Privacy Policy

Effective Date: 1 April 2026 Last Updated: 1 April 2026

This Privacy Policy describes how Servana Pty Ltd, a private company incorporated under the laws of the Republic of South Africa (registration number: 2025/897026/07), with its registered address at 95 OWL ROAD, KIKUYU ESTATE, MIDRAND, GAUTENG, 2090 ("Servana", "we", "us", or "our"), collects, processes, uses, stores, and discloses personal information in connection with the Trustark platform (https://app.gettrustark.com) and the Trustark website (https://gettrustark.com) (collectively, the "Services").

This Privacy Policy is published in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and the Promotion of Access to Information Act 2 of 2000 ("PAIA"), and reflects our commitment to internationally recognised data protection standards, including those established by the General Data Protection Regulation (EU 2016/679) ("GDPR") as best practice.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree to the practices described herein, you must not use the Services.

1. Who This Policy Applies To#

This Privacy Policy applies to:

1.1 Customers — legal entities and individuals who register for and use the Trustark platform under our Terms of Service;

1.2 Authorised Users — employees, contractors, or agents of Customers who access the platform under a Customer account;

1.3 Website Visitors — individuals who visit https://gettrustark.com and any of its subpages without registering an account; and

1.4 Trust Portal Visitors — individuals who access a publicly published customer Trust Portal page through the Trustark platform.

Where a Customer has engaged Servana as an operator (under POPIA) to process personal information on the Customer's behalf, this Privacy Policy describes Servana's obligations in that capacity. The Customer, as the responsible party, is independently responsible for its own privacy compliance.

2. Our Role Under POPIA#

2.1 Responsible Party. Where Servana collects and processes personal information for its own purposes (for example, Account registration data, billing information, and Website analytics), Servana acts as the responsible party as defined in POPIA.

2.2 Operator. Where Servana processes personal information on behalf of a Customer (for example, security posture data, compliance documentation, and vendor information submitted to the Trustark platform), Servana acts as an operator under POPIA, processing such information strictly in accordance with the Customer's instructions and not for its own independent purposes.

2.3 Information Officer. Servana has designated an Information Officer as required by POPIA. The Information Officer's contact details are set out in clause 17 of this Privacy Policy.

3. Personal Information We Collect#

We collect and process the following categories of personal information:

3.1 Account and Identity Information

When you register for an Account, we collect:

• Full name and surname
• Business email address
• Job title and role
• Organisation name and industry
• Organisation website (where provided)
• Password (stored in hashed and salted form; we do not have access to plaintext passwords)

3.2 Billing and Payment Information

Where subscription fees are applicable:

• Billing name and address
• Payment method details (processed by our third-party payment processor; Servana does not store full payment card numbers)
• VAT registration number (where applicable)
• Invoice history

3.3 Security Posture and Compliance Data

Data submitted by Customers and Authorised Users in the course of using the platform, which may include:

• Security control statuses and assessments
• Compliance evidence documentation and artefacts
• Risk register entries
• Vendor and third-party information
• Compliance framework alignment data

This data may incidentally contain personal information about employees, contractors, and third parties. Customers are responsible for ensuring they have a lawful basis for submitting such data to the platform.

3.4 Usage and Technical Data

We automatically collect certain information when you access or use the Services:

• IP address
• Browser type, version, and operating system
• Device type and screen resolution
• Pages visited, features used, and time spent on the platform
• Referring URL
• Authentication logs and session metadata
• Error logs and crash reports

3.5 Communications Data

When you contact us by email, chat, or contact form:

• Name and email address
• The content of your communications
• Metadata associated with such communications (timestamp, channel)

3.6 Trust Portal Visitor Data

When individuals visit a publicly accessible Customer Trust Portal page:

• IP address (hashed prior to storage)
• Browser user agent
• Referring URL
• Time and date of the visit

No personally identifiable information is retained in relation to Trust Portal visits. IP addresses are hashed using a one-way cryptographic function before storage.

3.7 Cookie and Tracking Data

Information collected through cookies and similar technologies as described in clause 13.

