PRIVACY POLICY
Jacobus van zyl Last updated: March 2026 Version: 1.0
1. Who I Am
Jacobus van zyl is a private security consultant providing physical security assessments, vulnerability assessments, and security advisory services. I am registered with the Private Security Industry Regulatory Authority (PSIRA) and operate in compliance with South African law.
Responsible Party (as defined in the Protection of Personal Information Act 4 of 2013):
Jacobus van zyl, Secunda, Mpumalanga, South Africa Email: jacobus@alphadefense.co.za Website: www.vanzylj.co.za
Information Officer: Jacobus Van Zyl
Registered with the Information Regulator of South Africa
2. Scope of This Policy
This Privacy Policy explains how Jacobus van zyl collects, uses, stores, shares, and protects your personal information when you:
- Visit my website
- Contact us via email, telephone, or social media
- Enquire about or engage my services
- Receive services from me under a service agreement
This policy applies to all natural persons whose personal information I process. It does not apply to juristic persons (companies, close corporations, trusts), although I handle information about juristic persons with equivalent care.
3. The Personal Information I Collect
I collect only the personal information necessary for the purpose for which it is collected. Depending on your interaction with me, this may include:
Contact and identification information
- Full name
- Email address
- Telephone number
- Physical or business address
Business information
- Company name and registration details
- Job title and role
- Business premises details (for security assessment purposes)
Assessment-related information
- Premises details, photographs, and access control information provided during a security assessment
- Incident history and security-related information you share with us
- Information about third parties relevant to an assessment (e.g. service providers, staff)
Communication records
- Email correspondence
- Notes from telephone or in-person consultations
- Enquiry and lead management records
Website usage information
- Browser type and version
- Pages visited and time spent on my website
- Referring website
- IP address (where relevant to website security)
I do not collect special personal information (as defined in POPIA Section 26) unless it is strictly necessary and you have provided explicit consent. I do not knowingly collect personal information from persons under the age of 18 without the consent of a competent person.
4. Why I Collect Your Personal Information
I process personal information only for specific, explicitly defined, and lawful purposes. My processing purposes and the lawful basis for each are as follows:
| Purpose | Lawful Basis (POPIA) |
|---|---|
| Responding to enquiries and providing quotations | Legitimate interest / pre-contractual steps |
| Concluding and performing service agreements | Contractual necessity |
| Conducting security assessments | Contractual necessity |
| Preparing and delivering assessment reports | Contractual necessity |
| Invoicing and financial record-keeping | Legal obligation / contractual necessity |
| Communicating with you about your engagement | Contractual necessity |
| Managing leads and potential client relationships | Legitimate interest |
| Improving our services and methodology | Legitimate interest |
| Complying with legal obligations | Legal obligation |
| Protecting our rights in the event of a dispute | Legitimate interest |
I do not process your personal information for automated decision-making or profiling purposes.
5. How Long I Keep Your Personal Information
I retain your personal information only for as long as necessary for the purposes for which it was collected, or as required by law.
My standard retention periods are:
- Leads and enquiries (not converted to clients): 12 months from last contact, after which personal information is securely deleted
- Client records and correspondence: 5 years from the end of the client engagement
- Assessment materials and reports: 5 years from the date of delivery
- Financial and invoicing records: 5 years, as required by the Companies Act and South African Revenue Service requirements
- Legal dispute records: For the duration of the dispute plus the applicable prescription period
Where retention beyond these periods is required by law or for the establishment, exercise, or defence of legal claims, I will retain only what is necessary for that purpose.
6. Who I Share Your Personal Information With
I do not sell, rent, or trade your personal information to any third party.
I may share your personal information with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection obligations:
Operators (third-party service providers) I use third-party platforms and tools to operate my business. These operators process personal information on my behalf under data processing agreements or equivalent contractual terms:
- Google (Gmail, Google Drive): Email communication and document storage. Data processing terms apply. Servers may be located outside South Africa.
- Meta (WhatsApp Business): Client communication. Meta Business Terms apply. Servers located in the United States.
- Anthropic (Claude AI): I use AI tools to assist with documentation and analysis. I apply pseudonymisation protocols before any client information is processed through AI tools. I do not enter identifiable client personal information into AI platforms without appropriate safeguards.
- My website hosting provider: Website operation and email hosting.
- Accounting and invoicing software (if applicable): Financial record management.
Professional advisors I may share information with my legal, compliance, or financial advisors where necessary, subject to professional confidentiality obligations.
Law enforcement and regulatory authorities I may disclose personal information to the South African Police Service, the Information Regulator, or other competent authorities where required by law, court order, or in response to a legitimate legal request. Where permitted by law, i will notify you of such disclosure.
Cross-border transfers Some of my third-party operators process personal information outside South Africa, including in the United States. Where personal information is transferred outside South Africa, we take reasonable steps to ensure that the recipient country or organisation provides an adequate level of protection as contemplated in Section 72 of POPIA. By using my services and engaging with me, you acknowledge that such transfers may occur.
