What we hold, and why

02Who is responsible

REDCLYPH (PTY) LTD, registration number 2013 / 185696 / 07, trading as RedClyph Software Solutions, of Brackenfell, Western Cape, is the responsible party for the personal information described in sections 03 to 05.

The company’s full registered address appears in the PAIA manual linked in section 11, where the Promotion of Access to Information Act requires it, and on the public company register.

The Information Officer is Marius Visser, a director of the company. Every question, request or complaint about personal information goes to him at info@redclyph.co.za or +27 82 417 0098.

For personal information held in a system RedClyph has built for a client, the client is the responsible party and RedClyph is only the operator. Section 06 explains what that means and who to approach.

03What this website collects

Nothing, directly. There is no contact form, no newsletter sign-up, no login, no analytics package, no advertising tag and no cookie of any kind. The contact links are ordinary mailto: links that open your own mail program; nothing is submitted to this site.

Two things nonetheless happen when you load a page, and both are worth stating plainly.

If the font request concerns you, a browser extension that blocks third-party requests will stop it, and the site remains entirely readable in the fallback typefaces.

04If you contact RedClyph

When you send an e-mail or call, RedClyph holds what you choose to send: your name, your e-mail address or telephone number, and whatever is in the message. It is used to answer you, and if the enquiry turns into work, to quote for it and to perform the contract.

An enquiry that does not become work is deleted within twelve months. There is no mailing list, and you will not be added to one.

05Clients and suppliers

For a client, RedClyph holds the name, job title, employer and business contact details of the people it deals with, together with project correspondence, quotations, specifications, contracts, support records and invoices. For a supplier it holds the equivalent account and contact details.

This is processed in order to perform the contract, to invoice and collect payment, and to keep the accounting and tax records the law requires. Contracts, invoices and accounting records are kept for seven years under the Companies Act, and for at least five years from the date a return was submitted under the Tax Administration Act.

06Data in systems RedClyph builds

Where RedClyph builds or supports a system for a client, the data in that system belongs to the client. The client is the responsible party and RedClyph is the operator, which under section 20 of POPIA means it may process that data only with the client’s knowledge or authorisation and only as far as the work requires.

There is a written operator contract with every such client, as section 21 of POPIA requires. It obliges RedClyph to maintain the security safeguards in section 19, to notify the client immediately if there is ever reason to believe the data has been reached by someone unauthorised, and to hand the data back in full and then delete its own copy when the engagement ends.

RedClyph deliberately takes only what the system needs. In the stock control system built for a pre-school, for example, the personal information amounts to the name, role and section of members of staff, and their login credentials. No information about any child is held.

If you are a user of a system RedClyph operates for someone else, ask them, not RedClyph. They hold the relationship with you and the decision about your data. RedClyph will help them answer, and will not answer over their head.

07Who else sees it

Personal information is not sold, and is not shared for anyone else’s marketing. It is given only to:

08Where it goes

RedClyph’s own web hosting, domain and e-mail are provided in South Africa. Systems built for clients are deployed to infrastructure the client chooses; where RedClyph can influence that choice it recommends hosting inside the Republic.

Two transfers leave the country, and both are disclosed rather than buried. Source code is held in private repositories with a provider whose servers are abroad — the repositories are private, and client personal information is not placed in them. And the typefaces described in section 03 are served by Google.

RedClyph does not transfer personal information out of South Africa on a client’s behalf without that client’s written consent, as section 72 of POPIA requires.

09How it is protected

Section 19 of POPIA requires appropriate, reasonable technical and organisational measures. In practice that means:

• HTTPS on everything published, with http redirected to https;
• e-mail authenticated with SPF, DKIM and DMARC, the last set to p=reject so that mail forged in RedClyph’s name is refused rather than merely filtered;
• credentials encrypted at rest and never committed to source control;
• private source code repositories, with no public repository under the company account;
• access control by role in the systems RedClyph builds, so that a user sees only what the role requires;
• an append-only audit trail wherever the integrity of a record matters;
• backups that are checked by restoring them, not merely by taking them.

No set of measures is perfect. Where there is reason to believe personal information has been reached by someone unauthorised, RedClyph notifies the responsible party immediately, and where RedClyph is itself the responsible party, the Information Regulator and the people affected, as section 22 requires.

10Your rights

You may ask, free of charge, whether RedClyph holds personal information about you, and ask for a copy or a description of it. You may require it to be corrected or deleted if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained. You may object to it being processed on the grounds section 11(3) of POPIA allows.

Write to the Information Officer at info@redclyph.co.za. A formal request may be made on the forms published by the Information Regulator, but a plain e-mail is enough to start and RedClyph will not stand on formality.

If RedClyph holds the information as an operator for a client, the request goes to that client, and RedClyph will help them answer it.

If you are not satisfied, you may complain to the Information Regulator.

11Access to information — PAIA

PAIA gives you the right to ask for a record held by RedClyph where you need it to exercise or protect a right. The manual required by section 51 of that Act sets out what records exist, how to ask, what it costs and on what grounds a request may be refused.

Download the PAIA and POPIA manual (PDF)

It is also available by e-mail on request, and for inspection at the registered address during business hours, in both cases free of charge.

12Other notices

This notice covers RedClyph Software Solutions and this website. Individual products may have their own, more specific notice where they process data this one does not describe.

• Winnow privacy policy — for the self-hosted mail triage tool, which runs entirely on the customer’s own computer and sends RedClyph nothing.

13Changes to this notice

This is version 1.0, effective 28 August 2026. It is reviewed at least once a year, and whenever RedClyph’s activities change in a way that affects it. The version and effective date are shown at the top of this page, so you can tell at a glance whether what you read before still stands.