Privacy notice | SYS24

Document version: 87 · Prepared 20 October 2026. This notice explains personal-information processing connected with SYS24 websites, client and admin portals, business software, hosting, managed IT and related services. It is intended to be read with the accepted order and any operator or data-processing agreement. We aim to handle information lawfully and transparently under South Africa's Protection of Personal Information Act (POPIA) and other applicable law.

1. Who is responsible

The supplier identified on your order or invoice operates under the SYS24 brand. For our own enquiries, customer accounts, billing, support, security and supplier management, we generally determine the purpose and means of processing and act as the responsible party. For records that a business customer controls in its CRM, Dignityflow, Workmin, website forms, payroll or hosted application, that customer is generally the responsible party and we act as an operator on its authorised instructions. The actual role depends on the activity, not simply the product name.

If your information was entered by a business using our software, contact that business first about its records, purposes and decisions. We will assist it under our agreement and the law. For SYS24's own processing or uncertainty about the correct contact, email contact@sys24.tech with the subject “Privacy / Information Officer”. We will route the request to the appropriate person. Our legal and contact particulars are available on your order, invoice or official contact page.

2. Information we may handle

• Account and contact information: names, business details, email, telephone, address, country, account identifiers, authorised users, role permissions and correspondence.
• Billing and service records: quotes, invoices, subscriptions, licences, domains, orders, payment references, transaction status, bank details needed for EFT or approved payouts and tax-related information. Processor tokens and masked card details may be retained where a supported payment setup is used. Card-entry information is handled through the relevant processor's flow; do not send complete card data or CVV in support messages.
• Website and technical records: IP addresses, session identifiers, device and browser information, security and access logs, form submissions, cookie preferences, permitted analytics and records needed to investigate abuse or errors.
• Support and managed-service information: tickets, attachments, authorised remote-session details, device identifiers, configuration records, diagnostic material and agreed maintenance reports.
• Customer-controlled workspace content: leads, contacts, members, beneficiaries, dependants, claims, identity details, photographs, bank information, verification reports, payroll, payslips, rates, attendance, HR documents, messages, webhook submissions and other records a customer chooses to process using purchased features.

Not every service collects every category. Identity documents, photographs, children's details, biometric-related processing and other sensitive records need particular care and, where relevant, the additional lawful conditions required by POPIA. Do not upload information that is unnecessary for the intended service.

3. Sources and purposes

Information comes from you, your authorised users, a business customer controlling a workspace, forms you submit, supported integrations and service providers involved in a requested transaction. Domain or verification data may come from registries and authorised source providers. We use information as necessary to respond to enquiries, create and secure accounts, fulfil orders, provision services, maintain entitlements, reconcile payments, deliver service notices, support users, prevent fraud, investigate incidents, comply with law and resolve disputes.

We identify an appropriate lawful basis for each activity, such as contract performance, a legal obligation, consent where required or a legitimate interest assessed against your rights. We do not treat accepting general terms as unlimited permission for unrelated processing. Required fields are identified in the relevant process; failing to provide information essential to a service may prevent us from supplying it. Optional choices should not be presented as compulsory without justification.

4. Customer workspaces, verification and employment records

A customer controlling workspace data must have authority to collect it, give appropriate privacy notices, choose lawful purposes, restrict staff access and ensure accuracy. It must meet any special requirements for children, special personal information, identity checks, employment records and automated decisions. Enabling a module or buying credits does not itself establish that authority.

When instructed to perform verification, the selected method may send the minimum required identity, country, photograph, bank or other details to the configured verification provider. Results and reports can be saved in the workspace for authorised review and appropriate reuse, avoiding unnecessary repeat requests. A saved report may become outdated; the customer must assess when a fresh check is necessary and when the report should be deleted. Claims, bank payments, hiring or benefit decisions remain the customer's responsibility and require suitable review and lawful safeguards.

Webhook endpoints can collect website enquiries into a customer's leads. The customer must secure its endpoint credentials, provide notices on its forms and avoid transmitting unnecessary sensitive fields. HR, payroll and attendance settings must be disclosed appropriately to staff and used lawfully; login activity is not automatically reliable evidence of hours worked. We do not use operator access to customer records as permission for our own unrelated marketing.

5. Recipients and service providers

Information is available only to authorised personnel and providers who need it for the relevant purpose, subject to appropriate contractual and security controls. Depending on the services actually enabled, recipients may include hosting and infrastructure providers, registrars, email and SMS providers, SMSPortal, VerifyNow, PayFast, Whop, Paystack, authorised support personnel, professional advisers and a customer's chosen integrations. These names do not mean every provider receives every record. Some suppliers act as independent responsible parties for their own regulated activities, such as payment processing; review their notices as well.

