Privacy Policy

How ITRS collects, processes, and protects your personal information — across every jurisdiction we operate in.

Last updated: 27 February 2026  |  Effective: 27 February 2026

Contents

1. Who We Are

ITRS — IT & Risk Services (Pty) Ltd ("ITRS", "we", "our", "us") is a boutique cyber risk management firm headquartered in Cape Town, South Africa. We operate as a Managed Security Service Provider (MSSP) serving small and medium businesses across seven countries.

We act as the responsible party (under POPIA), data controller (under GDPR), or equivalent role under applicable privacy legislation in each jurisdiction where we operate. Our registered details are provided in Section 15 of this policy.

As a cybersecurity firm, we hold ourselves to the highest standard of data protection. Safeguarding personal information is not merely a compliance obligation — it is fundamental to our purpose and reputation.

2. Information We Collect

We collect only the minimum personal information necessary to deliver our services and operate our business. The categories include:

3. How We Collect Information

Directly from you — when you complete our contact form, request a risk assessment, subscribe to communications, or engage us for services.

Automatically — through cookies, server logs, and analytics tools when you interact with our website. You may manage cookie preferences via the banner presented on your first visit.

From third parties — in limited circumstances, we may receive information from referral partners, professional networks, or publicly available business directories, always in compliance with applicable law.

4. Why We Process Your Information

We process personal information for the following purposes: responding to enquiries and consultation requests; delivering our AEGIS cyber risk management services; conducting risk assessments and producing risk quantification reports; fulfilling contractual obligations to clients; maintaining and improving our website and digital services; sending service-related communications (never unsolicited marketing without consent); complying with legal and regulatory obligations; and protecting the security and integrity of our systems and those of our clients.

5. Legal Basis for Processing

Depending on your jurisdiction and the nature of processing, we rely on one or more of the following lawful bases:

Consent — where you have given clear, informed, and voluntary consent (e.g., subscribing to communications or accepting cookies). You may withdraw consent at any time.

Contractual necessity — processing required to perform a contract with you or to take pre-contractual steps at your request (e.g., conducting a risk assessment).

Legitimate interest — processing necessary for our legitimate business interests (e.g., improving our services, ensuring network security, preventing fraud), provided these interests do not override your fundamental rights.

Legal obligation — processing required to comply with applicable laws, regulations, or lawful government requests.

6. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

Technology partners — trusted security vendors whose platforms are integral to service delivery (e.g., endpoint protection, SIEM, vulnerability scanning). Each operates under a Data Processing Agreement with confidentiality obligations at least as stringent as our own.

Infrastructure providers — cloud hosting (Amazon Web Services), email delivery, and analytics services. We select providers with demonstrated compliance certifications (SOC 2, ISO 27001, or equivalent).

Professional advisors — legal counsel, auditors, or insurers where necessary for business operations.

Legal requirements — where we are compelled to disclose information by law, regulation, court order, or lawful government request. We will notify affected individuals where legally permitted to do so.

7. International Data Transfers

As a firm operating across seven countries — South Africa, the United States, the United Kingdom, Australia, New Zealand, the United Arab Emirates, and India — personal data may be transferred between jurisdictions. We ensure all cross-border transfers comply with applicable data protection laws by implementing appropriate safeguards, including Standard Contractual Clauses (SCCs), binding corporate rules, or reliance on adequacy decisions where available.

Our primary data processing infrastructure is hosted in the AWS Cape Town (af-south-1) region. Where data must be processed in other regions for service delivery, we apply equivalent technical and organisational safeguards.

8. Data Retention

We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our retention periods are as follows:

Website enquiries: 24 months from last interaction, then securely deleted.

Client service data: Duration of the engagement plus 5 years, to satisfy regulatory and audit requirements.

Risk assessment reports: Duration of the engagement plus 3 years, unless the client requests earlier deletion.

Financial and billing records: 7 years, as required by tax legislation in our operating jurisdictions.

Cookie and analytics data: Maximum 13 months from collection, in line with privacy best practices.

9. How We Protect Your Data

As a cybersecurity firm, data protection is both our obligation and our expertise. We implement technical and organisational measures aligned to industry-leading frameworks including NIST CSF, CIS Controls v8, and ISO 27001. These measures include:

Encryption of all data in transit (TLS 1.2+) and at rest (AES-256). Multi-factor authentication on all internal systems and client-facing portals. Endpoint detection and response across all company devices. Role-based access controls enforcing the principle of least privilege. Continuous vulnerability management and penetration testing. 24/7 security monitoring through our own AEGIS platform. Documented incident response procedures with defined escalation paths. Regular security awareness training for all personnel. Secure development practices for all web properties and APIs.

No system is entirely immune to risk — we are transparent about this because honesty is a professional obligation. Should a security incident affect your personal data, we will notify you and the relevant supervisory authorities in accordance with Section 13 of this policy.

10. Your Rights

Depending on your jurisdiction, you have some or all of the following rights regarding your personal information:

Right of access — request confirmation of whether we hold your personal data and obtain a copy of it.

Right to rectification — request correction of inaccurate or incomplete personal data.

Right to erasure — request deletion of your personal data where there is no compelling reason for continued processing.

Right to restrict processing — request limitation on how we use your data in certain circumstances.

Right to data portability — receive your personal data in a structured, commonly used, machine-readable format.

Right to object — object to processing based on legitimate interests or direct marketing.

Right to withdraw consent — withdraw previously given consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@itrs-za.com. We will respond within 30 days (or sooner where required by local law). We may need to verify your identity before processing your request. There is no fee for exercising your rights, unless a request is manifestly unfounded or excessive.

11. Cookies & Analytics

Our website uses cookies — small text files stored on your device — to ensure basic functionality and, with your consent, to analyse how visitors interact with our site.

We do not use advertising cookies, tracking pixels, or retargeting technologies. You may manage or revoke your cookie preferences at any time by clearing your browser cookies; you will be prompted again on your next visit.

12. Children's Privacy

Our services are designed for business professionals and are not directed at individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at info@itrs-za.com.

13. Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within the timeframe required by applicable law — 72 hours under POPIA and GDPR, or as otherwise mandated by local regulation.

Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay, providing a clear description of the breach, its likely consequences, and the measures we have taken or propose to take in response.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our website. We encourage you to review this policy periodically.

15. Contact Us & Complaints

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

If you are dissatisfied with our response to a privacy concern, you have the right to lodge a complaint with the supervisory authority in your jurisdiction. In South Africa, this is the Information Regulator (inforegulator.org.za). In the EU/EEA, contact your local Data Protection Authority. In the UK, contact the Information Commissioner's Office (ico.org.uk).

16. Jurisdiction-Specific Provisions

This Privacy Policy was last reviewed on 27 February 2026.
ITRS — IT & Risk Services (Pty) Ltd. All rights reserved.