Privacy Policy

1. Who we are

Business name: TrustCore Risk Solutions (Pty) Ltd
Registration: Private company (South Africa), 2025 / 950846 / 07

Physical address:

• 10 Vereniging Street, Moorreesburg, Western Cape, 7310
• First Floor, Willowbridge Centre, 39 Carl Cronje Drive, Bellville, 7530

Email: bennie@trustcore.co.za
Telephone: 076 680 0833 / 082 322 5020

Information Officer: Mr Barend Petrus van der Merwe (Bennie)
Email: bennie@trustcore.co.za / hello@trustcore.co.za / disputes@trustcore.co.za
Telephone: 082 322 5020

TrustCore provides workplace integrity assessments, polygraph examinations, pre‑employment screening, and risk‑management support to employers and organisations. We process personal information lawfully, safely, and transparently in accordance with the Protection of Personal Information Act, 2013 (“POPIA”).

2. What personal information we collect

We collect only the minimum personal information required for the specific service being delivered. Whether the supply of personal information is voluntary or mandatory depends on the service.

A. Workplace Integrity Database (WID)

Supply of personal information by the data subject for inclusion in the Workplace Integrity Database is voluntary. However, employers may lawfully upload verified dismissal information without the data subject’s consent under POPIA section 11(1)(f) (legitimate interests), as authorised by the Information Regulator. This means that even if a data subject chooses not to provide information or does not participate, the employer may still upload factual dismissal records to the WID for legitimate risk‑management purposes.

B. Pre-employment screening

Supply of personal information is contractual. If the subject chooses not to provide it, the employer may be unable to assess suitability for employment.

C. Polygraph examinations

Supply of personal information is voluntary unless required by an employment contract or workplace policy.

D. Client onboarding / service delivery

Supply of personal information is contractual. If the subject chooses not to provide it, TrustCore Risk Solutions may be unable to provide the requested services.

2.1 General personal information

• Full names
• Identity numbers
• Contact details
• Employment history and job‑related information
• Statements relating to workplace incidents
• Operational or HR‑related information

2.2 Special personal information (sections 26–33 POPIA)

Processed only when lawful, necessary and proportionate:

• Biometric data (polygraph physiological recordings)
• Health information voluntarily disclosed during pre‑test interviews
• Information relating to alleged misconduct, dishonesty or criminal behaviour
• Children’s information (only with competent person consent or Regulator authorisation)

2.3 Information provided by clients

• Case files
• Incident reports
• Internal HR documentation
• Supporting evidence for investigations

We do not collect unnecessary or excessive information.

3. Purpose of processing

We process personal information for:

• Polygraph examinations
• Workplace investigations
• Integrity verification
• Risk‑management support
• Contractual obligations
• Legal and regulatory compliance
• Audit and accountability
• Preventing, detecting or investigating unlawful conduct

We do not use personal information for marketing.

4. Lawful basis for processing

Processing is based on one or more POPIA grounds:

• Voluntary, informed consent
• Legitimate interests of the employer or client
• Legal obligation
• Performance of a contract
• Public interest (including prevention of unlawful conduct)
• Prior Authorisation from the Information Regulator (where required)

Consent is always obtained for polygraph examinations and for any release of results.

5. Sharing of personal information

Personal information is shared only when necessary and only with authorised parties:

• Employers or clients requesting the service
• Law enforcement agencies (when legally required)
• Legal representatives (when authorised)
• Operators or service providers assisting with the service
• The Information Regulator (when required)

Digital consent mechanisms

TrustCore Risk Solutions obtains consent through secure, authenticated digital processes including smartphone links, USSD prompts, voice‑verified consent, or other approved electronic methods. Each consent instance is:

• Cryptographically bound to the specific enquiry
• Time‑stamped
• Auditable
• Stored securely

No information is released without valid digital consent or another lawful basis.

Fallback written consent (exceptional circumstances)

Used only when digital consent is not reasonably possible. Written consent must be:

• Completed and signed by the data subject
• Verified against an identity document
• Captured and stored in TrustCore’s secure consent system

Employer-initiated consent workflow

The employer initiates the enquiry; the data subject completes the consent. No information is accessible until valid consent is received.

6. Cross-border transfers

TrustCore transfers personal information to its contracted cloud service provider, Supabase Pte. Ltd (Singapore), with hosting in Frankfurt, Germany (EU). This transfer is authorised under POPIA section 72(1)(a) through a binding agreement requiring Supabase to provide protection substantially similar to POPIA.

Supabase sub‑processors used for infrastructure, backups, logging, analytics and support are contractually bound to POPIA‑aligned protection. All transfers are limited to:

• Hosting and processing in the EU region
• Backups and redundancy
• Security logging and monitoring
• Technical support access

No additional transfers are authorised.

7. Workplace Integrity Database (WID)

TrustCore Risk Solutions operates a secure, closed‑access Workplace Integrity Database containing verified records of individuals dismissed for misconduct. The WID is fully authorised under POPIA following the granting of Prior Authorisation by the Information Regulator.

System status declaration (live system)

• The WID is activated, operational and authorised to process real personal information.
• Only authenticated, authorised employers may submit, search or retrieve information.
• All processing requires valid digital consent or another lawful POPIA basis.
• The production system is subject to full POPIA safeguards, including encryption, MFA, audit logging, operator controls and access governance.

Purpose of the WID

To assist employers in making fair, responsible employment decisions by providing factual integrity‑related indicators.

Key governance principles

• Consent‑first processing
• Closed, controlled employer access
• No public access
• Only factual, non‑prejudicial indicators
• Full dispute, correction and rehabilitation procedures
• Comprehensive audit trails
• POPIA‑aligned retention and destruction
• Strict operator management

The WID does not contain opinions or defamatory content.

8. How we protect personal information

TrustCore uses layered safeguards:

• Secure digital storage
• Encryption in transit and at rest
• Password protection and multi‑factor authentication
• Locked physical storage for paper records
• Operator confidentiality agreements
• Access control and audit trails
• Secure destruction after retention periods
• Staff training on POPIA
• Incident and breach response procedures

9. Data subject rights

Data subjects may:

• Access their personal information
• Request correction
• Request deletion (where applicable)
• Object to processing (where applicable)
• Withdraw consent
• Request reasons for decisions made using their information
• Lodge complaints with the Information Regulator

Requests: disputes@trustcore.co.za
Information Regulator: inforeg@justice.gov.za
Complaints: complaints.IR@justice.gov.za

10. Retention and destruction

Personal information is retained only as long as necessary to:

• Fulfil its purpose
• Comply with legal or contractual obligations
• Protect legitimate interests

Records are securely destroyed when no longer required.

11. Operator and third-party processing

Where TrustCore acts as an Operator, we enter into written Operator Agreements ensuring:

• Processing only on instruction
• Confidentiality
• Security safeguards
• No unauthorised disclosure
• POPIA compliance

All third‑party processors are vetted and bound by confidentiality.

12. Consent for disclosure

Digital consent is required for any disclosure unless another lawful basis applies. Fallback written consent is permitted only in exceptional circumstances.

13. Updates to this privacy policy

This policy may be updated to reflect:

• Legislative changes
• Operational changes
• Guidance from the Information Regulator

The latest version is available on request.

14. Contact us

Information Officer: Mr Barend Petrus (Bennie) van der Merwe
Email: bennie@trustcore.co.za / hello@trustcore.co.za
Telephone: 082 322 5020 / 076 680 0833