This policy explains how ComplexIT — a product of Harrier Technology Group (Pty) Ltd ("we", "us") — handles personal information under the Protection of Personal Information Act, 2013 ("POPIA"). ComplexIT plays two different roles, and it matters which one applies. Our Terms of Service set out the legal basis for these roles in more detail; this policy explains what they mean in practice.

• As Operator. For information a Complex enters about its own owners, residents, trustees, and staff (unit records, incident reports, contact details, and similar), the Complex is the "Responsible Party" under POPIA: it decides what's collected and why. We are the "Operator", processing that information only on the Complex's behalf and documented instructions, as set out in our Terms of Service. If you're an owner, resident, or trustee with questions about your own Complex's records, your Complex is generally the right first point of contact — we assist them in responding to you.
• As Responsible Party. For information people give us directly, such as filling in the "Request access" form on our website, or a Complex administrator's own account details when we first set up their Complex, we are the Responsible Party and this policy applies to us directly.

Our Information Officer, responsible for POPIA compliance, is Bailey Hoedemaker, who can be reached at legal@complexit.co.za.

On behalf of a Complex (as Operator), ComplexIT's database can hold:

• Staff and trustee accounts: name, email, role, and account/authentication information for complex admins, trustees, and security staff.
• Unit records: unit number, type, and which owner(s) and resident(s) are linked to it.
• Owner and resident records: name, email, account/authentication information, and contact number.
• Security incident records: descriptions, timestamps, and any notes entered by security staff or admins about an incident.
• Trustee records: positions held and terms served.
• Amenity bookings: sign-ups and approvals for shared amenities like a pool or clubhouse.
• Communications: announcements sent through the platform, and the notifications generated by them.
• Device information for push notifications, if a user opts in: a browser-issued subscription identifier, not a phone number or device owner's identity.

Directly from you (where we're the Responsible Party):

• Name, email, and complex name, if you submit our "Request access" form.
• Basic technical information any website collects (e.g. browser type) needed to serve the site correctly. We don't run third-party advertising trackers.

A core part of ComplexIT is letting security staff and admins log incidents at a Complex. These records can include descriptions of events and the people involved, and are inherently sensitive in nature. We process incident records strictly as instructed by the Complex. The Complex is responsible for identifying and documenting an appropriate lawful basis for processing this information — depending on its circumstances, this may include its legitimate interest in maintaining security for its owners and residents, but that isn't automatic and is for the Complex to assess — and for controlling who within the Complex is permitted to view them. We don't independently decide to collect or use incident data beyond what the Complex's staff enter, and we don't use it for any purpose the Complex hasn't authorised.

• To provide the platform: authenticate users, keep each Complex's records separate and accessible only to the right people, and run the features a Complex uses (announcements, security incidents, trustee management, amenity bookings, and so on).
• To send notifications a Complex's staff, trustees, owners, or residents have triggered or are entitled to (e.g. an announcement reaching the owners it applies to).
• To respond to a Complex's support requests.
• To follow up on "Request access" submissions from our website.
• To meet legal obligations, for example responding to a lawful request from the Information Regulator.

We don't sell personal information, and we don't share it with third parties for their own marketing purposes. We use subprocessors to run the platform, currently:

• Amazon Web Services (AWS), to host the platform and database in the af-south-1 (Cape Town) region.
• Resend, to deliver transactional email (e.g. confirming a "Request access" submission), where a Complex or visitor's email address, and the relevant message content, is the personal information shared with them for that purpose.

We choose subprocessors that provide an appropriate level of protection for personal information, and we require them to keep it confidential and secure.

The platform's application data is hosted in South Africa (AWS's af-south-1 region). Some subprocessors we use for specific functions — for example, our email-delivery provider — may process limited personal information (such as an email address and message content) outside South Africa as part of delivering that function. We don't otherwise transfer personal information outside South Africa as part of the normal operation of the service.

For information we hold as Operator, retention follows the Complex's own instructions: we keep it for as long as the Complex's account is active, and delete or anonymise it within a reasonable period after the Complex's account ends or on the Complex's request, except where we're required to keep something for longer by law. Data may persist for a limited additional time in encrypted backups until it is overwritten in the ordinary course of our backup cycle. "Request access" submissions we hold directly are kept only as long as needed to follow up, or until you ask us to delete them.

Each Complex's data is kept logically separate at the database level, not only through application logic, and access controls are designed so that one Complex's staff, trustees, or owners cannot access another Complex's records through the platform in the ordinary course of using it. Access to the platform requires authentication, and administrative access to the underlying systems is restricted to those who need it to operate the service. No system is completely immune to risk, and we continue to review and improve these safeguards as the platform grows.

You generally have the right to:

• ask what personal information is held about you and get a copy of it;
• ask for information that's inaccurate, out of date, or incomplete to be corrected;
• ask for information to be deleted or destroyed where we're no longer authorised to keep it;
• object to processing in certain circumstances; and
• complain to the Information Regulator if you believe your information has been mishandled.

For records held on behalf of a Complex, please contact that Complex first — they're best placed to action the request, and we assist them in doing so. For information we hold directly (see Section 1), contact us using the details below.

South Africa's Information Regulator can be reached at inforegulator.org.za.

ComplexIT uses browser storage to keep you signed in and to remember basic preferences. It doesn't use third-party advertising cookies or trackers.

We may update this policy as the platform changes. For material changes, we'll give reasonable notice — for example, by updating the "last updated" date above and, where appropriate, letting Complexes know directly.

Questions about this policy, or about information we hold directly as Responsible Party, can be sent to legal@complexit.co.za. See also our Terms of Service.