← Back to Home

Legal

Data & Compliance

A plain description of how we handle personal information, the controls we operate, and what we will and will not claim to you.

1. Our commitment

Kirov Dynamics Technology (Pty) Ltd processes personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA). Our default is to collect as little as possible, keep it only as long as we have a reason to, and to be able to explain who has access to it.

This page describes that approach in detail. Where a service we operate for a client is concerned, the signed agreement is the document that commits us to specific controls, and that agreement is what we are measured against.

2. How we apply the POPIA principles

Principle	What it means in practice here
Accountability	We name an Information Officer internally and can show our procedures on request.
Purposeness	Information is collected for a stated purpose only, and we do not quietly repurpose it.
Minimality	We ask only for what the task actually needs. Our own website collects nothing automatically at all.
Correctness	We keep records you can ask us to correct, and we correct them on request.
Openness	We publish how we handle information: see the Privacy Policy.
Purpose limitation	We do not use client or prospect information for unrelated purposes or marketing lists.
Security safeguards	See section 4.
Retention	Records are kept only as long as a purpose or a legal duty requires, then deleted or anonymised.
Prohibition on unauthorised disclosure	Access is limited to people who need it, under confidentiality obligations.

3. Data we handle on a client's behalf

Under a Kirov Care or build engagement we may process personal information belonging to our client's customers, staff or citizens, such as names, contact details, identity numbers, account records, service histories or complaint records. In that situation the client is usually the responsible party and we act as its operator. Our commitments are then set out in the agreement, and include:

• processing personal information only on the client's documented instructions;
• restricting access to named personnel who need it for the contracted purpose;
• not using the client's data to train general models, to benchmark, or for our own commercial purposes;
• flowing the same obligations down to any sub-processor we use;
• assisting with a data subject's access, correction or deletion request;
• returning or securely deleting the data when the engagement ends.

4. Security practices

The measures below are the ones we actually operate, and they apply to systems we manage under Kirov Care. They are proportionate controls, not a claim of certification.

Access control

• unique, named accounts only, with no shared logins;
• multi-factor authentication on administrative and remote access;
• least-privilege permissions, reviewed and reduced when a role changes;
• joiners, movers and leavers handled promptly, with access removed on the day someone leaves;
• administrative access logged and periodically reviewed.

Technical

• TLS for data in transit, including backups transferred off-site;
• encryption at rest on systems holding client data;
• automated backups with restore testing, so a backup is known to work rather than assumed to;
• patching and vulnerability management on operating systems, applications and dependencies;
• malware protection, secure configuration baselines, and separation of production from development;
• logging and monitoring sufficient to investigate an incident, retained for an agreed period.

Physical and organisational

• supplier and hosting providers held to written security and confidentiality terms;
• confidentiality obligations in every contract with staff and contractors;
• an incident response procedure to contain, investigate and report an incident;
• staff awareness and secure-development training.

5. Incident response

If we detect a suspected or confirmed personal information breach we will contain it, establish what was affected and who, preserve the evidence, and notify the responsible party without undue delay. Where we are ourselves the responsible party and the breach is likely to harm an individual's rights, we will notify the affected individuals and the Information Regulator, and provide the information the Regulator requires, within the timeframes POPIA allows. Notification itself is never a reason to delay containment.

6. Data residency and cross-border processing

Where we can, we host a client's data in South Africa, or in the region the client requires. Some managed platforms are only available in other jurisdictions, and we will say so plainly in the proposal rather than after the fact. In those cases the transfer is governed by a written agreement, security undertakings and, where required, standard contractual clauses. Data can be requested back in a portable format rather than being held hostage to a platform.

7. Sector and statutory obligations

Some data carries obligations beyond POPIA. In South Africa these commonly include:

• Public bodies working with citizens' personal information, who must meet POPIA's special requirements and are accountable to Parliament;
• Health information, which is special personal information and carries additional protection;
• Financial information, where sector rules and the protection of Personal Accounts Information apply;
• Records of the public sector and any statutory retention duty;
• Construction, municipal and utility environments, where safety and operational records must be retained and traceable.

Where a project is subject to a specific statute, we will identify the applicable duty at proposal stage and build the required controls into the design, rather than treating the legislation as an afterthought.

8. Assessments and certifications

Where certification is a genuine requirement, we will help you assess the gap, and we can work inside a client's existing certified environment so that the certified boundary covers the system.

9. Your rights and how to exercise them

You may ask whether we hold information about you, ask for a copy, ask us to correct or delete it, or object to how we use it. For information we hold as your own, write to info@kirovdynamics.co.za. For information we hold on behalf of a client, we will direct you to that client, who is the responsible party. If you are not satisfied with our response you may complain to the Information Regulator of South Africa.

Our own website's approach is set out in full in the Privacy Policy.