Privacy & POPIA Policy

1. Who we are

Logos Risk & Analytics (Pty) Ltd (registration no. 2026/387027/07) ("we", "us", "our") operates FileForge and is the responsible party for the personal information processed through it. Our Information Officer is Thinus Viljoen. You can contact us about privacy or to exercise your rights at info@logosrisk.co.za.

2. What information we collect

• Account information — your name, email address and password (passwords are stored only in hashed form, never in plain text).
• Company and project information you enter to generate a file (e.g. company details, registration number, addresses, project and site details).
• Personal information of the people you appoint or employ that you enter into your safety file (e.g. names, roles and contact details of appointees).
• Signature images and logos you upload.
• Generated files, which contain the information above.
• Payment information — payments are processed by PayFast. We receive confirmation of a payment but do not receive or store your card details.
• Technical and usage data needed to run and secure the Service (such as basic log data).
• Messages you send us through support or contact channels.

3. Why we process it, and our legal basis

We process personal information to:

• provide the Service and generate your files — to perform our contract with you;
• manage your account, process payments and provide support;
• secure the Service, prevent abuse and keep records; and
• comply with our legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Information about other people in your files

Your safety files include the personal information of people you appoint or employ. You are responsible for having a lawful basis to provide that information to us and for informing those people as required by POPIA. We process it only to produce your files, on your instruction, as an operator on your behalf.

5. Who we share it with

We share personal information only with the providers we need to run the Service, and only so they can provide services to us:

• our hosting provider, to store your data on a secured server;
• our payment provider (PayFast), to process payments;
• our artificial-intelligence provider, to generate the document text from your inputs; and
• authorities or advisers where we are required or permitted to do so by law.

We require these providers to protect your information and to use it only to provide services to us.

6. Where it is stored and how we protect it

Your information is stored on a secured server. We apply reasonable, appropriate technical and organisational measures as required by section 19 of POPIA, including encryption of data in transit (HTTPS), hashing of passwords, restricted server access and firewalling. No system is perfectly secure, but we take reasonable steps to protect your information against loss, damage and unauthorised access.

7. Cross-border processing

Some of our providers (for example our payment or artificial-intelligence provider) may process information outside South Africa. Where this happens, we take reasonable steps to ensure your information receives a level of protection consistent with POPIA.

8. How long we keep it

We keep your account and files for as long as your account is active and as needed to provide the Service. Older generated files are removed automatically after a set retention period. On closure of your account we delete or de-identify your personal information within a reasonable period, unless we are required to retain it by law.

9. Your rights under POPIA

Subject to the Act, you have the right to:

• access the personal information we hold about you;
• correct or update it;
• object to, or request deletion or destruction of, your personal information in certain circumstances;
• withdraw consent where our processing is based on consent;
• export a copy of your data (the Service provides a data-export function in your account); and
• complain to us and to the Information Regulator.

To exercise any of these rights, contact info@logosrisk.co.za.

10. Cookies and sessions

We use essential cookies and browser session storage to keep you logged in and to run the Service securely. We do not use advertising or tracking cookies.

11. The Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your personal information lawfully. Their details are available at inforegulator.org.za.

12. Changes to this policy

We may update this policy from time to time. The "last updated" date above shows when it last changed, and material changes will be notified where appropriate.

13. Contact

Information Officer: Thinus Viljoen
Logos Risk & Analytics (Pty) Ltd (reg. 2026/387027/07)
Email: info@logosrisk.co.za