Privacy Policy

This policy explains what personal information we collect, why we collect it, who we share it with and what you can do about it. It is written in terms of the Protection of Personal Information Act 4 of 2013, which South Africans generally call POPIA.

1. Who is responsible

Ocalt (Pty) Ltd is the responsible party for the personal information described in this policy.

• Company: Ocalt (Pty) Ltd
• Registration number: 2025/771151/07
• Information Officer: Zimkhitha Ndlovu, Chief Financial Officer
• Information Officer email: zimkhitha@ocalt.com
• General email: info@ocalt.com
• Telephone and WhatsApp: +27 77 433 3156

2. Who this applies to

This policy applies to visitors to ocalt.co.za, people who submit an enquiry to us, our clients and their representatives, our suppliers, and applicants for work with us. Separate arrangements apply where we process personal information on behalf of a client, which is dealt with in section 9.

3. What we collect

From website visitors

• IP address, browser type and version, device type, operating system
• Pages visited, time of visit, referring page
• Cookie identifiers, where cookies are in use

From people who enquire

• Name, job title, employer or organisation name
• Email address, telephone number, preferred contact method
• Information you choose to give us about your organisation: number of branches, staff numbers, locations, the systems you run, how IT is currently handled, and free-text notes
• The indicative estimate generated from your answers

From clients

• Contact details of your nominated representatives and authorised approvers
• Billing details, banking details for payment, VAT and registration numbers
• Records of support tickets, correspondence, meetings and site visits
• Technical records: asset registers, device identifiers, account names, access logs, network configuration

From applicants

• CV, qualifications, employment history, references and right-to-work information

We do not seek special personal information as defined in POPIA, and we ask you not to include health, religious, biometric, trade-union, political or criminal-record information in a free-text field unless we have specifically asked for it and explained why.

4. How we collect it

Directly from you, when you complete the quote builder, email us, message us on WhatsApp, telephone us or meet us. Automatically, from your device when you browse this website. From third parties, such as public company registries, credit references where we extend payment terms, and referees you nominate. Where we collect from a source other than you and POPIA requires it, we will tell you.

5. Why we process it

• To respond to your enquiry and prepare a scope of work, quotation or proposal
• To conduct a technical assessment of your environment
• To enter into and perform a service agreement with you
• To deliver support, respond to incidents and dispatch engineers to your sites
• To invoice you, collect payment and keep accounting records
• To maintain the security of the systems we manage and to investigate incidents
• To meet legal, tax, regulatory and audit obligations
• To improve this website and our services
• To send you service communications, and marketing where you have agreed to receive it
• To assess applicants for employment

6. Our lawful basis

We process personal information where one or more of the grounds in section 11 of POPIA applies:

• Consent - for example, optional marketing communications
• Performance of a contract - to deliver the services you have engaged us for
• Legal obligation - tax, companies and financial record-keeping
• Legitimate interests - responding to enquiries, securing our systems, recovering debt, and improving our services, balanced against your rights

7. The quote builder

The step-by-step builder on this website runs entirely in your browser. Your answers are not transmitted to us while you move through the steps, and the estimate is calculated on your own device. Nothing reaches us until you choose to send it, by pressing the WhatsApp, email or copy control on the final step. If you close the page before that, nothing is sent and nothing is stored by us.

The estimate is a calculation, not a decision about you within the meaning of section 71 of POPIA. No decision affecting you is made automatically. A person at Ocalt reviews every enquiry.

8. Cookies and analytics

This website is built to work without tracking cookies. Where we introduce analytics or advertising cookies, we will publish the detail here and request your consent before any non-essential cookie is placed.

• Strictly necessary cookies keep the site functioning and secure. These do not require consent.
• Analytics cookies, if used, tell us which pages are visited and where people leave. Consent required.
• Marketing cookies, if used, measure the performance of advertising. Consent required.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may break parts of the site.

9. When we act as an operator

When we manage your IT environment, we necessarily come into contact with personal information belonging to your employees, customers and suppliers. In respect of that information you are the responsible party and we are an operator.

• We process it only on your documented instructions and only to deliver the services.
• We do not use it for our own purposes and we do not sell it.
• We apply appropriate, reasonable technical and organisational measures to secure it.
• We bind our personnel and subcontractors to confidentiality.
• We notify you without undue delay where we reasonably believe it has been accessed or acquired by an unauthorised person, so that you can meet your own notification obligations under section 22 of POPIA.
• On termination we return or securely destroy it, as you instruct, subject to any retention the law requires.

