Privacy notice
How SMC IT Solutions collects, uses and protects personal information under the Protection of Personal Information Act (POPIA).
1. Who we are
SMC IT Solutions (Pty) Ltd (registration number 2012/004131/07) ("SMC IT", "we", "us") is a Microsoft cloud and managed services provider. For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), we are the responsible party for personal information we collect about you, except where we process personal information on behalf of our clients (see section 5).
| Registered address | 1305 Gardens Centre, Gardens, Cape Town, 8001 |
|---|---|
| Operating office | Pretoria North, Gauteng |
| Information Officer | Sadhasivan Chetty (Managing Director) |
| privacy@smcit.co.za | |
| Phone | +27 21 013 3010 |
2. Scope
This notice explains how we handle personal information when you visit smcit.co.za, contact us, become a client or supplier, apply to work with us, or receive our communications. "Personal information" has the meaning given in POPIA and includes information about identifiable juristic persons (companies).
3. Information we collect
| Who | What we collect | Source |
|---|---|---|
| Website visitors & enquirers | Name, company, work email, phone number, the service you are interested in, the content of your message; technical data such as IP address, browser type and pages requested. | You, via our contact form or email; our hosting provider's server logs. |
| Clients & client staff | Contact and billing details, company registration and VAT numbers, order and subscription history, support tickets, and user account details (names, email addresses, licence assignments) needed to provide Microsoft 365 and Azure services. | You or your organisation; Microsoft partner and billing systems. |
| Suppliers & partners | Contact details, company information, banking details for payment, B-BBEE certificates. | You or your organisation. |
| Job applicants & contractors | CV, qualifications, certifications, references and contact details. | You; referees you nominate. |
We do not intentionally collect special personal information (such as health, religious or biometric information) or personal information of children through this website. Please do not include such information in your enquiries.
4. Why we use it and our lawful basis
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Responding to enquiries and preparing quotes | Your consent, and steps you ask us to take before entering a contract |
| Delivering services, licences, support and billing | Performance of our contract with you or your organisation |
| Accounting, tax, B-BBEE and other statutory records | Compliance with legal obligations |
| Website security, fraud prevention and troubleshooting | Our legitimate interest in keeping our systems secure |
| Recruitment | Steps you ask us to take, and our legitimate interest in hiring |
| Sending service updates and insights by email | Existing clients: our legitimate interest, with an opt-out in every message. Everyone else: only with your prior opt-in consent (POPIA s69) |
We do not sell personal information, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
5. When we process data for our clients
When we manage a client's Microsoft 365 or Azure environment, we may have access to personal information belonging to that client's staff and customers. In that role we act as an operator (POPIA s20–21): we process it only on the client's documented instructions, keep it confidential and secure, and notify the client of any security compromise. The client remains the responsible party, and its own privacy notice applies. The terms are set out in our Master Services Agreement.
6. Who we share it with
We share personal information only where needed for the purposes above, with:
- Microsoft (including Microsoft 365, Azure and the Microsoft Partner Center) to provision and manage services and licences;
- our distributor for Microsoft cloud subscriptions, for ordering and billing;
- business systems we use for accounting, invoicing and email (for example Zoho Books and Microsoft 365);
- our website hosting provider;
- professional advisers (accountants, auditors, lawyers) under a duty of confidentiality;
- regulators, SARS, courts or law-enforcement agencies where the law requires it.
Our service providers act as operators under written agreements that require them to protect your information.
7. Transfers outside South Africa
Some of our providers store or process data outside South Africa (for example in the European Union or the United States). Where we use Azure or Microsoft 365, we choose South African data-centre regions wherever the service allows. Any cross-border transfer takes place only where the recipient is bound by law, binding corporate rules or a written agreement that provides an adequate level of protection, or where another ground in POPIA section 72 applies.
8. How long we keep it
- Website enquiries that do not lead to business: up to 24 months after our last contact.
- Client, contract and financial records: for the duration of the relationship and at least 5 years after it ends, as required by tax and company law.
- Unsuccessful job applications: 12 months, unless you ask us to delete them sooner.
- Server logs: up to 90 days.
After these periods we delete, destroy or de-identify the information (POPIA s14).
9. How we protect it
We apply the same security standards we implement for our clients, including multi-factor authentication and Conditional Access on all staff accounts, role-based least-privilege access, encryption in transit and at rest, endpoint protection, logging and regular access reviews (POPIA s19). If we have reasonable grounds to believe your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as required by POPIA section 22.
10. Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you and request a copy of it (POPIA s23, read with our PAIA manual);
- ask us to correct, update or delete inaccurate, irrelevant, excessive, out-of-date or unlawfully obtained information (s24);
- object to processing based on our legitimate interests (s11(3));
- withdraw consent at any time, without affecting processing that took place before;
- opt out of direct marketing at any time, using the unsubscribe link or by emailing us;
- lodge a complaint with the Information Regulator.
Send requests to privacy@smcit.co.za. We will verify your identity, then respond within 30 days. You may use the prescribed forms in the POPIA Regulations (Form 1 for objections, Form 2 for correction or deletion), though a clear email is enough.
11. Cookies
Our website uses only strictly necessary technical storage and no advertising or tracking cookies. Details are in our cookie notice.
12. Complaints
Please contact our Information Officer first so we can try to resolve your concern. You also have the right to complain directly to the regulator:
The Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Tel 010 023 5200 · toll-free 0800 017 160 · POPIAComplaints@inforegulator.org.za (POPIA) · PAIAComplaints@inforegulator.org.za (PAIA) · inforegulator.org.za
13. Changes to this notice
We may update this notice from time to time. The version and date at the top of the page show when it last changed. Material changes will be highlighted on this page.