Privacy Policy

Last updated 13 July 2026

GoTecID (Pty) Ltd (“we”, “us”, the “responsible party”) is committed to protecting personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”). This policy explains how we handle personal information in connection with GoTecID™ (“the Platform”).

1. Who we are

The responsible party is GoTecID (Pty) Ltd (Reg. 2026/540097/07), of 250 Blaauwberg Road, Table View, Cape Town, 7441. Our Information Officer is Reghardt Venter, registered with the Information Regulator (registration 2026-061677, 9 July 2026) and contactable at rventer@fintecgroup.co.za or +27 64 584 3869.

2. Scope of this policy

This website is currently informational. We do not collect personal information through sign-up forms, contact forms or pilot registrations on this website. This policy sets out how the Platform will process personal information once operational, and how we handle limited technical information when you visit this website.

Website visitors

When you browse this website, our hosting infrastructure may process limited technical data (such as IP address and basic request logs) for security and availability. We do not use this to identify you and do not run advertising trackers on this site. Fonts and assets are served from this website itself, so no third-party font or content-delivery provider receives your information when you browse.

3. What we do — and do not — do with documents

GoTecID is a consent-driven document sharing platform. It moves documents; it does not verify them, and it does not decide whether a document is genuine or whether a person is who they claim — that remains the receiving organisation’s responsibility. Uploaded documents are held as encrypted files that we do not read: in POPIA terms, we are the custodian of sealed envelopes, not a reader of their contents. Health documents, where uploaded, are treated as opaque files and never parsed into structured special personal information.

4. The personal information we process

When the Platform is operational, and only where you choose to use it, we may process: the account details you provide; the documents you upload (held encrypted); records of the access you grant and the shares you make; and account and technical logs needed to operate the service securely. We apply the principle of data minimisation: we process the least information necessary for the purpose.

5. Why we process it (purpose & lawful basis)

• To provide the upload, storage and controlled-sharing functionality you request — on the basis of your consent and/or performance of our agreement with you.
• To record and honour the access permissions you set, and to maintain your audit trail — core functions of the service.
• To keep the service secure and available, and to meet our legal obligations.

Where we rely on consent, you may withdraw it at any time; this does not affect processing carried out before withdrawal.

6. The eight conditions for lawful processing

We process personal information in line with POPIA’s eight conditions: accountability; processing limitation (including minimality and consent); purpose specification; further-processing limitation; information quality; openness; security safeguards; and data-subject participation.

7. Our operator

We use Supabase as our infrastructure and database operator (a POPIA “operator” / processor), which processes personal information on our documented instruction under a written agreement requiring appropriate security safeguards and confidentiality. Some processing by our operator may take place outside South Africa; where it does, we take the steps POPIA requires for lawful trans-border processing.

8. Sharing with organisations

The Platform is designed so that you control disclosure. Documents are shared only where you grant a specific, consented share, and are viewed under watermarked, view-only conditions and not redistributed. Where an organisation is on the network, an Operator Agreement governs its handling of information received through GoTecID. We do not sell personal information and do not share it for third-party marketing.

9. Security safeguards

We maintain technical and organisational measures appropriate to the risk, including encryption of stored documents, watermarked view-only access, role-based access, and an immutable audit trail of every access. No system can promise absolute security; our commitment is to minimise exposure and handle information accountably. Independent security review is a mandatory gate before any real user documents are processed. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

10. Retention and deletion

We keep personal information only as long as necessary for the purpose, or as required by law, after which it is deleted or de-identified. Applicable retention periods depend on the data and the law that governs it — for example, FICA / Tax Administration Act records (typically 5 years), Companies Act records (typically 7 years) and employment records under the BCEA (typically 3 years); everything else is purpose-bound under POPIA. These periods are presented as guidance, not legal determination. When a retention period ends, GoTecID can remind you and draft a deletion request for you to review and send — supporting your POPIA right to request deletion.

11. Your rights

You have the right to: be told what personal information we hold; request access to it; request correction or deletion of information that is inaccurate, irrelevant, excessive or out of date; object to processing; and, where applicable, withdraw consent. To exercise any of these, contact our Information Officer at rventer@fintecgroup.co.za.

12. Complaints to the Regulator

If you believe we have interfered with your personal information, you may lodge a complaint with the Information Regulator:

13. Changes

We may update this policy as the Platform develops. The “last updated” date above reflects the current version.