Privacy Policy

1 Responsibility and contact

ITSA may determine the purpose and means of processing its website, account, supplier, billing and business administration information. For hosted customer files, email, backups or recordings, the customer will normally determine the purpose and ITSA may act as its service provider or processor. The actual contract and activity determine the roles; hosting information does not transfer ownership of it to ITSA.

Privacy requests may be sent to [email protected] with the subject Privacy request, or delivered for the Managing Member to Erf 936, 19 Faraday Street, Unit 22, 1st Floor, Southern Industrial, Windhoek, Namibia. General enquiries may be directed to [email protected]. Do not include passwords, recovery codes or unnecessary sensitive information.

2 Information we handle and where it comes from

Depending on your interaction, we may handle contact and organisation details; authorised-user and account records; quotation, purchase, invoice and payment-reference information; delivery and warranty records; service requirements, licensing and domain information; correspondence and support records; and technical information such as IP addresses, browser details, authentication events and security logs.

Support and project work may require limited access to device configurations, diagnostic records, files, email, backup content or security alerts. For physical systems it may involve recordings or biometric information only where expressly authorised and necessary. Recruitment and employment information is handled for the relevant employment purpose, with access limited accordingly.

Information may come from you, your organisation's authorised representatives, website and service activity, necessary suppliers, payment confirmations or lawful public sources used for verification. If you provide another person's information, you must have authority and provide appropriate notice. We ask for information relevant to the purpose and do not require sensitive datasets through ordinary enquiry forms.

3 Purposes and lawful grounds

We use relevant information to answer enquiries, scope work, prepare quotations, verify accounts and authority, supply and support services, arrange licences and deliveries, manage renewals and payments, investigate incidents and abuse, prevent fraud, maintain required records and establish or defend legal rights.

The applicable basis may be steps requested before a contract, performance of a contract, a legal obligation, consent where required or a legitimate operational or security purpose permitted by applicable law. Where a law requires a specific legal basis or balancing assessment, ITSA must document it. We do not treat this policy as a waiver of privacy rights or a blanket consent to every use. Namibia's constitutional protection of privacy and other applicable duties remain relevant. Foreign privacy laws apply where their territorial or activity requirements are met, rather than merely because a visitor can view the website.

4 Customer service data

Access to customer-controlled information must be limited to authorised work and necessary personnel. The order or a data processing agreement must address documented instructions, confidentiality, safeguards, approved subprocessors and locations, incident notification, assistance with lawful requests, and export or deletion. The customer is responsible for its lawful purpose and instructions; ITSA remains responsible for carrying out its own agreed duties.

Customers must tell us before sending information subject to special confidentiality, localisation, medical, financial, biometric or public-sector restrictions. An infrastructure location does not automatically mean every support log, backup or supplier function is confined to that location. Self-managed server customers administer their own software, access and application privacy notices.

5 Recipients and service providers

Information may be shared with authorised personnel, necessary subcontractors, cloud and hosting providers, technology distributors and manufacturers, licensing partners, couriers, payment service providers, professional advisers and authorities where lawfully required or justified. Sharing must be proportionate to the purpose. A lawful corporate restructuring may involve protected disclosure with appropriate safeguards and notice where required.

Relevant suppliers can include Microsoft for email, collaboration and cloud functions; Hetzner for infrastructure; Cloudflare for website delivery, DNS and security; and the identified cybersecurity manufacturer for a purchased product. Actual suppliers depend on the service. These names identify real technology relationships and do not make their policies ITSA's policies. Supplier-specific information and applicable contract terms must be supplied for the selected service before restricted information is transferred.

6 International processing

International suppliers may store information in, transmit it through or allow support access from countries outside Namibia. ITSA must assess applicable restrictions and use appropriate contractual, organisational and technical safeguards. Where applicable law requires a transfer mechanism, authorisation or specific assessment, it must be completed before transfer. We do not promise that all information stays in Namibia or that every country provides identical protection.

Ask for the proposed locations, providers and transfer arrangements for your workload before ordering. A customer may impose a location restriction only if ITSA accepts it in writing and can meet it across the agreed processing chain.

7 Website technologies and communications

The Cookie Policy explains necessary storage, optional embedded content and available choices. The optional Check Point threat-map embed connects to an independently operated service when enabled. External websites have their own terms and controls. Static fonts, images or vendor assets may also involve technical requests; a cookie choice does not promise anonymous browsing.

Optional marketing requires a separate appropriate basis. You can object to marketing or withdraw consent where relied on, without cancelling an order. Essential communications about an account, quotation, security issue, payment or service renewal may still be sent for their legitimate purpose. We do not use customer-controlled service content for unrelated advertising or to train a general-purpose AI model without separate express authorisation and an appropriate lawful basis.

8 Retention and deletion

Retention depends on purpose, legal duties, contractual commitments, warranties, security needs and the reasonable establishment or defence of claims. ITSA must maintain a proportionate retention schedule and review information that is no longer needed. Accounting and legally required records may need to remain after a service ends. No universal retention period applies to every category.

Hosted data and backups follow the accepted service schedule. Removal from an active system may precede expiry of isolated backup copies, which remain protected and must not be restored for unrelated use. A legal hold may suspend scheduled deletion for the necessary records. Customers should agree export and deletion arrangements before ending a service.

9 Security incidents and access controls

ITSA requires safeguards proportionate to the information and service, including restricted access, suitable authentication, protected transfer and careful credential handling. No system is guaranteed completely secure. Report suspected disclosure or compromise promptly to [email protected] or, for a privacy concern, [email protected].

When an incident affects information ITSA controls, ITSA must assess the impact, contain the incident, preserve relevant evidence and notify affected parties and authorities where applicable law or contract requires. For customer-controlled information, ITSA must notify the customer's authorised contact without undue delay after becoming aware of a relevant breach, subject to lawful restrictions, and provide available information and reasonable cooperation. This policy does not import a universal foreign notification deadline into every Namibian service.

10 Requests complaints and choices

You may ask about information ITSA holds about you, request correction, seek deletion or restriction where appropriate, object to particular processing, withdraw consent where relied on and request a human review of a material AI-assisted decision. Portability and other statutory remedies apply where the relevant law provides them. ITSA will consider reasonable privacy requests even where no specific statutory right applies.

We may verify identity and authority proportionately and may need to protect another person's rights, preserve required records or continue necessary contract processing. We will explain a material refusal or limitation. Our service target is to acknowledge a request within five business days and provide a substantive response within thirty calendar days, or explain a necessary extension, subject to any shorter binding deadline. These are ITSA handling targets, not a statement of a universal statutory period.

You may escalate a concern to the Managing Member, obtain independent advice or approach an authority with jurisdiction or the courts. Internal contact does not remove an external right or stop a legal filing deadline. If a foreign privacy regime applies, its competent supervisory authority and remedies remain available.

11 Children automated decisions and updates

ITSA's commercial website is intended for adults and authorised business representatives. ITSA does not intentionally solicit children's personal information for direct marketing. Educational services involving children require an agreed lawful arrangement with the responsible institution and any necessary guardian authority. Contact us if information about a child was provided in error.

AI-assisted work is subject to the Responsible AI Use Policy. People must oversee decisions materially affecting rights, access or employment; ITSA does not authorise such outcomes solely on unchecked AI output. Material changes to processing must be communicated appropriately. The date on this page identifies this version; publishing an update does not itself authorise a new incompatible purpose or amend a signed customer contract.