4. How We Collect Personal Information#

We collect personal information through the following means:

4.1 Directly from you — when you register an Account, complete forms on the Website, contact our support team, respond to surveys, or interact with the platform.

4.2 Automatically — when you access or use the Website or platform, through server logs, analytics tools, and cookies.

4.3 From third parties — including identity verification services, public business registries, marketing partners (where applicable), and single sign-on providers where you authenticate using a third-party identity provider.

4.4 From Customers — in our capacity as an operator, we receive personal information as submitted to the platform by Customers and Authorised Users.

5. Purposes of Processing#

5.1 As Responsible Party

We process personal information for the following purposes:

5.2 As Operator

Where we act as operator on behalf of a Customer, we process personal information only for the purposes of:

• Providing the contracted Services to the Customer;
• Maintaining the security and integrity of the platform; and
• Complying with applicable law.

We do not use Customer-submitted data for our own independent marketing, analytics (beyond anonymised usage metrics), or any purpose beyond what is required to deliver the Services.

6. Legal Basis for Processing#

Under POPIA and aligned with GDPR best practice, we process personal information on the following lawful grounds ("conditions for processing"):

6.1 Performance of a contract — processing is necessary to perform our obligations under the Terms of Service, including providing the platform to Customers and Authorised Users.

6.2 Compliance with a legal obligation — processing is necessary to comply with applicable law, including POPIA, ECTA, tax legislation, and financial regulations.

6.3 Legitimate interests — processing is necessary for Servana's legitimate interests (or those of a third party), provided such interests are not overridden by the interests, rights, or freedoms of the data subject. This includes fraud prevention, security monitoring, service improvement, and direct marketing to existing customers.

6.4 Consent — where we rely on consent as the basis for processing (for example, in connection with marketing communications or non-essential cookies), we will obtain consent explicitly and maintain a record of such consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

6.5 Public interest — in limited circumstances, processing may be necessary for purposes in the public interest as contemplated under POPIA.

7. How We Use Personal Information#

In addition to the purposes set out in clause 5, we use personal information to:

7.1 verify your identity and authenticate your access to the platform;

7.2 communicate with you about your Account, subscription, and the Services, including service announcements, security alerts, and administrative messages;

7.3 send product and feature updates, newsletters, and marketing communications, where you have provided consent or where we have a legitimate interest and you have not opted out;

7.4 comply with legal and regulatory obligations, including responding to lawful requests from law enforcement or regulatory authorities;

7.5 enforce our Terms of Service, Terms of Use, and other applicable policies;

7.6 detect, investigate, and prevent fraudulent, unauthorised, or illegal activity;

7.7 generate anonymised, aggregated statistics for the purpose of improving the Services and conducting market research; and

7.8 facilitate mergers, acquisitions, or other business transactions, subject to appropriate confidentiality protections.

8. Data Retention#

8.1 We retain personal information only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable law.

8.2 The following retention periods apply as a general guide:

8.3 Where we are required by law to retain personal information for longer than the periods set out above, we will comply with such legal requirements.

8.4 Upon expiry of the applicable retention period, we will securely delete or irreversibly anonymise personal information in accordance with our internal data destruction procedures.

9. Sharing of Personal Information#

We do not sell personal information. We may share personal information with third parties in the following circumstances:

9.1 Service Providers and Sub-operators

We engage reputable third-party service providers to assist in operating the Services. These providers act as sub-operators under POPIA and are contractually bound to process personal information only on our instructions and to maintain appropriate security measures. Categories of sub-operators include:

• Cloud infrastructure providers — for hosting the platform and storing data (including Supabase for database and file storage)
• Authentication providers — for identity management and access control
• Payment processors — for billing and subscription management
• Email and communication providers — for transactional and marketing communications
• Analytics providers — for website and platform usage analysis
• Customer support tools — for managing support interactions

We maintain an up-to-date register of sub-operators, available on request.

9.2 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of Servana's assets, personal information may be transferred to the acquiring entity as part of such transaction. We will provide notice of such a transfer and, where required, seek your consent.

