Privacy notice

Responsible party

The responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) is Hartbeat Tech, which operates ClearSource in South Africa (see the imprint). For privacy requests, write to us through the contact form and choose the topic “Privacy request”.

Information Officer: the operator’s Information Officer handles privacy requests and dealings with the Information Regulator. You reach the Information Officer through the same contact form and topic. The Information Officer’s name is not stated yet.

This notice explains what personal information ClearSource processes, for what purpose and on what lawful ground, who receives it, where it is processed, how long it is kept and what your rights are. Under POPIA, personal information includes information about an identifiable, existing company or other juristic person, not only about natural persons.

What is processed when you visit

Our hosting and security provider delivers the site. Its logs for that delivery can include your IP address, browser (user agent), referrer and the page requested. Lawful ground: the legitimate interest in delivering a working and secure website (POPIA section 11(1)(f)).

ClearSource sets no analytics cookies. From the requests it delivers, our hosting provider compiles aggregate statistics for us, such as the number of visits, the pages requested, countries and device types. They are not linked to a person and are not used to build a profile. ClearSource’s own statistics of page views and clicks are described in the next section. Fonts, logos and images are served from this site.

Aggregate statistics and partner links

ClearSource records on its own server how the site is used: which pages are viewed; which marked buttons and links are clicked (for example an IT partner’s website, telephone or email link, a comparison, the change-log feed, the cost calculator’s buttons) and, for a link to another website, only that website’s host name (such as example.co.za); what is searched for with the site search; and a small fixed set of events (opening and exporting the cost calculator, viewing a comparison or an IT-partner profile, switching language). For the first page you open, the website you came from is recorded by its host name only (such as google.com or chatgpt.com), never the address of the page you were on. Search queries are stored normalised (lower case, at most 60 characters); a query that contains an @ sign or more than six digits is not recorded at all. Text you enter in forms and seat counts are never recorded.

Each record holds only the page, the day, the language and the item above. No IP address, no browser details (user agent), no cookie and no identifier are stored with it, and nothing is stored on your device, so records cannot be linked to each other or to a person: they are statistics, not personal information. The request that reports an event is delivered like any page request (see “What is processed when you visit”); its IP address is used only briefly, in memory, to limit the number of requests per minute. If your browser sends Global Privacy Control or Do Not Track, page views, clicks and searches are not recorded.

The single records are stored with our hosting provider (see “Service providers and transfers outside South Africa”) and deleted after three months; daily totals of the fixed events are kept in ClearSource’s database in Europe. They show which parts of the site are used, what people look for and how many visits IT partners receive from it. Figures reported to IT partners contain only totals, and figures below 5 are not shown.

If the address of the page you arrive on contains campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), for example from a newsletter or an advertisement, source, medium and campaign are recorded too. These tags name a campaign, not a person.

Links to IT partners’ websites go through ClearSource’s own address clearsource.co.za/go/…, which counts the click in the same aggregate way and then forwards you to the partner’s website. The partner receives only the address of this site (https://clearsource.co.za/, not the page you were on) as the referring page, plus the tags utm_source=clearsource, utm_medium=referral and a utm_campaign that names where the link was placed. No other information about you is passed to the partner.

Licence cost calculator

The licences you pick in the cost calculator are calculated in your browser and kept in the page address (the “?m=…” part), so a link can be shared or reopened. Your current model and any scenarios you save are also kept in your browser’s local storage on your device. ClearSource does not receive or store your selection.

Contact form

The contact form asks for your name, company, business email address, a topic and your message, and optionally a telephone number. ClearSource uses these details only to answer you; they are never passed to IT partners. Lawful ground: your consent, which you give with the checkbox (POPIA section 11(1)(a)). Providing the details is voluntary, but without them we cannot answer you.

Double opt-in: after you send the form, we email you a link, and your message reaches us only after you confirm it. Until then it is stored in our database (see “Service providers and transfers outside South Africa”). The confirmation email is sent by our email service in the European Union; the confirmed message is delivered to our mailbox.

Protection against spam: the form runs automatic checks against spam and bots, such as a limit on how often one IP address can send and a check that your email domain can receive email (only the domain is looked up, never your full address). If a security check is shown, our hosting and security provider processes technical data of your browser (such as IP address and browser type) to detect bots, on our behalf and, to improve its bot detection, as an independent responsible party; it never reads what you enter.

Retention: the confirmation link is valid for 24 hours, and a message that is not confirmed is deleted after 7 days at the latest. A confirmed message is removed from the database once delivered and kept in our mailbox only as long as needed to deal with your request. Our email log keeps only a one-way hash of your address, never the address itself.

Cookies and local storage

ClearSource sets no analytics or advertising cookies. It uses cookies only where a function you use needs them: if you choose a language in the “Language” menu, a technical session cookie remembers that language until you close your browser; if a browser or security check is shown, a technical cookie records that it was passed (see “Security safeguards and data breaches”).

Some choices are kept in your browser’s local storage on your device: your light or dark theme, whether partner logos are shown, your licence model and saved scenarios, the IT-partner directory’s view settings and comparison list, and the naming pattern for admin groups in the licence table. They stay on your device and are not sent to ClearSource. None of this is used to build a profile or for direct marketing.

You can block or delete cookies and local storage in your browser settings. The site still works without them, but your choices are then not remembered.

IT partner directory

The directory shows information about companies, each with the public sources it comes from. It contains no records about you as a visitor.

If you tick IT partners to compare them, the list (at most four) and your view settings stay in your browser’s local storage and are not sent to ClearSource. The comparison page lists the chosen IT partners in its address, so you can share it.

