Data Protection Notice

Our Privacy Policy covers personal information we collect as a responsible party — principally through this website. This notice covers something different: the client operational data we process when delivering analytics and platform services, and the safeguards that apply to it.

Our role: operator, not owner

When we build, host or support an analytics platform for a client, the client determines why and how the data is processed. Under POPIA the client is the responsible party and Mokay Group of Companies acts as an operator, processing data only on the client's documented instruction.

Where personal information is involved, we conclude a written agreement with the client as required by sections 20 and 21 of POPIA before processing begins.

Ownership of client data

Client operational data remains the property of the client at all times. We claim no ownership of it, and we do not use it for any purpose beyond delivering the agreed services. Specifically, we do not:

• sell, licence or share client data with third parties for their own purposes;
• use identifiable client data to train models or products for other clients;
• retain client data beyond the period agreed in the engagement.

Where we wish to reference an engagement publicly, or to use anonymised and aggregated insights, we do so only with the client's prior written agreement.

What we typically process

The operational data we handle varies by engagement. It commonly includes:

• Production and process data — output, throughput, quality, plant and sensor readings.
• Asset and equipment data — registers, utilisation, maintenance and downtime records.
• Safety, health and environmental data — inspections, observations, incidents and monitoring.
• Personal information — usually limited to the identity of employees or contractors who captured, approved or are referenced in a record, together with system access credentials.

We ask clients to provide the minimum personal information required for the system to function, and we support pseudonymisation where the operational purpose allows it.

Special personal information

Some sectors we serve involve categories POPIA treats as special personal information — most notably health information, and information concerning biometrics or trade union membership that can appear in workforce and safety records.

Processing these categories is prohibited under section 26 of POPIA unless a specific exclusion in section 27 applies, or the Information Regulator has granted authorisation. Where an engagement involves them we:

• establish with the client, in writing and before processing begins, which lawful ground is being relied on;
• work with de-identified or aggregated data wherever the operational question can be answered without identifying individuals — which, for capacity, utilisation and turnaround analysis, is usually the case;
• apply stricter access control, so identifiable records are reachable only by named individuals with a demonstrable need;
• retain such data for the shortest period consistent with the purpose and any regulatory requirement.

We do not accept identifiable health information for exploratory or demonstration purposes. Where a demonstration is useful, it is built on synthetic or fully de-identified data.

Security safeguards

Consistent with section 19 of POPIA, we apply technical and organisational measures proportionate to the sensitivity of the data:

• role-based access control, with permissions granted on a least-privilege basis;
• encryption of data in transit, and encryption at rest where the hosting environment supports it;
• segregation of client environments;
• logging of system and administrative activity, supporting traceability and audit;
• credential management, with multi-factor authentication on administrative access;
• backup and recovery arrangements agreed with the client;
• confidentiality obligations binding on our personnel.

Sub-processors and hosting

We use third-party infrastructure and software providers to deliver our services. Where such a provider will process client data, we:

• satisfy ourselves that the provider maintains appropriate security measures;
• bind the provider contractually to process data only on our instruction;
• disclose the provider to the client on request;
• remain accountable to the client for the provider's processing.

Where hosting outside South Africa is proposed, this is agreed with the client in advance and arranged in line with section 72 of POPIA.

Data transfer, return and destruction

At the end of an engagement, or earlier on the client's written request, we will return client data in a commonly used format and securely destroy our remaining copies, other than any copy we are legally required to retain. Where backups are involved, destruction takes effect as backup cycles expire, and those copies remain subject to the same safeguards until then.

Security compromise notification

If we become aware of a security compromise affecting client data, we will notify the affected client without undue delay and provide the information reasonably required for the client to meet its own obligations under section 22 of POPIA — including the nature of the compromise, the data affected, the likely consequences and the steps taken.

Where we are the responsible party for the affected information, we will notify the Information Regulator and the data subjects concerned as POPIA requires.

Data quality and integrity

Analytics is only as sound as the data beneath it. Our systems apply validation at the point of capture, record timestamps and attribution, and preserve an auditable trail from source record to reported figure. Where we identify data quality problems in a client's source systems, we raise them rather than reporting around them.

Contact

Questions about this notice, requests for our sub-processor list, or security documentation for a procurement process can be directed to:

Mokay Group of Companies
16 L’Breeze Estate, Olympus, Pretoria East, South Africa
Email: info@mokaygroup.co.za
Telephone: +27 60 569 3080