Privacy Notice

This notice explains how The Polymath (Pty) Ltd handles personal information in PolyTrack, as required by the Protection of Personal Information Act 4 of 2013 (POPIA), and how to ask for access to records under the Promotion of Access to Information Act 2 of 2000 (PAIA).

Last updated: 5 November 2026

1. Who we are

PolyTrack is a risk management platform provided by The Polymath (Pty) Ltd, a company based in Pretoria, South Africa. For PolyTrack we act only as a software provider: PolyTrack does not give insurance advice and does not handle premiums or claim payments.

• Company registration number: 2026/275612/07
• Information Officer: Ewoud Malan (registered with the Information Regulator, registration number 2026-069855). Street address: 35 4th Street, Menlo Park, Pretoria. Postal address: 35 4th Street, Menlo Park, Pretoria. Telephone: 067 855 8273. Email: ewoud@thepolymath.co.za.

2. Our two roles

As a responsible party. We decide how to use the information of the people who hold PolyTrack accounts or sign up for one: client users, brokers, insurers, health and safety specialists and consultancies. Sections 3 to 5 cover this information.

As an operator. Our clients load information about other people into PolyTrack, for example their employees, drivers, contractors and people involved in incidents. For that information the client is the responsible party and we process it on the client's behalf, under our agreement with them. If PolyTrack holds information about you because a company you work with uses it, please contact that company first; we will help them respond.

3. Information we collect about account holders

• Account and profile details: name, email address, role, job title, mobile and office numbers and, for brokers and insurers, business details such as an FSP number.
• Sign-in and security records: a hashed password, two-factor authentication settings, and password reset requests with the IP address and browser they came from.
• Sign-up records: the IP address and browser used to register.
• Activity records: an audit log of changes made in PolyTrack and who made them, and a log of the emails PolyTrack sends.
• Billing details: the name and email address of the person responsible for the subscription, and the plan chosen. Payments are made on PayFast's own pages; we never see or store card or bank details.

4. Information our clients load (as operator)

Depending on the modules a client uses, this can include contact people, employee training records (including ID numbers), driver records (including ID and licence details and driving behaviour from vehicle trackers), and incident records. Incident records can include the names of injured people and details of their injuries, which is health information and special personal information under POPIA. Clients decide what to load and are responsible for having a lawful reason to do so.

5. Why we use account holders' information

• To provide PolyTrack under our agreement with you or your organisation, including sign-in, notifications, reminders and reports.
• To keep PolyTrack secure, investigate faults and prevent misuse (our legitimate interest).
• To bill subscriptions and keep financial records (our agreement and legal obligations).
• To let the people your organisation works with see what they are entitled to see: a client's appointed broker, and insurers or specialists the client has granted access to.

We do not sell personal information and do not use it for advertising.

6. Service providers we use

We share information with these providers only so that they can provide their part of the service.

• xneelo (South Africa): hosting of the application and database.
• Cloudflare R2 (Western Europe): storage of uploaded documents. Documents are not publicly reachable; PolyTrack checks who may open each one.
• Brevo (France, European Union): sending PolyTrack's emails.
• Cloudflare (proxy and security): traffic to PolyTrack passes through Cloudflare's network, which can handle it in any country where Cloudflare operates, including the United States.
• Sentry (European Union, with processing that may also take place in the United States): error monitoring. Error reports do not include form contents or request bodies, and personal details such as email addresses and passwords are removed before a report is sent.
• PayFast (South Africa): subscription payments, once billing is switched on. Payments are made on PayFast's own pages; we never see or store card or bank details.
• Public registers (SARS, the FSCA and CIPC): checking a VAT, FSP or company registration number that you enter. Only the number is sent.

Used only if a user or client connects them:

• Google Calendar and Microsoft 365: adding reminders to your own calendar.
• Microsoft Teams and Slack: posting alerts to a client's own channel.
• Vehicle tracking providers (such as MiX Telematics, Cartrack and Netstar): reading a client's own tracking data.

7. Information sent outside South Africa

Some of our service providers process personal information outside South Africa: Cloudflare (document storage in the European Union), Brevo (emails, France) and Sentry (error monitoring). Cloudflare and Sentry are United States companies and may also process information in the United States. If you or your organisation connect them, Google Calendar, Microsoft 365, Microsoft Teams and Slack may process information in other countries, including the United States. We tell you this before you connect them.

We share personal information with these providers only under binding data processing agreements that require them to protect it to a standard substantially similar to POPIA, also when they pass it on to their own sub-processors, as section 72 of POPIA requires. Where we process information as an operator for a client, the client approves these providers in its agreement with us.

8. How we protect information

• Access in PolyTrack is limited by role: a client sees only its own organisation, a broker only their own clients, and an insurer or specialist only the organisations that granted them access.
• Passwords are stored hashed, and two-factor authentication is available.
• The connection to PolyTrack is encrypted (HTTPS), and secrets such as two-factor and integration keys are encrypted in the database.
• Repeated sign-in and password reset attempts are limited.

If we become aware of a security compromise affecting personal information, we will notify the Information Regulator and the affected people, or the client concerned where we act as operator, as POPIA requires.

9. How long we keep information

We keep account holders' information while the account is active and for five years afterwards, unless the law requires us to keep it longer. Password reset records are deleted automatically after 90 days, or 12 months for completed resets. Information our clients load is kept or deleted on the client's instructions.

10. Cookies and browser storage

PolyTrack uses only the cookies it needs to work: a session cookie that keeps you signed in until you sign out or close your browser, security protection against forged requests, and a cookie that remembers when you have dismissed a notice. Your browser may also keep unsent form drafts and, on mobile, offline field forms until they can be sent. We do not use advertising or analytics cookies.

PolyTrack does not load fonts or scripts from other companies' servers: text is shown in your own device's fonts, and the charts, PDF viewer and barcode scanner run from PolyTrack's own server, so your browser does not contact a font or content network when it opens a page.

11. Your rights

Under POPIA you may ask us:

• whether we hold personal information about you, and for a copy of it;
• to correct or delete information that is inaccurate, out of date, excessive or unlawfully held;
• to stop processing your information where we rely on our legitimate interest; and
• to stop sending you marketing messages, if we ever send any.

Send your request to ewoud@thepolymath.co.za. We may need to confirm your identity first. Where we hold the information as operator for a client, we will pass your request to that client.

If you are unhappy with how we have handled your information, you may complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200, or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

12. Access to records (PAIA)

You may ask for access to records held by The Polymath (Pty) Ltd under PAIA. Complete Form 2 ("Request for access to record") from the PAIA Regulations, 2021, available on the Information Regulator's website, and send it to the Information Officer at the contact details in section 1.

The PAIA Regulations set a request fee and, if access is granted, fees for searching for, preparing and copying the records. We will tell you what is payable before we do the work. We will reply within 30 days, which PAIA allows us to extend once by up to 30 days if we tell you why.

Access may be refused on the grounds PAIA sets out, for example to protect another person's privacy or confidential commercial information. If you disagree with our decision you may complain to the Information Regulator (PAIAComplaints@inforegulator.org.za) or apply to court.

Our PAIA manual sets out the records we hold and how to request access to them. It is available at polytrack.co.za/paia and from the Information Officer on request.

13. Changes to this notice

We will update this notice when how we handle personal information changes. The date at the top shows when it last changed.