1. Scope & Controller

This policy covers personal information processed by Intelligence VIP Protection Services (“IPS”, “we”, “us”) when you visit our website, contact us, or receive our services.

Controller: IPS, 546 16th Road, Constantia Park, Midrand, Gauteng, South Africa.

2. Data We Collect

• Contact: name, email, phone, address.
• Service Data: site location, risk profile, job specs, access instructions.
• Investigation Data: case notes, witness statements, OSINT, lawful surveillance media, device metadata, financial records, and reports. Includes data on third parties (e.g., subjects) where lawful and necessary; clients must confirm legal authority to share such data.
• Security Systems: CCTV samples, access control logs, biometrics (facial templates) for setup — only with notice and consent.
• Children’s Data: We don’t knowingly process data of under-18s without parental consent, unless incidental to security operations.
• Technical: IP address, browser/device info, analytics, cookies.
• Communications: emails, WhatsApp/business phone logs tied to your inquiry or contract.

3. How We Use Data

• Respond to inquiries, prepare quotes, and deliver services.
• Verify identity, assess risks, prevent fraud.
• Comply with PSIRA and lawful orders.
• Improve services, training, and site performance.
• Maintain records, billing, and CRM.

4. Lawful Bases

We process data under consent, contract, legal obligation, and legitimate interests (e.g., safety, fraud prevention).

5. Sharing & Processors

No selling of data. Limited sharing with:

• PSIRA-registered staff/contractors.
• Hosting/email/SMS/telephony providers, document storage, analytics tools.
• Legal counsel, insurers, auditors, regulators.
• Law enforcement or courts where required.

5.1 Whistleblowing & Complaints

Reports of IPS staff misconduct may be shared with PSIRA, SAPS, or legal counsel as required by law. Anonymous reports are allowed but may limit follow-up.

6. Cross-Border Transfers

Some providers may process data in the EU, UK, or US. Safeguards like contractual clauses and certifications maintain POPIA protection.

7. Retention

We keep data only as long as needed for the purpose collected or as required by law. Biometric data is deleted within 30 days after contract end unless required for legal proceedings.

8. Security & Breach Response

We use technical and organizational safeguards (access controls, confidentiality agreements, secure storage). If a breach poses risk to rights/freedoms, IPS will notify the Information Regulator and affected parties as required by POPIA, typically within 72 hours of confirmation.

9. Your Rights (POPIA)

• Access your data.
• Request corrections/updates.
• Object to/restrict processing; withdraw consent.
• Request deletion, subject to legal retention.

10. Cookies

We use a consent banner to control non-essential cookies. Analytics/marketing tools (Google Analytics, Meta Pixel) load only after consent. You can change consent anytime via the banner.

11. Contact

12. Changes to This Policy

We may update this policy. The current version and effective date will always appear on this page. Material changes (e.g., new data uses) will be notified via email or site banners.