1. Introduction and applicability
This policy explains how Cyber Doc handles personal information relating to its website, enquiries, business relationships and authorised services. It addresses South Africa’s Protection of Personal Information Act, 2013 (POPIA) and the General Data Protection Regulation (GDPR) where that regulation applies. It does not represent a certification of regulatory compliance.
Cyber Doc is responsible for deciding how its own enquiry, administration and business records are used. In that context it acts as a responsible party under POPIA or a controller under the GDPR. When handling information solely on a client’s documented instructions, it acts as an operator or processor. The client remains responsible for its own purposes, lawful authority and notices; the engagement terms define each party’s duties.
2. Who we are
Cyber Doc provides cybersecurity consulting services in South Africa. Its registered enterprise name is CYBER DOC, a South African close corporation (CC), registration number 1999/001192/23, originally registered on 13 January 1999. The entity is referred to as Cyber Doc CC in this policy.
Privacy enquiries: eddie@cyberdoc.co.za. Website: https://cyberdoc.co.za/.
Business correspondence address: Available upon request via eddie@cyberdoc.co.za.
3. Personal information we may handle
Depending on the relationship and service, information may include names, business affiliations, contact details, enquiry content, correspondence, contractual and invoicing records, and information supplied during an engagement. Technical records may contain device identifiers, IP addresses, account identifiers, timestamps or activity records. Do not send passwords or unnecessary sensitive information through the website enquiry form.
Information may come directly from you, an authorised client representative, systems within an agreed engagement scope, or service providers supporting the relationship. Where information comes from another source, additional notice may be required unless a lawful exception applies.
4. Website enquiries and communications
The website form asks for your name, email address, subject and message. A cell number is optional for ordinary enquiries and required when you select an urgent Incident Response request. The form also records that selection. Required details enable Cyber Doc to respond; without them the form cannot submit a complete enquiry.
The website handler prepares an email to help@cyberdoc.co.za with the submitted details and uses your email address as the reply address. Urgent requests are marked in the email subject. Afrihost provides Cyber Doc’s website hosting and business email hosting. Enquiries are processed through that website and business email infrastructure; actual delivery depends on those services. Selecting the urgent option does not itself establish that a responder has received or acted on the message.
Enquiry information is used to consider your request, communicate with you, arrange services and maintain relevant business records. A privacy notice is not a request for blanket consent to unrelated marketing.
5. Purposes and lawful grounds
Processing purposes may include responding to enquiries, taking steps towards or performing an agreement, delivering authorised services, administering accounts, meeting legal obligations, protecting systems and handling disputes. Each activity needs a lawful ground appropriate to the circumstances.
Depending on the activity, grounds may include contractual necessity, a legal obligation, consent, or legitimate interests balanced against the individual’s rights. Relevant interests may include responding to business requests, securing services and establishing or defending legal claims. Consent is used where required and may be withdrawn without affecting prior lawful processing. Special information requires an additional lawful justification; a general business purpose alone is insufficient.
This policy does not provide a basis for automated decisions with legal or similarly significant effects. Any such processing or new marketing activity would require a separate assessment and appropriate notice before use.
6. Authorised consulting and cybersecurity engagements
Work within an agreed scope may encounter personal information in client records, accounts, logs, correspondence or evidence. Access must remain within the client’s authority and the engagement’s lawful purpose. The working approach should limit collection and reporting to what is relevant, with unnecessary identifying details omitted or obscured where practical.
When Cyber Doc acts on a client’s behalf, instructions, confidentiality, access, subproviders, security, incident reporting and return or deletion of information must be addressed in the engagement arrangements. Independent legal duties may still require limited retention or disclosure. Finding exposed personal information during an assessment does not, by itself, establish that a legally notifiable breach has occurred.
7. Minimisation and confidentiality
Only information relevant to a defined purpose should be requested or retained. Access should be limited to authorised people who need it for that purpose and are subject to appropriate confidentiality duties. Please provide the minimum necessary detail and agree a suitable transfer method with Cyber Doc before sharing sensitive engagement material.
8. Operational applications and backups
Personal information may be handled through applications used in its operations for the purposes described in this policy. Operational backup and recovery arrangements must be limited to necessary information and authorised access. Any cloud storage provider must be approved before information is transferred to it, with appropriate consideration of confidentiality, provider terms, storage locations, recovery and deletion.
This policy does not identify a separate operational cloud backup provider as currently in use. Backup and recovery handling depends on the applicable arrangements and the information involved. No particular encryption standard, certification or automated deletion functionality is represented as verified.
9. Service providers and lawful disclosures
Afrihost provides the website and business email hosting used to process website requests, enquiries and communications. Those services may process contact details, message content and technical records needed to support hosting, email delivery and security. This policy does not assume Afrihost’s internal processing locations, subcontractors, security controls or retention periods.
Any additional provider must be assessed and approved for the relevant purpose before receiving information. Providers processing information on instructions require appropriate confidentiality, security and processing arrangements. Disclosures may also be necessary under a binding legal requirement, your lawful instruction, or for establishing or defending legal claims. Disclosures must be limited to what is necessary and lawful.
10. International transfers
Cloud, hosting or communication services may process information outside South Africa or the country where it was collected. Before such processing, the locations, recipients and applicable legal transfer conditions must be established. POPIA section 72 and, where relevant, GDPR Chapter V require an appropriate transfer basis.
Depending on the law and circumstances, this may involve adequate protection, suitable contractual safeguards or another permitted ground. Provider terms alone do not prove that a transfer is lawful. No particular overseas processing destination, adequacy decision or contractual transfer mechanism is represented here as verified or already implemented. You may contact the privacy address for information about transfer arrangements relevant to your information.
