Privacy &
POPIA Notice.

We collect personal information in three contexts:

• Website enquiries — when you complete the contact form, we collect your name, email address, company (optional) and the contents of your message.
• Estate access systems (KT-Gateway, KT-Visitor, KT-Watch) — when a KLEVA TECH system is installed at an estate or facility, the system processes vehicle registrations, visitor identifiers, access events and CCTV footage as configured by the responsible party (typically the estate body corporate or facility owner). KLEVA TECH acts as an operator on their behalf.
• Smart monitoring telemetry (KT-Pulse, KT-Trace, KT-Alert) — sensor, asset and livestock telemetry that does not normally include personal information. Where alert delivery uses personal contact details (e.g. on-call phone numbers, WhatsApp), those details are stored only for the purpose of routing alerts.

• Consent — you tick the POPIA consent box before submitting an enquiry. You may withdraw consent at any time by emailing carl@klevatech.co.za.
• Contractual necessity — to deliver the system or service you have engaged us for.
• Legitimate interest — system security, audit trails, fraud prevention and the continuity of our own business.
• Legal obligation — where retention is required by law (e.g. financial records, estate access logs disclosable to law enforcement on lawful request).

We do not sell personal information. We share it only with:

• Sub-processors we use to deliver the website and supporting services — currently Vercel (hosting), Resend (transactional email) and Cloudflare (optional bot protection). Each is contractually bound to POPIA-aligned processing terms.
• The responsible party that owns the system — for estate access and smart monitoring installations, the body corporate or facility owner remains the data controller and decides who may view system data.
• Law enforcement, only when compelled by a lawful order such as a subpoena or warrant.

Website data sits with our hosting providers, which may process traffic outside South Africa. Where data crosses borders we rely on the providers' standard contractual safeguards under section 72 of POPIA. On-site system data (access events, CCTV) stays on the client's own infrastructure unless they elect cloud sync.

• Enquiry messages — up to 24 months from last contact, then deleted.
• System logs (access events, telemetry) — retained per the client's configuration, typically 30 to 365 days.
• Records required by law (tax, financial) — kept for the periods required by South African legislation.

Under POPIA you have the right to:

• Know what personal information we hold about you.
• Request correction or deletion of inaccurate information.
• Object to processing on reasonable grounds.
• Withdraw consent at any time for processing based on consent.
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

We apply the technical and organisational measures appropriate to the data we process — HTTPS everywhere, HSTS-preloaded transport, CSP and X-Frame-Options on every response, rate-limited contact endpoints, server-side validation, encrypted secrets and audited access to deployment infrastructure.

The public website uses no analytics, no advertising trackers and no third-party cookies. The contact form may include a Cloudflare Turnstile challenge that sets short-lived cookies for bot mitigation; these are described on Cloudflare's documentation.

For any privacy enquiry, data subject request, or to withdraw consent, email carl@klevatech.co.za. We will respond within 30 days.