Information about listed IT partners

POPIA protects the personal information of companies and other juristic persons as well as that of natural persons, so the directory processes personal information of the IT partners it lists: the company’s trading and registered names, its registration number as the company publishes it, its offices, its company telephone number and email address, its website, its languages, its Microsoft partner programmes and designations, its services and, where the company publishes a valid certificate or sworn affidavit, its B-BBEE level with the document’s details. ClearSource lists company-level contact details only: it does not list directors, owners or employees by name, or their personal telephone numbers or email addresses.

Sources: Microsoft’s partner directory and the company’s own website, including documents it publishes there. Each entry shows its sources. ClearSource collects this information from these sources rather than from the company because the company has deliberately made it public (POPIA section 12(2)(a)).

Purpose and lawful ground: to show businesses which IT partners in South Africa sell Microsoft licences and how to reach them. This serves the legitimate interests of businesses looking for a supplier, of the listed companies and of ClearSource (POPIA section 11(1)(f)). Being listed is free. The directory pages are public: search engines and AI services can read them, show them in their answers and use them to train AI models (see the terms of use).

If your company is listed, you can object to the listing at any time on reasonable grounds relating to your particular situation (POPIA section 11(3)(a)), and ask for an entry to be corrected or deleted (section 24): write to us through the contact form and choose the topic “Data correction” or “Privacy request”. We then check the entry and correct or remove it. ClearSource does not send listed companies marketing messages.

Service providers and transfers outside South Africa

ClearSource uses service providers that process personal information on its behalf (operators under POPIA): for hosting, security and the aggregate statistics (provider in the USA, with data centres worldwide; each request is usually served from the one nearest you, which can be in South Africa or another country), for its database (provider based in the USA; data stored in Europe), for sending email (European Union) and for its mailbox. The database and the mailbox are in Europe.

Our operators process personal information only on our instructions and under written agreements that require them to keep it confidential and to protect it with appropriate security measures (POPIA sections 20 and 21). Where a provider also acts as an independent responsible party, this notice says so.

These countries are outside South Africa. We transfer personal information to them only where POPIA section 72 allows it: where the recipient is bound by a law, binding corporate rules or a binding agreement that provides an adequate level of protection, as the data-protection laws in Europe and the providers’ data-processing agreements do; where the transfer is necessary to do what you asked for, such as sending you a confirmation email; or with your consent. For a provider based in the USA, the safeguard is its binding data-processing agreement with us.

On request, we tell you which providers process your personal information and where.

Security safeguards and data breaches

We protect personal information with appropriate, reasonable technical and organisational measures (POPIA section 19): encrypted connections, a database that denies access by default and is reached only through our server, administrator accounts with two-step verification, a log of administrative changes, and short retention periods.

To keep the site available and protect its content from automated copying, our security provider checks requests to the site on our behalf (IP address, browser and page requested), limits very frequent requests and filters attacks. Verified search-engine and AI crawlers are not counted towards this limit. If a browser check is shown, a technical cookie records that it was passed. Lawful ground: the legitimate interest in a secure site (POPIA section 11(1)(f)). This is not combined with the aggregate statistics and is not used to build a profile. Request counts expire after a few seconds; the site’s own security logs (IP address, browser and request) are kept for at most seven days.

If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.

Retention

We keep personal information only as long as needed for the purpose for which it was collected, unless the law requires or allows us to keep it longer (POPIA section 14). Our hosting provider keeps its logs for a short period as part of operating its network; the site’s own logs are deleted after at most seven days, and request counts expire on their own. Contact-form messages are kept as described under “Contact form”. A directory entry is kept while the company is listed, together with the sources it is based on.

Requests by automated visitors, such as search-engine and AI crawlers, are recorded by the name their software gives (for example Googlebot or GPTBot), with the address requested, the response status and the day, without an IP address, and kept for three months.

Direct marketing

ClearSource does not use personal information for direct marketing: it sends no newsletters and no marketing messages by email, SMS or telephone, whether to visitors or to listed companies. If this changes, we will first ask for your consent where POPIA section 69 requires it, and every message will name ClearSource and let you opt out free of charge.

Sale of personal information

Personal information is not sold or rented, and it is not passed on for others’ marketing.

Your rights

Under POPIA you have the right to: ask whether we hold personal information about you, free of charge, and ask for a record or description of it (section 23); ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy or delete a record we are no longer authorised to keep (section 24); object to processing based on legitimate interests (section 11(3)(a)) and to processing for direct marketing (section 11(3)(b)); and withdraw your consent at any time, without affecting processing that took place before (section 11(2)(b)). ClearSource takes no decisions about you based solely on automated processing (section 71).

To exercise a right, write to us through the contact form and choose the topic “Privacy request”. We may ask you to confirm your identity before we act on a request. We answer within a reasonable time and at the latest within 30 days. You can also institute civil proceedings (POPIA section 99).

Complaints to the Information Regulator

If you believe that ClearSource interferes with the protection of your personal information, you can lodge a complaint with the Information Regulator (POPIA section 74). We ask you to contact us first so that we can try to put it right, but you do not have to.

Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Complaints, on POPIA Form 5: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za, 010 023 5200. Website: inforegulator.org.za.

Access to information (PAIA)

Under the Promotion of Access to Information Act 2 of 2000 (PAIA), you can request access to records the operator holds, subject to the grounds for refusal in that Act. Send your request to the Information Officer: write to us through the contact form and choose the topic “Privacy request”. No PAIA manual is published on this site yet.

Changes to this notice

We update this notice when our processing changes. The version published on this page applies; the date of its last update is shown at the top of the page.