POPIA Policy

What personal information the 1map application processes, why, who sees it, how it is protected and how long it is kept, and your rights under the Protection of Personal Information Act.

Version 1.0In force since 2026-09-07

This policy explains how 1map Spatial Solutions (Pty) Ltd ("1map", "we", "us") processes personal information in the 1map web application, the 1map Mobile application, the embeddable 1map Widget and the 1map public API (together "the Service"), and how we meet the Protection of Personal Information Act 4 of 2013 ("POPIA"). It is the notification to data subjects that section 18 of POPIA requires, and our statement of the security safeguards that section 19 requires.

It should be read together with our Privacy Policy, which covers our public websites; our Cookie Policy, which lists everything the application stores in your browser; and our Terms of Service. Where this policy and the Privacy Policy overlap, this policy is the more specific statement of what happens inside the Service.

It applies to everyone whose personal information we process: people who hold an account on the Service; people who use the Service through an account that belongs to their employer or another organisation; visitors to the sign-in and public pages; and people whose personal information appears in data that our customers load into the Service.

The responsible party is 1map Spatial Solutions (Pty) Ltd, registration number 2012/138357/07, of 26 Richter Avenue, Uitzicht, Wellington, Western Cape, South Africa.

Questions, requests and complaints about personal information go to the Information Officer designated for 1map: by email to [email protected], by telephone on +27 (21) 873 0546, or by post to the address above. The Information Officer is responsible for our compliance with POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA"), and for handling requests made under either Act.

"Personal information" is information that relates to an identifiable living person or an identifiable existing company or other legal person, as POPIA defines it: a name, an email address, a telephone number, an IP address, a location, an identifying number, a record of correspondence, and similar.

"Processing" is anything done with personal information, from collecting and storing it to using, sharing, correcting, retaining and deleting it.

"Data subject" is the person the information is about. "Responsible party" is the organisation that decides why and how personal information is processed. "Operator" is an organisation that processes personal information for a responsible party, on its instructions, without becoming responsible for it.

"The Regulator" is the Information Regulator (South Africa), the independent body established under POPIA to oversee both POPIA and PAIA.

"Account" is an organisation's space on the Service. A person signs in as a user and may belong to one or more accounts; the roles granted to them in each account decide what they may see and do there.

We process the following personal information about people who hold a user profile on the Service.

Identity and contact details: email address, first and last name, company, industry, telephone number, cell number (used to send two-factor verification codes), website, country, region, language, time zone, and any comment you give us when you register.

Sign-in credentials: your password, stored only as a one-way hash that cannot be turned back into the password; the secret for two-factor authentication, stored encrypted; and the time your password was last changed.

Records of consent and acceptance: the date and time, the version of the notice or terms you accepted, the IP address you accepted from, and, for the cookie notice, the categories you allowed. These exist so that we can show that consent was given, as section 11(2) of POPIA requires of us.

Sign-in sessions: the IP address, the browser or device, the time you signed in, when you were last active, and which page you were on. An administrator of your account can see these to check who is signed in and to end a session that should not be open.

Audit stamps: every record in the Service carries who created it, who last changed it and who deleted it, and when. This is how the Service keeps an account's data traceable and recoverable.

Subscription and billing details, if you hold a paid plan: company, address, VAT number, the contact name, email address and telephone number for the account, a payment token issued by our payment processor, the last four digits, expiry and holder name of a card, the history of payments, and the reason given for a cancellation. We never hold a full card number; Netcash does.

Location pings from the 1map Mobile application, if your organisation switches on device tracking: the device name and description, the time and the position. This feature is controlled by the account that uses it, and your organisation is the responsible party for deciding to use it.

Technical records: the server logs and error reports the Service writes while it runs, which include IP addresses, the pages and requests made, and the time. The Service uses no analytics, advertising or social-media trackers of any kind.

We do not ask for special personal information as POPIA defines it (for example race, health, religious belief, biometric information or criminal history), and the Service is not designed to hold it. We make no decisions about you by automated means that have legal or similarly significant effects, so section 71 of POPIA is not engaged.

Our customers load their own data into the Service: map layers, attribute tables, attachments, documents and uploads. That data may contain personal information about other people, for example the owners or occupants of properties, the consumers of a municipal service, or the surveyors and land owners named on a Surveyor-General plan lodged through the SG Lodgements application.

For that data the customer is the responsible party and we are the operator, as sections 20 and 21 of POPIA describe. We process it only to provide the Service to that customer and only on the customer's instructions, under written terms that bind us to the safeguards in section 9 of this policy, and we do not use it for any purpose of our own. A request about personal information that appears in a customer's data should be made to that customer; we will help the customer to answer it.

Most of the personal information we hold about you comes from you: when you register, when you edit your profile, when you take out a subscription, and while you use the Service.

If your organisation's administrator creates your profile, the details come from them. If you sign in with Google or Microsoft, we receive your name and email address from that provider when you choose to use it; we receive nothing from them otherwise.

Your browser and device supply the technical records in section 4 automatically. Our payment processor tells us whether a payment succeeded and gives us the token and masked card details described above. When a fibre-coverage lookup is made, the fibre-network operator concerned receives an address or position and returns an answer about coverage.

POPIA allows personal information to be processed only for a specific, lawful purpose and only where one of the grounds in section 11 applies. Ours are the following.

To provide the Service you or your organisation has contracted for: creating and running your profile, signing you in, applying the roles and permissions granted to you, supporting you, and billing a paid plan. The basis is the performance of a contract with you, or with the organisation on whose behalf you use the Service.

To keep the Service and its data secure: verifying identity, sending two-factor codes, limiting sign-in attempts, recording and ending sessions, keeping audit stamps and logs, and investigating misuse. The basis is our legitimate interest, and that of every customer, in a secure service; these records are the minimum needed for that purpose.

To meet our legal obligations: keeping billing and tax records for the periods company and tax law require, keeping records that show consent was given, and responding to lawful requests from authorities.

With your consent, where POPIA requires it: storing optional preferences and diagnostics in your browser, which the cookie notice asks about, and any direct marketing, which section 13 of this policy covers. You may withdraw consent at any time, and we will tell you when a withdrawal has a consequence for what the Service can remember for you.

We do not process personal information for a purpose that is incompatible with the one it was collected for, and we do not sell it.

The administrators of an account you belong to can see your profile details, your roles in that account, whether you are signed in, and your active sessions. That is part of running an account, and it is limited to the account you share with them; an administrator of one organisation cannot see the users of another.

We use a small number of service providers, each acting as our operator under written terms and only for the purpose named: a payment processor (Netcash) for card, debit-order and EFT payments; an email delivery provider for the messages the Service sends; an SMS gateway for two-factor codes; Google or Microsoft, only when you choose to sign in with them; a content delivery and security provider that fronts our web addresses; and the fibre-network operators queried during a coverage lookup, who receive the address or position being looked up and nothing else.

We disclose personal information to a public body, a court or a regulator where the law requires it or where it is necessary to protect the rights of 1map, our customers or the public. We will tell you about such a disclosure where the law allows us to.

We do not share personal information with advertisers, data brokers or analytics providers, because we use none.

Some of the providers named in section 8 may store or process personal information outside South Africa. Where that happens, section 72 of POPIA allows it only if the recipient is subject to a law, binding corporate rules or a binding agreement that protects the information in substantially the same way POPIA does, or if you have consented, or if the transfer is necessary to perform a contract with you. We rely on those conditions and on written terms with each provider, and we will tell you on request where a particular category of information is held.

Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information with appropriate, reasonable technical and organisational measures. The measures built into the Service include the following.

Every connection to the Service is encrypted in transit. Passwords are stored only as one-way hashes using a modern algorithm, and older hashes carried over from previous versions are replaced the next time the person signs in. Two-factor authentication is available for every account, by SMS or authenticator application. Sign-in, registration, password reset and two-factor pages are rate-limited. Password reset links are single-use, expire within an hour and are stored only as a hash.

A session ends when you sign out, after a period of inactivity, and in any case eight hours after sign-in; signing out revokes the session on our servers, and deactivating or removing a user ends every session they hold, including on the mobile application. The browser holds no reusable credential.

Access to data is denied by default and granted through roles and permissions. The separation between accounts is enforced on the server, so that data belonging to one organisation cannot be reached from another. Where a restriction on what a user may see cannot be applied, the Service returns nothing rather than everything.

