Effective Date: 1 July 2026 — Last Updated: 1 July 2026
ATH Solutions (Pty) Ltd ("ATH Solutions", "we", "us", or "our") operates the Enterprise Disaster Management Platform ("EDMP"). This Privacy Policy describes how we collect, use, store, share, and protect personal information when you use EDMP. It is compliant with the Protection of Personal Information Act, 4 of 2013 (POPIA) and, where applicable, the General Data Protection Regulation (GDPR).
By accessing or using EDMP you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the platform.
1. Who We Are (Responsible Party / Data Controller)
Transaction data: work requests, quotes, milestones, payment records, escrow balances, and invoices.
Technical data: IP addresses, browser type, session identifiers, log data, and cookies.
Location data: GPS coordinates submitted by contractors using the live tracking feature.
Media: photographs and documents uploaded for damage assessments or contractor verification.
Communication data: messages sent through the platform’s in-app chat and broadcast notifications.
3. Lawful Basis for Processing
We process personal information on the following lawful grounds:
Contract performance: to deliver the services you have requested and to fulfil obligations under agreements.
Legal obligation: to comply with applicable law, including tax, AML, and disaster-management regulations.
Legitimate interests: fraud prevention, platform security, analytics, and product improvement.
Consent: for optional marketing communications (you may withdraw at any time).
4. How We Use Your Information
To create and manage your account and authenticate your identity.
To match work requests with appropriate contractors.
To process payments and manage escrow accounts.
To facilitate communication between parties on the platform.
To conduct AI-assisted damage assessments and fraud detection.
To send transactional notifications (SMS, email, push).
To generate analytical reports and operational dashboards.
To comply with legal and regulatory obligations.
To improve the platform and investigate security incidents.
5. Sharing of Personal Information
We do not sell your personal information. We may share it with:
Other platform participants: relevant details (name, contact, location) are shared between parties to facilitate service delivery (e.g., citizen → contractor).
Service providers: cloud hosting, payment processors (PayFast, Stripe), SMS gateways, and email providers acting under data-processing agreements.
Government / municipal authorities: where required by disaster-management legislation or court order.
Insurers: limited claim-relevant information when you are a party to an insured event.
Auditors and legal advisers: strictly for compliance and dispute resolution purposes.
6. International Data Transfers
Your data is primarily processed within the Republic of South Africa. Where data is transferred outside South Africa (e.g., to EU-based service providers), we ensure adequate safeguards are in place as required by POPIA and GDPR, including Standard Contractual Clauses where necessary.
7. Retention of Personal Information
Account and transaction data: retained for 7 years after your last transaction, then securely deleted.
Audit and compliance records: retained permanently in encrypted form.
Chat messages and activity logs: 1 year active, 7 years in cold storage.
Session tokens and temporary files: deleted within 30 days.
8. Your Rights (POPIA & GDPR)
Depending on your jurisdiction, you have the right to:
Access - request a copy of the personal information we hold about you.
Correction - request correction of inaccurate or incomplete data.
Deletion - request erasure of your personal information (subject to legal retention obligations).
Portability - receive your data in a structured, machine-readable format.
Restriction - request that we limit processing of your data in certain circumstances.
Objection - object to processing based on legitimate interests or for direct marketing.
Withdraw consent - where processing is based on consent, you may withdraw at any time.
To exercise any of these rights, log in to your account and submit a Data Request under My Profile → Data & Privacy, or contact us at info@ath.solutions. We will respond within 72 hours as required by POPIA.
9. Cookies and Tracking
We use session cookies strictly necessary for authentication and security. We do not use third-party tracking cookies or advertising pixels. You can disable cookies in your browser settings; however, this will prevent you from signing in to the platform.
10. Security
We implement AES-256 encryption for sensitive fields at rest, TLS 1.3 in transit, multi-factor authentication for privileged roles, role-based access control (RBAC), and continuous security monitoring. In the event of a personal-information breach, we will notify affected parties and the Information Regulator of South Africa within 72 hours where required by law.
11. Children
EDMP is not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us immediately and we will delete it.
12. Changes to This Policy
We may update this Policy from time to time. Material changes will be communicated by email and by a notice on the platform at least 14 days before taking effect. Continued use of EDMP after the effective date constitutes acceptance of the revised Policy.
13. Contact & Complaints
For privacy-related questions or complaints, contact our Information Officer at info@ath.solutions. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa (www.justice.gov.za/inforeg/) or, if in the EU, your local supervisory authority.