Syraxis Privacy Policy

This policy explains how Syraxis Pty Ltd ("Syraxis", "we", "us") handles personal information. It covers:

• syraxis.app, our public website
• app.syraxis.app, the Syraxis product
• the Syraxis apps for Android and iPhone

We wrote it to be read by the people who use Syraxis, including SHEQ managers, site staff, contractors and their workers.

1. Who we are and how to contact us

Syraxis Pty Ltd is a private company registered in South Africa. Syraxis is SHEQ software. Companies use it for inspections, actions, training and credentials, and to manage the contractors who work on their sites.

To contact us about privacy, email our Information Officer at support@syraxis.app. Please put "Privacy" in the subject line.

2. Our two roles

The Protection of Personal Information Act (POPIA) uses two terms:

• Responsible party: the organisation that decides why and how personal information is used.
• Operator: an organisation that processes personal information on behalf of a responsible party.

When we are the responsible party. We decide how the following information is used:

• information about visitors to syraxis.app, and emails you send us
• your Syraxis user account
• billing records for organisations that subscribe
• bug reports and support requests
• security logs

When we act for a company. Companies that subscribe to Syraxis load records about their workers, contractors and visitors. Examples include people records, contact details, ID numbers and ID documents, certificates (including medical certificates), training records, and inspection, observation, action and investigation records. For these records:

• the company that loaded them is the responsible party;
• we store and process them only to provide Syraxis to that company, and on its instructions.

If you have a question about these records, the company that holds them is usually the best place to start.

What we never do. We use customer data only to run Syraxis, and we never sell personal information.

What Syraxis does not do. Syraxis is software. It does not certify companies or contractors, and using it does not make anyone compliant. Each company remains responsible for its own legal obligations.

3. What we collect

3.1 Visitors to syraxis.app

• Technical information. When you visit syraxis.app, our hosting provider handles technical information such as your IP address and browser in order to deliver the pages.
• No forms. The website has no forms.
• Emails you send us. If you email sales@syraxis.app or support@syraxis.app, we receive your message and your contact details.
• No tracking. We do not use analytics, advertising cookies or tracking pixels on the website.

3.2 Product users

If you have a Syraxis account, we hold:

• your name, email address, profile picture (if you add one), time zone and notification preferences
• the organisations you belong to, and your role in each
• sign-in and security information, such as sessions and multi-factor authentication settings if you turn them on
• push-notification tokens, if you use the phone app
• a record of changes you make in the product

3.3 Records companies load about workers and contractors

A company using Syraxis may load the following records about its workers, contractors and visitors:

• Identity and contact details: name, email, phone, job title and work status.
• ID details: ID number, ID issue and expiry dates, and a copy of the ID document. A South African ID number also shows a person's date of birth.
• Certificates and credentials: for example trade tickets, licences, first aid certificates and medical certificates of fitness. Companies can also create their own types of credential.
• Training records.
• Site records: safety files, inspections, observations, actions, investigations and photos. These records can name people.
• Location: the GPS location of a record, if the user allows it.

3.4 Special personal information

POPIA gives extra protection to some kinds of information:

• Health information. Medical certificates are health information, which POPIA treats as special personal information.
• Criminal records. Syraxis has no credential type for criminal records by default. However, companies can create their own credential types, so this kind of information could be stored. A company that does this is responsible for having a lawful basis for it.
• ID numbers. We treat ID numbers with extra care. On screen and in shared files, Syraxis shows at most the last 4 digits of an ID number. Exports do not include ID numbers at all. Full ID numbers can be seen only by people who have the "See full ID numbers" permission. By default, only Admins have it.
• ID documents and medical certificates. Files stored as ID documents or medical certificates follow the same rule. Only people with that permission can open or download them. Other users can still see that a medical certificate exists, including its type, dates and file name.
• Contractor managers. A contractor manager can see full ID numbers, and open ID documents and medical certificates, only for their own company's people.

3.5 People who open a shared safety file

A company can share a safety file by link. Before the file opens, the viewer must accept a privacy declaration. Then:

• What is recorded. To protect the file, the company that shared it and Syraxis Pty Ltd record the viewer's IP address, browser and the email address they enter.
• Who can see it. The company that shared the file can see the viewer's name, company and email.
• How ID numbers appear. A shared file shows only the last 4 digits of an ID number.
• How long links last. Share links expire after 30 days by default, and after 90 days at most. Older links, created before link expiry was introduced, expire 90 days after it was introduced.

3.6 Device and usage information

• Logs. We keep application, server and security logs. These contain information such as IP addresses, browser details, request details and user IDs.
• Offline copy on your phone. The phone app keeps a copy of some work records on your device so you can work offline. It does not store people records or ID details, only your own sign-in details and the names of people assigned to actions. Signing out or switching organisation deletes everything on the phone, including work you haven't sent yet, so send your work first. Depending on your app version, you may see a warning before unsent work is deleted. If your session expires, the app keeps unsent work on the phone, locked to your account and organisation, and sends it when you sign back in. If a different person or organisation signs in instead, the app warns and then deletes it. If you are removed from an organisation, the app sends unsent records one last time (photos waiting to upload are not sent), warns you if anything couldn't be sent, and then deletes everything on the phone.

