Privacy Policy

Allocentra (Pty) Ltd ("Allocentra", "we", "us", "our") is the responsible party for your personal information as defined under POPIA. We are a provider of cloud-based MSP management software.

You can contact our Information Officer at privacy@allocentra.co.za.

We collect the following categories of personal information:

Account and identity information

• Full name and work email address
• Job title and company name
• Password (stored as a bcrypt hash — we never store plaintext passwords)
• Profile photo (if provided)

Usage and technical information

• IP address and browser/device type
• Pages visited and features used within the Service
• Timestamps of actions (audit log)
• API access tokens and session identifiers
• On the marketing website only, if you accept analytics cookies: Microsoft Clarity session recordings, heatmaps, and page-interaction data (clicks, scrolls, navigation)

Customer Data (managed on your behalf)

• Device names, hostnames, IP addresses, and hardware specifications of managed endpoints
• Ticket subjects, descriptions, and comments
• Contact information for end-users at your client companies
• Device performance metrics (CPU, memory, disk usage)

You are the responsible party for Customer Data relating to your clients and their end-users. You must ensure you have a lawful basis under POPIA to share such data with us.

We process your personal information to:

• Create and manage your account and workspace
• Provide, operate, and improve the Service
• Send service-related notifications (alerts, ticket updates, invitations)
• Respond to support requests and enquiries
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations applicable in South Africa
• Analyse aggregate, anonymised usage data to improve the Service

We do not sell your personal information to third parties and do not use it for targeted advertising.

Under POPIA, we process your personal information on the following grounds:

• Contract performance — to provide the Service you have signed up for.
• Legitimate interests — to improve the Service, prevent abuse, and maintain security, where this does not override your rights.
• Legal obligation — where processing is required by South African law.
• Consent — for optional communications such as product newsletters, and for optional analytics cookies on the marketing website (Microsoft Clarity), where you have opted in.

All Customer Data is stored in AWS eu-west-1 (Ireland, European Union). We implement appropriate technical and organisational measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls with least-privilege principles
• Multi-factor authentication for administrative access
• Regular automated backups with point-in-time recovery
• Continuous security monitoring and audit logging

Despite these measures, no system is completely secure. We encourage you to use a strong, unique password and to enable multi-factor authentication on your account.

We share personal information only in the following limited circumstances:

• Service providers — we use AWS (infrastructure), Amazon SES (transactional email), and Paystack (payments). Each sub-processor is bound by a data processing agreement and POPIA-compliant safeguards.
• Analytics processor (marketing website) — if you accept analytics cookies, we use Microsoft Clarity to capture page interactions, session recordings, and heatmaps. Microsoft processes this information as an analytics processor. See Microsoft's privacy statement. Clarity is not used on the logged-in product dashboard, portal, or authentication pages.
• Legal requirements — where required by South African law, court order, or regulatory authority.
• Business transfers — in the event of a merger or acquisition, your data may be transferred subject to equivalent privacy protections and advance notice to you.

Customer Data is hosted in Ireland (EU). That is a cross-border transfer under POPIA. We rely on appropriate safeguards, including AWScontractual data processing terms and GDPR-aligned security controls. If you accept analytics cookies, marketing-site interaction data is processed by Microsoft (Clarity) and may be transferred outside South Africa and the EU under Microsoft's terms and privacy statement. We do not otherwise transfer personal information to jurisdictions outside South Africa and the EU without an appropriate lawful basis under POPIA.

We retain personal information for as long as your account is active or as needed to provide the Service.

• Account data — retained for the duration of your subscription plus 90 days after account closure (to allow recovery), then permanently deleted.
• Audit logs — retained for 12 months.
• Device metrics — retained for 90 days.
• Billing records — retained for 5 years as required by South African tax law.

As a data subject under POPIA, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of your personal information (subject to legal retention obligations).
• Objection — object to the processing of your personal information.
• Restriction — request that we restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email our Information Officer at privacy@allocentra.co.za. We will respond within 30 days.

If you believe your rights have been violated, you may lodge a complaint with the Information Regulator of South Africa at www.inforegulator.org.za.

Allocentra uses cookies and similar technologies. Essential cookies and local storage maintain your authenticated session, security, and (on the marketing website) country or pricing preference. These are required to operate the Service.

Analytics cookies (marketing website only)

If you accept analytics cookies, we use Microsoft Clarity as an analytics processor. Clarity captures page interactions (clicks, scrolls, and navigation), session recordings, and heatmaps. It may set first-party cookies such as _clck and _clsk. Microsoft may also set its own cookies. Clarity is not loaded on the logged-in product dashboard, customer portal, or authentication pages.

You can accept, reject, or change analytics cookies via the cookie notice on the marketing website, by opening Cookie preferences in the footer, or at Manage cookie preferences. Rejecting analytics cookies does not affect your ability to browse the site or sign in to the Service. Microsoft's privacy statement is at microsoft.com/privacy/privacystatement.

We do not use advertising cookies or third-party marketing pixels on the core product. You may disable cookies in your browser settings, but disabling essential cookies will prevent you from signing in to the Service.

The Service is not directed at, and we do not knowingly collect personal information from, individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice in the Service at least 14 days before the changes take effect. The revised policy will indicate the new effective date.

Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

For any privacy-related questions, requests, or concerns, please contact our Information Officer: