Privacy & POPIA Policy

ISS Investigations (“ISS”, “we”, “our”, “us”) is a private investigations firm registered and operating in South Africa. We act as the Responsible Party for personal information processed in the course of our investigations, business operations, and client engagements.

Contact our Information Officer at: info@iss-investigations.co.za

We may collect and process the following categories of personal information:

• Identity information: full name, ID number, passport number
• Contact information: phone number, email address, physical address
• Financial information: only where relevant to a financial investigation mandate
• Case-related information: facts, circumstances, and details relevant to your matter
• Communication records: emails, WhatsApp messages, and call logs with our team
• Third-party subject information: personal details about persons relevant to an investigation, obtained lawfully
• Website usage data: basic analytics, IP address, browser type (no cookies beyond functional use)

We do not process special personal information (health, race, religion, biometrics) unless strictly necessary and lawfully authorised for a specific mandate.

We collect and process personal information solely for the following purposes:

• To provide investigative services in terms of a client mandate
• To communicate with you regarding your matter
• To compile reports and findings for your case
• To comply with legal obligations, including PSIRA regulations
• To manage our business relationship with you (invoicing, retainer management)
• To respond to enquiries submitted via our website or contact form

We do not use your personal information for unsolicited marketing, profiling, or any purpose unrelated to your matter or our legitimate business operations.

We process personal information on the following lawful grounds under POPIA:

• Consent: where you have given informed consent to the processing
• Contract: where processing is necessary to fulfil our mandate agreement
• Legitimate interest: where processing is necessary for lawful investigative purposes
• Legal obligation: where processing is required to comply with South African law

We do not sell, trade, or rent your personal information to third parties.

We may share your information only in the following limited circumstances:

• With your attorney or legal representative, at your instruction
• With courts or regulatory authorities, where legally required
• With PSIRA or law enforcement, in compliance with applicable law
• With trusted service providers acting under strict confidentiality agreements (e.g. secure hosting providers)

All operators who handle personal information on our behalf are required to comply with POPIA and maintain appropriate security measures.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• End-to-end encrypted communication channels
• Password-protected and access-controlled case files
• Physical security of paper records where applicable
• Regular review of security practices
• Staff training on POPIA obligations and data handling

In the event of a data breach that poses a risk to your rights, we will notify you and the Information Regulator as required by POPIA.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Client files and case records: 5 years from matter close
• Financial records: 7 years (as required by the South African Income Tax Act)
• General correspondence: 3 years
• Website enquiry data: 12 months

Upon expiry of the retention period, records are securely destroyed or anonymised.

As a data subject, you have the following rights:

• Right of access: to request confirmation of whether we hold your personal information
• Right of correction: to request correction of inaccurate or incomplete information
• Right of deletion: to request destruction or deletion of your information, subject to legal retention obligations
• Right to object: to object to the processing of your personal information in certain circumstances
• Right to complain: to lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact us at info@iss-investigations.co.za. We will respond within 30 days.

Our website uses only functional cookies necessary for basic operation. We do not use tracking cookies, advertising cookies, or third-party analytics that would require your explicit consent.

Basic server-side logs (IP address, browser type, page visits) are retained for security monitoring purposes only and are not linked to personal identities.

We do not transfer personal information outside of South Africa as a standard practice. In the exceptional circumstance that a transfer is necessary, we will ensure adequate protection equivalent to POPIA standards is in place before any transfer occurs.

We may update this Privacy Policy from time to time to reflect changes in law, our operations, or data practices. The current version will always be published on this page with the effective date clearly stated.

Material changes will be communicated to active clients via the contact details on file.

For any privacy-related queries, requests, or complaints, contact our Information Officer:

You also have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.