7. How I Protect Your Personal Information
I implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, loss, disclosure, alteration, or destruction. These measures include:
- Encryption of devices used to store personal information (BitLocker)
- Password management using industry-standard credential management tools
- Multi-factor authentication on business accounts where available
- Network segmentation to isolate business and IoT devices
- Secure file transfer protocols for the delivery of assessment reports
- Physical security controls for devices and physical records
- Regular review of access rights and security controls
No method of electronic transmission or storage is 100% secure. While I take reasonable steps to protect your personal information, I cannot guarantee absolute security.
8. Cookies and Website Tracking
My website may use cookies and similar tracking technologies to improve your browsing experience and gather anonymised usage statistics.
What are cookies? Cookies are small text files placed on your device by a website. They help us understand how visitors use our website and allow certain website functionality to work correctly.
Types of cookies i may use:
- Essential cookies: Required for the website to function. These cannot be disabled.
- Analytics cookies: Help me understand how visitors interact with our website (e.g. Google Analytics). These are anonymised where possible.
You may disable cookies in your browser settings. Disabling essential cookies may affect website functionality. Disabling analytics cookies will not affect your ability to use the website.
If i introduce additional cookies or tracking technologies, I will update this policy accordingly.
You can read more about the cookies I use on my website her: Cookie policy
9. Your Rights as a Data Subject
Under POPIA, you have the following rights in relation to your personal information:
Right of access (Section 23) You have the right to request confirmation of whether I hold personal information about you, and to request access to that information. Requests may be submitted to my Information Officer using the contact details in Section 1 or via the PAIA process described below.
Right to correction or deletion (Section 24) You have the right to request that we correct inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal information. You may also request deletion of personal information I am no longer lawfully entitled to retain.
Right to object to processing (Section 11(3)) Where I process personal information based on my legitimate interest, you have the right to object to that processing. i will consider your objection and cease processing unless I have compelling legitimate grounds that override your interests.
Right to lodge a complaint (Section 74) If you believe I have violated your rights under POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:
Information Regulator (South Africa) Website: www.inforegulator.org.za Email: inforeg@justice.gov.za Telephone: 010 023 5207
Access to information under PAIA In addition to your POPIA rights, you may request access to information held by Jacobus van zyl under the Promotion of Access to Information Act 2 of 2000 (PAIA). My PAIA Manual, which sets out the procedure for submitting requests, is available on request from my Information Officer.
How to exercise your rights Submit your request in writing to our Information Officer at the email address in Section 1. I will acknowledge your request within 3 business days and respond within 30 calendar days. I may need to verify your identity before processing your request.
10. Security Incidents and Data Breaches
In the event that I become aware of a data breach that involves your personal information and is likely to affect you adversely, I will notify you as soon as reasonably possible and will report the breach to the Information Regulator in accordance with Section 22 of POPIA.
My breach notification will include:
- A description of what occurred
- The categories and approximate number of data subjects affected
- The personal information involved
- The steps I have taken or will take to address the breach
- Recommendations for steps you can take to protect yourself
11. Children’s Personal Information
My services are directed at businesses and adult individuals. I do not knowingly collect personal information from persons under the age of 18 without the consent of a parent or competent person. If you believe I have inadvertently collected personal information about a minor, please contact my Information Officer immediately so I can take appropriate action.
12. AI Tools and Automated Processing
I use artificial intelligence tools, including AI-assisted writing and analysis platforms, to support my work. I am committed to responsible use of these tools in relation to your personal information:
- I apply pseudonymisation techniques before processing any client-related information through AI tools — this means personal identifiers are replaced with codes so that the information cannot be directly linked to you without additional information held separately by me
- I do not enter your full name, contact details, or directly identifying information into AI platforms without your explicit consent
- AI tools do not make decisions about you — they assist me in preparing documentation and analysis, which is always reviewed and approved by me before delivery
13. Use of Your Information for Marketing
I do not send unsolicited marketing communications (spam). If I have engaged with you previously and wish to contact you about our services, I will do so only where I have a lawful basis for doing so, and I will always give you a clear opportunity to opt out of further marketing communications.
To opt out of any marketing communications from me, reply to any such communication with the word “UNSUBSCRIBE” or contact my Information Officer directly.
14. Changes to This Privacy Policy
I review and update this Privacy Policy periodically. Material changes will be notified via my website or by direct communication where appropriate. The version number and date at the top of this policy indicate when it was last updated.
Your continued use of my website or engagement with my services after a material update constitutes your acknowledgement of the revised policy.
15. Contact Me
For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal information, please contact:
Information Officer Jacobus van zyl Email: jacobus@alphadefense.co.za Tel: 0674060823 Website: www.vanzylj.co.za
For formal POPIA requests, please mark your communication: POPIA Data Subject Request — [Nature of Request]
This Privacy Policy was drafted in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Promotion of Access to Information Act 2 of 2000 (PAIA), and applicable South African data protection guidelines issued by the Information Regulator.
Recent Comments