We may disclose information when legally required, to protect lawful rights or investigate serious abuse, using a lawful and proportionate process. Corporate or service transfers require appropriate safeguards and notices. We do not authorise disclosure of customer-controlled records for an unrelated recipient's marketing merely because the records are hosted in our software.

6. International processing

Cloud infrastructure, support and API suppliers may process information outside South Africa. We assess applicable cross-border requirements and use an appropriate permitted basis, such as adequate protections, binding contractual safeguards or another lawful ground. We do not promise that every configured provider or backup is located only in South Africa. Business customers with location restrictions must disclose them before ordering so that suitable service boundaries can be agreed.

7. Cookies, sessions and anti-abuse tools

Essential cookies and server-side session records support login, security, form protection, cart continuity and preferences. Logs can assist fraud detection and rate limiting. Where enabled, tools such as Google reCAPTCHA can process technical and interaction data to assess abuse, under the relevant provider's privacy terms. Optional analytics, embedded content, reviews or marketing technologies may involve additional providers and choices. We will seek consent where required and explain relevant choices; a basic cookie acknowledgement is not a substitute for consent where the law requires it.

You can use browser controls to manage cookies, but blocking essential cookies may prevent authentication, checkout or form submission. Avoid shared devices for sensitive work, sign out when finished and do not share session links or API credentials.

8. Communications and marketing

Service messages can include security alerts, invoices, payment confirmation, renewal, suspension, reinstatement-fee and maintenance notices needed for the service or legal obligations. Marketing is handled separately under applicable direct-marketing rules, including consent or another permitted basis and appropriate opt-out opportunities. An opt-out from marketing does not necessarily stop essential service or legal notices. Tell us if a message appears to have been sent in error.

9. AI and automated processing

If an AI or automation feature is enabled, data handling depends on that feature and its configured provider. Customers should minimise personal information, check provider terms and avoid submitting confidential or sensitive records without appropriate authority and safeguards. AI-generated content and verification results require review and can be inaccurate. We do not treat a product's availability as permission to make a decision with legal or similarly significant effects solely through automation contrary to applicable law. Ask about data flow and human-review options before using a feature for a high-impact purpose.

10. Retention, backups and deletion

We retain information for as long as reasonably necessary for the purpose, the agreement, applicable recordkeeping duties, legitimate dispute or security needs and lawful preservation obligations. Different records require different periods; we do not promise a single deletion period for all services. Workspace retention and exports should be agreed with the customer controlling the data. Closing an account does not necessarily require immediate deletion of tax invoices, verified transaction records or evidence we must lawfully retain.

Deletion from active systems may be followed by expiry from protected backups under the applicable backup cycle. Recovery copies are restricted and used for recovery or other authorised purposes, not ordinary access. When restored, appropriate deletion requirements must be reapplied where relevant. Request export and confirm retention before cancellation, because deleted or expired resources may not be recoverable. We will explain any lawful reason for retaining information when responding to a request.

11. Safeguards and incidents

We apply reasonable organisational and technical safeguards appropriate to the risks, including controlled access, supported authentication and session handling, permission checks, private storage where appropriate, operational logging and suitable change and recovery procedures. Customers must also protect endpoints, user privileges and credentials. No online system can guarantee absolute security.

We investigate suspected unauthorised access and take reasonable containment and recovery steps. We notify the relevant responsible party and make notifications to affected people or the Information Regulator as required by law, taking account of lawful investigation requirements. Operators and customers must cooperate under their agreement so that the correct party can meet its duties. Report suspected exposure promptly through Help or the privacy contact without sending additional sensitive records unnecessarily.

12. Your rights and requests

Subject to applicable law and appropriate identity verification, you may ask whether we hold your information, request access, correction or deletion, object to certain processing, withdraw consent for future consent-based processing, challenge accuracy and raise a complaint. Rights can be limited by lawful recordkeeping, other people's rights, confidentiality, legal privilege or other statutory grounds. Withdrawing consent does not invalidate lawful earlier processing or remove a separate lawful obligation.

Tell us the service, relationship and information concerned so that we can find the correct records. We will not require excessive identity data and will explain any applicable lawful fee, refusal or limitation. For customer-controlled workspace records, we may need to route the request to that customer rather than disclose its records directly. Do not send passwords or complete card details with a request.

13. Complaints and changes

Contact contact@sys24.tech with “Privacy / Information Officer” to raise a concern. You may also complain to South Africa's Information Regulator through its official channels at inforegulator.org.za. You do not have to waive regulatory or legal remedies to use our services. We may update this notice as services and legal requirements change; material changes will be communicated as required. A new notice does not retrospectively authorise incompatible processing or remove rights.