Every record carries who created, changed or deleted it and when, and deletions are reversible for a period, so that mistakes and misuse can be traced and undone. The Service is monitored, and staff access to production systems is limited to those who need it to run the Service.

The Service is developed under written security rules aligned to the controls of ISO/IEC 27001, and every change is recorded. We say "aligned to" deliberately: 1map is not certified under ISO 27001, and we do not claim to be.

Our operators (section 8) are bound by written agreements to protect personal information to the same standard and to tell us of any compromise, as sections 20 and 21 of POPIA require.

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Regulator and the people affected as soon as reasonably possible after we discover it, subject only to the legitimate needs of law enforcement and to the steps needed to establish the scope of the compromise and restore the integrity of our systems. We notify the Regulator through its online portal, and we notify the people affected by email to the address on their profile or by another means that reaches them, in enough detail for them to protect themselves.

Section 14 of POPIA requires us not to keep personal information longer than the purpose needs, unless the law or a contract requires it or you have consented. Our retention periods are these.

Your profile, credentials and account membership: for as long as your profile exists. When a profile is deleted it is first deactivated, so that the deletion can be reversed if it was a mistake, and is then anonymised, so that the audit stamps on records you created remain intact without identifying you.

Records of consent and acceptance: for as long as your profile exists and thereafter for as long as we may need to show that consent was given.

Sign-in sessions: 30 days after the session ends.

Subscription, payment and billing records: for the period company and tax law require after the last transaction, which is at least five years.

Server logs and error reports: for a limited period, long enough to diagnose faults and investigate security events, after which they are overwritten.

Data loaded by a customer: for as long as the customer keeps it in the Service, and for a short period afterwards in backups.

The Service itself sends only the messages needed to run it: verification links, sign-in and security notices, notices about your subscription and payments, and replies to your requests. Section 69 of POPIA allows electronic direct marketing only with your consent or, for a customer, in respect of similar products or services and with an opportunity to object each time. We will not send you marketing from the Service unless one of those conditions is met, every marketing message will carry a way to opt out, and opting out is honoured immediately.

POPIA gives you the following rights over your personal information. Most of them can be exercised directly in the Service; all of them can be exercised by writing to the Information Officer.

To know what we hold about you and to receive a copy of it (section 23, and PAIA). Your profile page shows most of it; for a full copy, ask the Information Officer. We may ask you to prove your identity first, and PAIA allows a prescribed fee for some access requests.

To have inaccurate, out-of-date or incomplete information corrected (section 24). You can edit your own profile at any time; for anything you cannot edit, ask the Information Officer, or use the Regulator's Form 2.

To have your information deleted or destroyed where we are no longer entitled to keep it (section 24). Ask the Information Officer, or use the Regulator's Form 2. Section 12 of this policy explains what deletion means and what we must retain by law.

To object to processing that relies on our legitimate interests, on reasonable grounds relating to your particular situation, and to object to direct marketing at any time (section 11(3), Regulator's Form 1).

To withdraw consent you have given (section 11(2)(b)). The cookie notice can be reopened from the application to change or withdraw your cookie choices; other consents can be withdrawn by writing to the Information Officer. Withdrawal does not affect processing that happened before it.

Not to be subject to a decision made solely by automated processing that has legal or similarly significant effects for you (section 71). The Service makes no such decisions.

To complain to the Regulator (section 74) if you believe we have interfered with the protection of your personal information. Section 16 gives the Regulator's details. We would ask you to raise the matter with our Information Officer first, so that we can put it right.

We respond to a request within 30 days of receiving it. If we cannot meet a request in full we will tell you why, and what you can do about it.

The Service is intended for organisations and for adults. We do not knowingly create a profile for a person under the age of 18 without the consent of a parent or guardian, as section 35 of POPIA and our Terms of Service require. If you believe a child has given us personal information without that consent, tell the Information Officer and we will remove it.

The Information Regulator (South Africa) can be reached at Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; by telephone on 010 023 5200 or toll-free on 0800 017 160; for general enquiries at [email protected]; for complaints under POPIA at [email protected]; and for complaints under PAIA at [email protected].

This is version 1.0 of this policy, dated 7 September 2026. We will change it when what the Service does changes, and the version and date at the top of the page will change with it. A change that affects the personal information we hold about you, or the purposes we hold it for, will be announced to account holders before it takes effect.