11. Security and privacy incidents
Safeguards must be proportionate to the information, purpose and risk. The measures appropriate to an engagement depend on the information, agreed scope and risks; no system can guarantee absolute security. This policy does not certify any particular technical control. If you suspect misuse involving information supplied to Cyber Doc, contact the business promptly and avoid including additional sensitive evidence in an ordinary email.
A suspected incident needs assessment of the facts, affected information, parties’ roles and applicable notification thresholds. Where Cyber Doc is an operator or processor, the responsible client must be informed as required by law and the engagement terms. Where Cyber Doc has its own notification duty, the relevant regulator and affected people must be notified within the applicable requirements. Under GDPR, a controller’s supervisory-authority notification may be required within 72 hours of awareness unless the risk exception applies; notice to individuals has a separate high-risk threshold. Under POPIA section 22, reasonable grounds to believe that personal information was accessed or acquired by an unauthorised person trigger notification to the Regulator and, subject to the statutory exceptions, the affected people as soon as reasonably possible after discovery. An operator must notify the responsible party immediately under section 21. POPIA does not use the GDPR risk exemption. No automated regulatory reporting or detection capability is asserted.
12. Retention, deletion and recovery copies
Cyber Doc retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including responding to enquiries, delivering services, maintaining necessary business records, and meeting applicable legal or contractual obligations.
Website enquiries that do not result in an engagement are reviewed after twelve months from the last substantive contact. Information that is no longer required is ordinarily deleted. Where continued retention is justified, it may be archived with restricted access, with the general reason recorded and a subsequent review arranged. Archived enquiries must not remain indefinitely without review. Archiving is continued retention and processing; it is not deletion.
Enquiries that become client engagements are handled as client records. Client, contractual, financial and security-related information may be retained for different periods according to applicable legal requirements, contractual terms, the nature of the information and legitimate preservation needs. There is no universal twelve-month deletion rule. Accounting, contractual and legal records require category-specific retention decisions. Assessment evidence requires separate retention and deletion arrangements appropriate to the engagement; the website-enquiry review period does not apply to that evidence.
Deletion or secure destruction is a separate action from archiving. A legal, contractual or evidentiary preservation obligation may justify retaining relevant records for longer, with access restricted and the need reviewed. Ordinary deletion does not require an additional de-identification process where deletion is appropriate.
Backup copies are managed under applicable recovery and retention arrangements. Unnecessary copies in email clients, exports and backups should be avoided. Deletion from an active mailbox does not necessarily remove hosting or recovery copies immediately. The timing of deletion from recovery copies depends on the applicable provider and recovery arrangements. Retained recovery copies remain subject to lawful purpose and access restrictions; a restore must not become a reason to resume unnecessary use of previously deleted information. Automatic deletion or immediate erasure from every copy is not promised.
13. Cookies, analytics and technical logging
The reviewed website source contains no analytics or advertising tracker and sets no browser cookies or local-storage records. Ordinary page content and imagery are served by the website. Social links open external services whose own policies apply when you visit them.
Website access and security logs may contain IP addresses, request times, requested resources and related technical information used to operate, troubleshoot and protect the website. Afrihost provides the hosting infrastructure. Log information should be retained only as reasonably necessary for those purposes or an applicable preservation requirement, with restricted access and periodic review.
Removal of an account’s archived access logs does not establish deletion of all underlying server, email, security or backup logs. Provider-managed logging and recovery copies can have different retention arrangements from account-level archives. No single monthly deletion period or indefinite-retention period is asserted for all logs. The source-level description above does not establish whether hosting infrastructure adds cookies or tracking; you may contact the privacy address about hosting-level processing. Any later non-essential cookies or tracking must be assessed and disclosed, with consent where required, before activation.
14. Your privacy rights
Subject to the applicable law and its exceptions, you may request confirmation of processing, access, correction or deletion, object to certain processing, and withdraw consent where it is the basis used. Where GDPR applies, rights may also include restriction and data portability in the circumstances defined by that regulation. These rights are not all unconditional.
Send requests to eddie@cyberdoc.co.za, marked “Privacy request”. Cyber Doc may need proportionate information to verify your identity and authority, without collecting unnecessary documents. Requests must be assessed within applicable legal time limits; any lawful refusal or permitted fee should be explained. For information processed on a client’s behalf, Cyber Doc may refer the request to, or assist, the responsible client.
15. Children and sensitive information
The website presents business services and is not directed at children. Do not submit a child’s information or sensitive personal information through an ordinary enquiry unless it is necessary and an appropriate lawful arrangement has first been agreed. Engagements that involve children’s information, POPIA special personal information or GDPR special-category or criminal-offence data require specific authority, safeguards and an appropriate legal basis.
16. Changes to this policy
Material changes to purposes, providers, permissions or handling practices require a review of this policy and, where necessary, a fresh notice or authorisation before the change is introduced. The last-updated date above identifies the current revision. Changes will be reflected on this page; material changes may also require a separate notice to affected people.
17. Privacy contact and complaints
Privacy enquiries for Cyber Doc CC (registered enterprise CYBER DOC, registration number 1999/001192/23) should be sent to eddie@cyberdoc.co.za. Please mark privacy concerns clearly and describe the issue without sending passwords or unnecessary sensitive information. Business correspondence address: Available upon request via eddie@cyberdoc.co.za.
You may complain to South Africa’s Information Regulator; its contact page provides current channels. Where GDPR applies, you may also complain to the competent supervisory authority, including in the country of your habitual residence, work or the alleged infringement. Contacting Cyber Doc first does not remove those rights.