Privacy Notice (POPIA) & Community CCTV Programme

2.1 Website & customer data

• Contact details (name, email, phone), account credentials, billing/delivery addresses.
• Billing & payment metadata (invoice details; we do not store full card numbers).
• Support correspondence and call notes.
• Device & usage data: IP address, browser/OS, pages viewed, cookie preferences, diagnostics.

2.2 CCTV programme data

• Video images of public streets/sidewalks and vehicles in view; no audio is recorded.
• Event metadata: timestamps, camera ID, AI event types (e.g., person/vehicle), audit logs.
• Access control: name, email/phone, role, access times, activity logs.

2.3 Sensitive categories we avoid

• No facial recognition or biometric identification.
• Privacy masks applied to avoid filming into windows/private yards.

• Directly from you (accounts, subscriptions, support).
• Automatically via our website/app (cookies, logs).
• From cameras positioned on private property aimed at public streets/sidewalks.
• From third parties you authorise (payments, identity/anti-fraud checks).

We share personal information only when necessary and with safeguards:

• Operators (processors): hosting, email/SMS, payments, CCTV platforms, maintenance — under written operator agreements and confidentiality.
• Law enforcement / insurers / legal advisers: where required or permitted by law, or to establish/exercise/defend legal claims.
• HOA partners: on a need-to-know basis, per programme rules (may act as joint RP).

Residents cannot export or publicly share footage. Exports are restricted to the IO/authorised staff on written request with a lawful basis (e.g., SAPS case number).

If a provider stores or processes data outside South Africa, we ensure an appropriate ground under POPIA s72 (adequate protection, binding agreements, or your consent). Where feasible, CCTV footage is stored locally and accessed securely.

We implement reasonable and appropriate measures: role-based access; unique accounts; MFA for admins; encryption in transit; hardened servers; patching; privacy masks; no audio recording; strict export controls; and operator contracts with security obligations. We maintain a breach-response plan and will notify the Information Regulator and affected persons where required.

• Access your personal information we hold.
• Request correction/deletion of inaccurate, irrelevant, excessive or unlawfully obtained information, or deletion of records we are no longer authorised to retain.
• Object to certain processing (including direct marketing) and opt-out at any time.
• Complain to the Information Regulator (details below).

How to make a request

• Access requests: email privacy@ghosthome.co.za.
• Correction/Deletion requests: email privacy@ghosthome.co.za (we accept Form 2 or clear written requests).

• We use essential cookies (sign-in, security, fraud prevention) and optional analytics/marketing cookies (with your consent where required). Manage preferences via our banner or your browser.
• We don't sell personal information and don't track you across unaffiliated websites for third-party targeted advertising.

• Operating window: resident live view at any time; person alerts 23:00–04:00 by default (adjustable on request).
• Access controls: live-view only (no timeline, no export, no PTZ) for residents. All activity is logged. Misuse leads to removal and may be reported to the Regulator/PSiRA (if applicable).
• Placement & masking: cameras on private property view public streets/sidewalks; permanent privacy masks prevent filming into private areas.
• No audio & no facial recognition. AI may classify events (person/vehicle) without biometric identification.
• Signage: entry-point signs state purpose, Responsible Party/Operator, retention, and IO contact. Sample sign text is available on request.

Residents do not receive direct exports. Where legally justified, exports are performed by the Information Officer (or authorised delegate) on written request with sufficient particulars (e.g., date/time, location, incident description, SAPS case number). We may refuse or redact where disclosure would violate rights of others or legal restrictions.

Our services are intended for adults. Resident access is limited to persons 18+. We do not knowingly allow minors to use the live-view service. Camera placement and masking aim to minimise intrusion.

We conduct proportionate risk/impact assessments (DPIA-style) for CCTV deployments, covering necessity, proportionality, risks, and mitigations (e.g., masking, retention, access limits, signage). A summary may be provided to partners on request.

We may update this notice from time to time. We'll change the "Last updated" date above and, if material changes are made, notify you via the website or email.