Data privacy policy

This policy explains how we handle personal information when you visit our website, contact us, engage us for services, or use one of our products. We process personal information lawfully, for legitimate purposes, and with appropriate safeguards.

01Who we are

Didusec (Pty) Ltd ("Didusec", "we", "us"), registration number 2014/111799/07, is a South African technology company that builds AI-native, cloud-based solutions for organisations in regulated sectors. We are the responsible party for the personal information described in this policy, except where section 03 says we act as an operator.

Registered office	Wembley, 1st Floor, The Campus, 57 Sloane Street, Bryanston, Sandton 2191, South Africa
Phone	+27 81 356 8989
Information Officer	[email protected]

02Information we collect

We collect only the personal information we need for the purposes set out below:

• Contact details: name, business email, telephone number and company, when you enquire or engage us.
• Enquiry content: the project, timeline or compliance details you choose to share with us.
• Technical data: IP address, browser type and request logs, processed automatically by our hosting and security provider when you visit our website. We do not run analytics or advertising trackers on this website.
• Service data: information processed on behalf of clients under a written agreement, where we act as an operator (see section 03).

03Our products

Didusec builds the products below and operates all of them except Covariance Trust Fabric, which each bank runs itself. Each has its own privacy notice that explains, for that product, what is collected and who the responsible party is. This policy applies alongside those notices.

Product	Website	Our role
Fintegris	fintegris.tech	Responsible party for enquiries and design-partner contacts. For client institutions' compliance data, operator under a written agreement.
declareZA	declareza.online (privacy notice)	Responsible party for account and enquiry data. For employers' worker records, the employer is the responsible party and Didusec is the operator under a written agreement.
PowerSettle	powersettle.tech	In development. Roles will be set out in the client agreement before any personal information is processed.
Cairn Concierge	This website	In development. Roles will be set out in the client agreement before any personal information is processed.
Covariance Trust Fabric	This website	Responsible party for briefing enquiries. Covariance Trust Fabric is a standard that each bank runs in its own environment; Didusec does not operate any bank's channel or process banks' client data under it.

04How and why we use it

We process personal information to respond to enquiries, deliver and support our services and products, meet contractual and legal obligations, secure our systems, and improve our website. We do not sell personal information, and we do not use it for purposes incompatible with those for which it was collected.

05Lawful basis

We rely on one or more lawful bases under POPIA: your consent; the performance of a contract with you; compliance with a legal obligation; or our legitimate interests in operating and growing our business, balanced against your rights. Where we rely on consent, you may withdraw it at any time.

06Sharing and data residency

We share personal information only with operators who process it on our behalf under written agreement, with professional advisers, or where the law requires. Our products are hosted on Amazon Web Services in the AWS Africa (Cape Town) Region, af-south-1, so product data is resident in South Africa by design.

Two website services operate outside South Africa:

• Contact form: messages sent through the form on didusec.co.za are relayed to our mailbox by Web3Forms. We ask for your consent under POPIA s.72(1)(b) before you send. If you prefer not to consent, email [email protected] directly.
• Hosting and security: this website is delivered through Cloudflare, which processes technical data (such as IP addresses) to deliver pages and block abusive traffic.

Where any other cross-border transfer is necessary, we apply the safeguards required by section 72 of POPIA.

07How we protect it

We apply appropriate technical and organisational measures, including encryption in transit and at rest, role-based access control, multi-factor authentication, network isolation, and audit logging. We maintain reasonable measures to detect, prevent and respond to security incidents, and we will notify you and the Information Regulator of a compromise where the law requires.

08Retention

We keep personal information only as long as necessary to fulfil the purposes for which it was collected, or as required to meet legal, regulatory, contractual or audit obligations. When it is no longer needed, we securely delete or de-identify it.

09Your rights under POPIA

Subject to the Act, you have the right to:

• be told what information we hold about you;
• request access to that information;
• correct or delete inaccurate information;
• object to processing in certain circumstances;
• withdraw consent where we rely on it; and
• complain to the Information Regulator.

To exercise any of these rights, contact our Information Officer at [email protected].

10Cookies

This website does not use analytics, advertising or preference cookies. Our hosting and security provider may set strictly necessary cookies to protect the site from automated abuse. You can control cookies through your browser settings.

11Changes to this policy

We may update this policy from time to time. The current version and its effective date are always on this page, and we will communicate material changes where appropriate.

Version	Effective	Change
1.2	11 November 2026	Added Covariance Trust Fabric to the products section.
1.1	10 November 2026	Added company registration number and full address; added the products section; named the website contact-form relay and hosting provider; updated the cookie statement.
1.0	1 June 2026	First version.