Privacy Policy

1. Introduction

This Privacy Policy explains how OSS Technologies ("OSS", "we", "us") processes personal information when you use the OSS Cloud portal (portal.oss.co.za) and related services such as Secure DNS.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable law. This Policy should be read with our Terms of Service.

2. What personal information we collect

2.1 Information you provide

• Identity and contact details: name, email address, optional phone number.
• Account details: account number, referral code (if any), password (stored as a secure hash).
• Billing-related details needed to process payments and issue invoices.
• Support correspondence you send to us.

2.2 Information collected automatically

• Portal usage logs: timestamps, authenticated actions, approximate IP address, browser/user-agent where logged for security.
• Payment event metadata from our payment provider (reference, status, amounts) via server-to-server notifications.
• Service entitlement records: subscription plan, token identifiers, issue/extend/revoke events, expiry timestamps.

2.3 DNS service operational data

When you use Secure DNS, our infrastructure processes DNS queries necessary to provide the service (queried names, protocol metadata, timestamps, and enforcement of access tokens). We use this to operate, secure, and improve the service and to enforce acceptable use. We do not sell DNS query content to advertisers.

3. Purpose of processing

• Creating and administering customer accounts.
• Authenticating users and securing the portal.
• Processing payments, preventing fraud, and issuing invoices/records of sale.
• Provisioning and renewing paid services (including DNS token lifecycle).
• Providing support and service notices.
• Monitoring abuse, security incidents, and system performance.
• Complying with legal obligations and enforcing our Terms.
• Improving services using aggregated or de-identified metrics where feasible.

4. Lawful basis (POPIA)

• Necessary to conclude or perform a contract with you (account, paid subscription, support).
• Necessary to comply with a legal obligation (e.g. tax/invoice retention).
• Legitimate interests (security, fraud prevention, service integrity), balanced against your rights.
• Consent where required (e.g. optional marketing). Withdrawal of consent does not affect processing that does not rely on consent.

5. Special personal information

We do not intentionally collect special personal information through the standard portal registration flow. Please do not submit such information unless we expressly request it for a lawful purpose.

6. Sharing and operators

We may share personal information with:

• Payment providers (currently PayFast) to process transactions and send payment notifications.
• Infrastructure and hosting providers that process data on our instructions as operators.
• Professional advisers or auditors under confidentiality.
• Authorities when required by law or to protect rights, safety, or security.

Operators who process personal information for us must apply appropriate security measures and process only on our documented instructions.

7. Cross-border transfers

Some subprocessors or infrastructure may process data outside South Africa. Where personal information is transferred outside the Republic, we take steps consistent with POPIA section 72 (for example contractual safeguards and careful provider selection).

8. Security safeguards

• TLS encryption for portal and DoH traffic in transit.
• Hashed passwords; portal JWT sessions separate from DNS access tokens.
• Access controls, logging, and operational hardening.
• Payment-card data is handled by the payment provider; we do not store full card numbers on the portal.

No method of electronic storage or transmission is completely secure. Protect your password and DNS tokens. Report suspected incidents to support@oss.co.za.

9. Retention

• Account and billing records: while the account is active and thereafter as required for legal, tax, and dispute purposes.
• DNS operational logs: limited operational and security period, then deleted or aggregated where practicable.
• Marketing contact data (if any): until you opt out or we no longer need it for that purpose.

10. Your rights as a data subject

Subject to POPIA, you may request to:

• Access personal information we hold about you.
• Correct or update inaccurate information.
• Object to certain processing, or request restriction where applicable.
• Request deletion where POPIA allows.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with the Information Regulator (South Africa).

Requests: privacy@oss.co.za. We may need to verify your identity. We will respond within a reasonable period as required by law.

11. Children

The portal is directed at persons 18 years or older (or authorised business users). We do not knowingly collect personal information from children.

12. Cookies

We use essential cookies or local storage for authentication and security of the portal session. We do not use third-party advertising trackers on the portal as part of the core product. Disabling essential storage may prevent login.

13. Direct marketing

We may send service and transactional messages (payment receipts, security notices) without separate marketing consent. For promotional messages, we will comply with POPIA and CPA requirements, including opt-out.

14. Changes

We may update this Policy periodically. Material changes will be indicated by updating the "Last updated" date and, where appropriate, notifying account holders.

15. Contact and complaints

You may complain to the Information Regulator (South Africa): https://inforegulator.org.za/