Where required, this is recorded in a written operator agreement forming part of your service agreement.

10. Who we share it with

We share personal information only where it is necessary, and only with:

• our employees and contracted engineers who need it to do the work
• subcontractors and specialist partners engaged to deliver part of a service, under written confidentiality obligations
• service providers we use to run our own business: email and productivity platforms, hosting and cloud providers, accounting and invoicing software, ticketing and monitoring tools, WhatsApp Business messaging
• professional advisers, such as auditors, attorneys and insurers
• regulators, courts and law enforcement where the law requires it
• a purchaser or successor, if our business or part of it is sold, subject to equivalent protection

We do not sell personal information, and we do not share it with third parties for their own marketing.

11. Transfers outside South Africa

Some of the platforms we use to run our business store data outside South Africa. Where personal information is transferred across a border, we do so in accordance with section 72 of POPIA, on the basis that the recipient is subject to a law, binding corporate rules or a binding agreement providing an adequate level of protection, or with your consent, or because the transfer is necessary to perform a contract with you.

12. How we secure it

• Encryption of data in transit, and at rest where the platform supports it
• Multi-factor authentication on administrative accounts
• Role-based access, granted on a need-to-know basis and reviewed regularly
• Endpoint protection and patch management on our own devices
• Logging, monitoring and alerting on systems we control
• Written confidentiality undertakings from personnel and subcontractors
• A documented incident response process

No control set is perfect. If a compromise occurs affecting your personal information, we will notify you and the Information Regulator as POPIA requires.

13. How long we keep it

• Enquiries that do not become clients: up to 24 months, then deleted
• Client records and correspondence: for the duration of the agreement and 5 years afterwards
• Accounting and tax records: at least 5 years, as required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011
• Support tickets and technical logs: 24 months, unless needed longer for a security investigation
• Unsuccessful job applications: 12 months, unless you ask us to keep them longer

Where information is no longer needed and no law requires us to keep it, we delete it or de-identify it.

14. Your rights

Under POPIA you have the right to:

• be told what personal information we hold about you, and to receive a copy of it
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
• object, on reasonable grounds, to our processing of your information
• withdraw consent where our processing relies on consent, without affecting processing already carried out
• object to direct marketing at any time
• not be subject to a decision based solely on automated processing that has legal consequences for you
• complain to the Information Regulator
• institute civil proceedings for a breach of your rights under POPIA

To exercise a right, email the Information Officer at the address in section 1. We may ask for proof of identity. POPIA prescribes Form 2 for access requests and Form 3 for objections; we will accept a plain written request and assist you with the prescribed form if one is needed. We respond within a reasonable time, and within any period the law prescribes.

15. Direct marketing

We send electronic marketing only where you are an existing client in respect of similar services, or where you have consented. Every marketing message identifies us and includes a way to opt out. Opting out is free and takes effect promptly. Section 69 of POPIA limits us to a single request for your consent if you are not already a client and have not previously refused.

16. Children

This website and our services are directed at organisations and adults. We do not knowingly collect personal information of a child as defined in POPIA without the consent of a competent person. If you believe we hold such information, contact the Information Officer and we will delete it.

17. Complaints

Raise a concern with our Information Officer first - we would rather fix it directly. If you are not satisfied, you may complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Website: https://inforegulator.org.za

The Regulator publishes its current postal address, email addresses and complaint forms on its website.

18. Access to information

The Promotion of Access to Information Act 2 of 2000, known as PAIA, gives you the right to request access to records held by Ocalt (Pty) Ltd where the record is required for the exercise or protection of a right.

• Information Officer: Zimkhitha Ndlovu, contactable at zimkhitha@ocalt.com
• PAIA manual: available on request from the Information Officer
• How to request: submit the prescribed form to the Information Officer, describing the record and the right you seek to exercise or protect
• Fees: prescribed request and access fees may apply, as published by the Department of Justice
• Response: we respond within the period prescribed by PAIA, and give reasons where a request is refused

19. Changes and contact

We may update this policy. The current version is always published at this address, with the effective date at the top. Where a change materially affects how we handle your information, we will bring it to your attention.

Contact us about privacy:

• Information Officer: Zimkhitha Ndlovu, zimkhitha@ocalt.com
• General: info@ocalt.com
• WhatsApp or phone: +27 77 433 3156