9.3 Legal Obligations

We may disclose personal information where required to do so by applicable law, court order, or lawful request from a governmental or regulatory authority (including the Information Regulator of South Africa), provided we take reasonable steps to notify you of such disclosure where legally permissible.

9.4 Protection of Rights

We may disclose personal information where we reasonably believe it is necessary to: (a) protect the rights, property, or safety of Servana, its customers, or the public; (b) detect or prevent fraud or other illegal activity; or (c) enforce our terms and policies.

9.5 With Your Consent

We may share personal information with third parties where you have given your prior informed consent to such sharing.

10. International Data Transfers#

10.1 The Services are operated from South Africa. However, our sub-operators and service providers may store or process personal information in other countries, including within the European Union, the United Kingdom, and the United States of America.

10.2 Where personal information is transferred outside the Republic of South Africa, Servana ensures that such transfers comply with section 72 of POPIA, which requires that the recipient country provides an adequate level of protection, or that an appropriate agreement incorporating adequate safeguards (such as standard contractual clauses or binding corporate rules) is in place.

10.3 By using the Services, you acknowledge that your personal information may be transferred to and processed in countries outside South Africa. We take reasonable steps to ensure that your personal information receives equivalent protection wherever it is processed.

11. Security Measures#

11.1 Servana implements and maintains appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

    (a) Encryption in transit and at rest — all data transmitted to and from the Services is encrypted using industry-standard TLS. Data at rest is encrypted using AES-256 or equivalent standards.

    (b) Access controls — strict role-based access controls restrict access to personal information to personnel with a legitimate need. Privileged access is subject to multi-factor authentication.

    (c) Audit logging — all access to personal information is logged in a tamper-evident audit log.

    (d) Vulnerability management — we conduct regular security assessments and apply security patches on a timely basis.

    (e) Incident response — we maintain a documented security incident response plan and conduct periodic drills.

    (f) Employee training — all personnel with access to personal information are trained on data protection obligations and security practices.

11.2 Notwithstanding the foregoing, no method of electronic transmission or storage is entirely secure. We cannot guarantee absolute security and do not accept liability for breaches that are outside our reasonable control.

11.3 You are responsible for maintaining the security of your Account credentials and for notifying us immediately upon becoming aware of any suspected unauthorised access to your Account.

12. Your Rights Under POPIA#

As a data subject under POPIA, you have the following rights in respect of personal information that Servana processes about you in its capacity as responsible party:

12.1 Right of Access (section 23 of POPIA / PAIA). You have the right to request confirmation of whether Servana holds personal information about you and to request access to such information. Access requests are governed by PAIA, and our PAIA Manual is available upon request.

12.2 Right to Correction (section 24 of POPIA). You have the right to request that we correct, update, or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.

12.3 Right to Object (section 11(3) of POPIA). You have the right to object, on reasonable grounds, to the processing of your personal information. Where processing is based on legitimate interests or direct marketing, you may object at any time and we will cease processing unless we have compelling legitimate grounds.

12.4 Right to Withdraw Consent. Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

12.5 Right to Complain. You have the right to lodge a complaint with the Information Regulator of South Africa if you believe that Servana has processed your personal information in violation of POPIA.

    Information Regulator contact details:     Website: https://inforegulator.org.za     Email: inforeg@justice.gov.za     Telephone: +27 (0)10 023 5207

12.6 Right to Erasure. You may request that we delete your personal information where it is no longer necessary for the purposes for which it was collected, subject to Servana's legal obligations to retain certain information.

12.7 Right to Data Portability. Where technically feasible and legally required, you may request that we provide a copy of your personal information in a structured, commonly used, machine-readable format.

12.8 How to Exercise Your Rights. To exercise any of the above rights, please submit a written request to our Information Officer at hello@servanaplatforms.com. We will respond within a reasonable period and, in any event, within thirty (30) days of receiving a valid request, as required by POPIA. We may request verification of your identity before processing your request.

