your personal information on the website. You are able to review or update any personal information that we hold on you by accessing your account online, emailing us, or phoning us. Please note that in order to better protect you and safeguard your personal information, we take steps to verify your identity before granting you access to your account or making any corrections to your personal information.

Retention

We will only retain personal information for as long as it is necessary to fulfil the purposes explicitly set out in this policy, or for compatible lawful purposes, unless:

retention of the record is required or authorised by law;
retention is reasonably required for lawful operational, security, audit, incident management, or contractual purposes; or
you or another competent person have consented to the retention of the record.

Retention periods may vary depending on the type of record and the context. For example, website and account records may be kept for the life of the account and a reasonable period thereafter, visitor and access logs may be kept for a limited operational or security period, and incident records may be kept for longer where needed for investigations, claims, or legal obligations. Where information is no longer required, we will delete, destroy, or de-identify it as soon as reasonably practicable, subject to applicable law and any lawful hold.

During the period of retention, we will continue to abide by our non-disclosure obligations and will not share or sell your personal information.

We may retain personal information in physical or electronic records, including secure cloud or hosted environments used by us or our service providers, subject to appropriate safeguards.

Transfer to another country

We may transfer or store personal information outside South Africa where this is necessary for our operations, service providers, support arrangements, or hosting environments. Where we do so, we will take reasonable steps to ensure that the recipient is subject to a law, binding corporate rules, binding agreement, or other mechanism that provides an adequate level of protection consistent with POPIA, or that another lawful basis for the transfer applies.

Your rights

Request what information we hold on you

You may request confirmation of whether we hold personal information about you and, where applicable, request access to a copy or description of the personal information that we hold on you, subject to applicable law and any lawful grounds for refusal.

Updating or removing

You may ask us to correct, update, delete, or de-identify personal information that is inaccurate, incomplete, misleading, unnecessary, excessive, or unlawfully obtained, subject to applicable law and our role in the relevant processing. In some cases, we may need to refer your request to the relevant customer where we process information on that customer's behalf.

Withdrawal of consent or objection to processing

You may withdraw your consent where we rely on consent as a lawful justification to process personal information. You may also object to processing in appropriate circumstances, particularly where processing is based on legitimate interests, subject to applicable law. Please note that if you do so, we or our customer may not be able to provide certain services, permit certain access, or continue particular processing activities.

Complaints

If you believe that your personal information has been processed unlawfully or in a manner that infringes your rights, you may lodge a complaint with us using the contact details set out below. You may also lodge a complaint with the Information Regulator where applicable.

We may need to request additional information from you to verify your identity for you to access these rights. This is to ensure that your personal information is not disclosed to an unauthorised person.

Changes

We may change the terms of this policy at any time by updating this web page. We will notify you of any changes by placing a notice in a prominent place on the website or by sending you an email detailing the changes that we have made and indicating the date that they were last updated. If you do not agree with the changes, then you must stop using the website and our goods or services. If you continue to use the website or our goods or services following notification of a change to the terms, the changed terms will apply to you and you will be deemed to have accepted those updated terms.

Limitation

We are not responsible for, give no warranties, nor make any representations in respect of the privacy policies or practices of linked or any third party websites.

Enquiries

If you have any questions or concerns arising from this privacy policy or the way in which we handle personal information, please contact us via our website at www.accesstrack.co.za, via e-mail to info@accesstrack.co.za or telephonically at 012 001 9930.

Version 2.0 | Last Revised June 2026