Privacy Policy
Version 1.0 · Effective 20 September 2026
1. Introduction
CSP Logic ("we", "us", or "our") is committed to protecting the privacy and personal information of our users in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA") and other applicable South African data protection laws. This Privacy Policy explains how we collect, use, share, and safeguard your personal information when you use the CSP Logic platform ("the Service").
2. Information We Collect
We collect the following categories of personal information: (a) Account information - name, email address, phone number, job title, and role when you are invited to or register on the Service; (b) Profile information - company name, assigned sites, departments, and permissions configured by your administrator; (c) Activity data - records you create such as incident reports, inspection responses, training records, and audit log entries; (d) Technical data - IP address, device information, browser type, and usage logs collected automatically when you access the Service; and (e) Location data - GPS coordinates captured when you submit field reports, when authorised.
3. How We Use Your Information
We use your personal information to: (a) provide, maintain, and improve the Service; (b) authenticate users and manage access control; (c) process and store HSE records including incidents, inspections, risk assessments, and corrective actions; (d) send service notifications, alerts, and administrative communications; (e) monitor for security, fraud, and compliance purposes; (f) generate reports and analytics for your organisation; and (g) comply with legal obligations under the OHS Act, POPIA, and other applicable regulations.
4. Legal Basis for Processing
In accordance with POPIA, we process your personal information on the following lawful bases: (a) Consent - where you have provided explicit consent for specific processing activities; (b) Contract - processing necessary to provide the Service under our Terms of Service; (c) Legal obligation - processing required to comply with occupational health and safety, labour, and data protection laws; (d) Legitimate interests - processing necessary for security, audit, and operational integrity of the Service. Your organisation, as the responsible party for data within its tenant, must ensure a lawful basis exists for processing personal information of its employees and contractors.
5. Sharing of Information
We do not sell your personal information. We may share your information with: (a) your organisation's administrators and authorised users within the same tenant; (b) our cloud infrastructure and hosting providers who process data on our behalf under data processing agreements; (c) third-party service providers such as email delivery and analytics tools, under strict confidentiality obligations; (d) regulatory authorities, law enforcement, or courts where required by law; and (e) prospective purchasers or partners in connection with a business transaction, subject to confidentiality obligations.
6. Data Security
We implement appropriate technical and organisational measures to protect your personal information, including: encrypted data transmission (TLS/SSL), role-based access control, multi-tenant data isolation, regular security assessments, audit logging of administrative actions, and staff training on data protection. Despite these measures, no system can be guaranteed to be completely secure. We will notify you and the Information Regulator of any security breach affecting personal information as required by POPIA.
7. Data Retention
We retain personal information for as long as your account is active or as necessary to provide the Service. HSE records (incidents, inspections, risk assessments, training records) are retained for the periods required by the OHS Act and other applicable regulations, which may extend beyond account termination. Upon account termination, your organisation may request a data export, after which personal information will be deleted or anonymised within a reasonable period, except where retention is required by law.
8. Your Rights Under POPIA
As a data subject, you have the right to: (a) be notified when your personal information is collected; (b) access and receive a copy of your personal information; (c) request correction or deletion of inaccurate personal information; (d) object to processing of your personal information; (e) withdraw consent for processing that relies on consent; (f) request that your personal information not be used for direct marketing; and (g) lodge a complaint with the Information Regulator. Account deletion can be requested in CSP Logic from My Profile or through our public account-deletion resource at https://csplogic.co.za/account-deletion. Other rights requests may be submitted through your organisation's administrator or support@csplogic.co.za.
9. Special Categories of Personal Information
The Service may process special categories of personal information, including health-related data (e.g., injury records in incident reports), biometric data (e.g., biometric login), and photographic evidence. This information is processed only where necessary for occupational health and safety compliance and with appropriate safeguards. Your organisation is responsible for obtaining necessary consents from data subjects for processing special categories of personal information.
10. Cookies and Tracking Technologies
The Service uses essential cookies and similar technologies to maintain authentication, security, and core functionality. Any optional analytics or marketing technologies will be subject to the choices described in our Cookie Policy before they are enabled. Essential cookies cannot be disabled where they are required for the Service to function securely.
11. Cross-Border Transfers
Your personal information may be processed and stored on cloud infrastructure located outside of South Africa. Where this occurs, we ensure that appropriate safeguards are in place, including standard contractual clauses or other lawful transfer mechanisms as required by POPIA. We will only transfer your personal information to countries that provide an adequate level of data protection or where appropriate safeguards have been implemented.
12. Children's Privacy
The Service is not directed to children under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us so we can take appropriate action.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated through the Service or via email. We encourage you to review this policy periodically.
14. Contact
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@csplogic.co.za or through our Contact page. You may also lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za.