13. Cookies and Tracking Technologies#

13.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work more efficiently and to provide information to website operators.

13.2 Cookies We Use

We use the following categories of cookies:

13.3 Managing Cookies

You may manage your cookie preferences through:

• Browser settings — most browsers allow you to block or delete cookies. Note that disabling strictly necessary cookies will affect the functionality of the Services.
• Cookie consent tool — where available, you can manage non-essential cookie preferences through the cookie consent banner displayed when you first visit the Website.
• Opt-out tools — for Google Analytics, you may use the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout.

13.4 Do Not Track

We do not currently respond to browser-based Do Not Track ("DNT") signals, as there is no consistent industry standard for DNT compliance. We do, however, respect cookie consent choices made through our consent tool.

13.5 Third-Party Tracking

The Website may contain pixels, beacons, or tags from third-party services, including analytics and advertising providers. These third parties may collect information about your online activities over time and across different websites. Their collection and use of information is governed by their own privacy policies.

14. Children's Personal Information#

14.1 The Services are not directed at children under the age of eighteen (18) years. We do not knowingly collect personal information from individuals under the age of eighteen (18).

14.2 If you are a parent or guardian and you believe that a child under eighteen (18) has provided us with personal information without your consent, please contact us at hello@servanaplatforms.com immediately. We will promptly investigate and, where confirmed, delete such information.

14.3 Where any product or feature of the Services would be used in a context involving children's personal information, the Customer (as responsible party) is solely responsible for ensuring compliance with all applicable laws governing the processing of children's personal information, including obtaining appropriate parental or guardian consent.

15. Personal Information Breach Notification#

15.1 In the event that Servana becomes aware of a security compromise of personal information that poses a real risk of harm to data subjects ("Security Compromise"), Servana will:

    (a) notify the Information Regulator of South Africa as soon as reasonably possible in accordance with section 22 of POPIA;

    (b) notify affected data subjects (or Customers acting as responsible parties) as soon as reasonably possible, and in any event within seventy-two (72) hours of becoming aware of the Security Compromise, where required by POPIA or applicable law;

    (c) provide reasonable information about the nature of the Security Compromise, the categories of personal information affected, the likely consequences, and the steps taken or proposed to address it.

15.2 Servana maintains a documented security incident response plan and has designated personnel responsible for managing Security Compromises.

15.3 Notification may be delayed where required by law enforcement authorities investigating the Security Compromise, for such period as is required.

16. Amendments to This Privacy Policy#

16.1 Servana reserves the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, the Services, applicable law, or regulatory requirements.

16.2 Where we make material changes to this Privacy Policy, we will notify you by: (a) posting the updated Privacy Policy at https://gettrustark.com/privacy with a revised effective date; and (b) where reasonably practicable, sending an email notification to the primary contact email address associated with your Account.

16.3 Your continued use of the Services following the publication of an updated Privacy Policy constitutes your acceptance of the changes, subject to applicable law.

16.4 We encourage you to review this Privacy Policy periodically to stay informed of how we protect your personal information.

17. Contact Information and Information Officer#

If you have any questions, concerns, or requests relating to this Privacy Policy or Servana's processing of your personal information, please contact:

Information Officer Mthawelanga Ngcakani Servana Pty Ltd

Email: hello@servanaplatforms.com Postal Address: 95 OWL ROAD, KIKUYU ESTATE, MIDRAND, GAUTENG, 2090

General Legal Enquiries: hello@servanaplatforms.com General Support: support@servanaplatforms.com

Servana Pty Ltd Registration Number: 2025/897026/07 Registered Address: 95 OWL ROAD, KIKUYU ESTATE, MIDRAND, GAUTENG, 2090 Website: https://gettrustark.com

18. PAIA Manual#

In accordance with section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), Servana has compiled a PAIA Manual, which describes the records held by Servana, how to make access requests, and applicable fees. The PAIA Manual is available upon written request to hello@servanaplatforms.com.

This Privacy Policy was last reviewed and approved by the Information Officer of Servana Pty Ltd on 1 April 2026.