3.7 Cookies and third-party content

• Website. The website uses no cookies for advertising or analytics.
• Signing in. Our sign-in provider, Clerk, uses cookies or similar technology to keep you signed in. It also uses Cloudflare Turnstile to check that sign-ins are not automated.
• Shared files. After a viewer accepts the declaration, a cookie keeps the shared file open for 12 hours.
• Training videos. Training content can include embedded YouTube or Vimeo videos. When you play one, your browser connects to YouTube or Vimeo. They receive your IP address and may set their own cookies, under their own privacy policies.

3.8 Billing

• Card payments. Card payments are handled by Paystack. Card details you enter go directly to Paystack. We never see or store them.
• What we keep. We keep the billing email, organisation details, checkout records, subscription references and a log of billing changes.

4. Why we use personal information

POPIA allows personal information to be processed on certain grounds, including consent, performing a contract, meeting a legal obligation, and legitimate interests.

Health information. POPIA allows health information to be processed only in limited cases, for example with the person's consent, or where it is necessary to meet an obligation in law.

• Companies often keep medical certificates and training records because occupational health and safety law may require them.
• The company that loads these records is responsible for having a lawful basis. It is also responsible for telling its workers how their information is used.

5. Who we share it with

We use the following service providers to run Syraxis:

Bug reports. Please do not include personal details about other people. The bug-report form asks you not to.

Other services. We do not use analytics, advertising, error-tracking, chat, CRM or AI services that receive personal information.

We may also share personal information:

• Within your organisation: people in your organisation can see records according to the roles your company sets up;
• With people you choose: for example, people you send a share link to;
• Where the law requires it: for example, a court order or a lawful request from a regulator.

6. Information sent outside South Africa

• Where Syraxis data is stored. Syraxis stores its data with AWS in Frankfurt, Germany. Pages and files are delivered through AWS's global content-delivery network.
• Our providers. Some of our providers are based in, or process information in, other countries, such as the United States and Ireland.
• The law we follow. When personal information is sent outside South Africa, we do so as section 72 of POPIA allows, for example where the recipient is bound by law or by an agreement that gives protection substantially similar to POPIA.

7. How we protect it

We use reasonable technical and organisational measures to protect personal information. They include:

• encrypted connections, and encryption of stored data
• private storage that can only be reached through short-lived signed links
• keeping each organisation's data separate
• role-based access, with optional multi-factor authentication
• logging, monitoring and regular backups
• share links that expire

8. If there is a data breach

• Records we hold for a company. If we have reasonable grounds to believe that someone without permission has accessed or acquired personal information we hold for a company, we will tell that company immediately. The company can then notify the Information Regulator and the people affected.
• Information we are responsible for. For information where we are the responsible party, we will notify the Information Regulator and the people affected as soon as reasonably possible, as POPIA requires.

9. How long we keep it

Other information, such as emails you send us, is kept only for as long as we need it for the purpose it was collected for, unless the law requires us to keep it longer.

10. Your rights

Under POPIA you may:

• ask whether we hold personal information about you, and ask for a copy
• ask us to correct or delete information that is inaccurate, out of date, excessive or held unlawfully
• object to processing based on legitimate interests
• withdraw consent, where we rely on consent
• complain to the Information Regulator

How to make a request

• Records a company loaded about you. Contact the company that loaded them, and we will help it respond. You can also email support@syraxis.app. We will work with the company and export your records for you.
• Your own Syraxis account. Email support@syraxis.app and we will export a copy for you. You can also delete your account in Settings.

We may need to check who you are before we act on a request.

Information Regulator (South Africa)

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• General enquiries: enquiries@inforegulator.org.za, 010 023 5200, or toll-free 0800 017 160
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: https://inforegulator.org.za

11. Direct marketing

• No marketing emails. We do not send marketing emails. Product emails, such as reminders about due dates, are part of the service and are not marketing.
• If this changes. If we ever send electronic marketing, we will do so only as POPIA allows. Every message will tell you who it is from and how to opt out.

12. Children

Syraxis is built for workplaces and business users. We do not knowingly collect personal information about children for our own purposes.

A company that loads records about a worker under 18 is responsible for having a lawful basis to process that child's personal information.

13. Phone apps

The Android and iPhone apps follow this policy.

• Permissions. They ask for camera and location access only when you use features that need them.
• Offline copy. The offline copy of work records on your device does not store people records or ID details, only your own sign-in details and the names of people assigned to actions. Signing out or switching organisation deletes everything on the phone, including work you haven't sent yet, so send your work first. Depending on your app version, you may see a warning before unsent work is deleted. If your session expires, the app keeps unsent work on the phone, locked to your account and organisation, and sends it when you sign back in. If a different person or organisation signs in instead, the app warns and then deletes it. If you are removed from an organisation, the app sends unsent records one last time (photos waiting to upload are not sent), warns you if anything couldn't be sent, and then deletes everything on the phone.

14. Changes to this policy

When we update this policy, we will change the "Last updated" date at the top.

15. Contact

Questions about this policy or your personal information: support@syraxis.app (Information Officer, Syraxis Pty Ltd).