Your data, your control
A plain-language guide to how EZ Cyber Guard handles personal information, the data protection laws we design around, and the choices you have.
Last updated 17 October 2026
The short version
What we collect
Account details (name, work email, company, phone), billing records, and — for the security service — logs, alerts, inventory and vulnerability data from the devices you enrol.
Why we use it
To run your monitoring, alert you, bill you, support you and keep the platform secure. We don't use your security data to advertise to you.
Who helps us
Trusted service providers: we use a secure, encrypted database and sign-in service hosted in a secure environment.
Cards & payments
Card details go straight to Payfast. EZ Cyber Guard never sees or stores them.
Our role: responsible party and operator
For your account and billing details, EZ Cyber Guard decides why and how the information is used, so we act as the responsible party (POPIA) or controller (GDPR). For the security data from your endpoints — logs, alerts, inventory — we process it on your instructions to deliver the service, acting as an operator or processor. You stay in charge of what you connect and how long it is kept, within your plan's retention period.
Built around POPIA, aware of the world
We are based in South Africa, so POPIA is our home law. Because customers and their staff can be anywhere, we also design around the laws below.
South Africa · Home law
Protection of Personal Information Act 4 of 2013 (POPIA)
POPIA sets out how personal information must be processed lawfully and securely. We design our service around its eight conditions for lawful processing, and we also keep the Electronic Communications and Transactions Act 25 of 2002 (ECTA) in mind for online services.
- You can ask for access to, correction of, or deletion of your personal information.
- You can object to processing and withdraw consent where consent is the basis.
- Security compromises are reported to the Information Regulator and affected people as POPIA section 22 requires.
- Transfers outside South Africa only happen where POPIA section 72 conditions are met.
Kenya
Data Protection Act, 2019
- Rights of access, correction, deletion and objection.
- Registration and lawful-basis duties for data controllers and processors.
- Restrictions and safeguards on transfers outside Kenya.
Nigeria
Nigeria Data Protection Act, 2023 (NDPA)
- Lawful-basis, consent and data-minimisation principles.
- Data subject rights including access, rectification and erasure.
- Breach notification and cross-border transfer requirements.
Ghana
Data Protection Act, 2012 (Act 843)
- Eight privacy principles covering fair processing and security.
- Access and correction rights for individuals.
- Registration of data controllers.
Zimbabwe
Cyber and Data Protection Act, 2021
- Rules for collecting and processing personal information.
- Data subject rights and controller security duties.
- Conditions for transferring data abroad.
What you can ask us to do
Exact rights depend on the law that applies to you. We aim to honour reasonable requests from everyone.
Access
Ask what personal information we hold about you.
Correct
Have inaccurate or outdated information fixed.
Delete
Ask us to delete information we no longer need.
Object or restrict
Object to, or limit, certain processing.
Portability
Receive your data in a usable format where the law allows.
Withdraw consent
Change your cookie choices or consent at any time.
Complain
Lodge a complaint with your data protection regulator.
To use a right, reach us through the Contact page and tell us which right you want to exercise.
How we protect information
Security is what we do, so we hold ourselves to the same standard.
Tenant isolation
Every organisation's data is separated at the database level, so one customer can never read another's.
Per-device enrolment keys
Devices join with their own one-time key. You never receive shared administrator credentials.
Audit trail
Sensitive actions such as removing a device are recorded so they can be reviewed.
Encrypted in transit
Traffic between your browser, our servers and your monitored devices is protected with TLS.
Cookies & local storage
We keep this to the minimum. Optional categories stay off until you turn them on.
| Name | Category | Purpose | Lasts |
|---|---|---|---|
| Sign-in session (sb-…-auth-token) | Strictly necessary | Keeps you signed in and your session secure. | Until you sign out or it expires |
| ez-cookie-consent | Strictly necessary | Remembers your cookie choices. | Until you clear your browser data |
| ez-theme | Preferences | Remembers light or dark mode. Stored only if you allow Preferences. | Until you clear your browser data |
We do not currently use analytics or marketing cookies. If that changes, they will only load if you opt in. . If your browser sends a Global Privacy Control signal, we treat it as an opt-out of optional cookies.
We count visits to our public website pages and a few actions (such as starting the readiness check or a free trial) without cookies. We don't store your IP address; it's combined with the date into a one-way code that can't be reversed or linked across days. If your browser sends a Global Privacy Control or Do Not Track signal, we don't count you at all.
To see which country a visit comes from and which network it uses, our server sends the visitor's IP address to IPinfo (ipinfo.io), a service based in the United States. IPinfo returns the name of the network owner (usually your internet provider, or your employer if it runs its own network) and the country. We keep only that network name and country, never the IP address.
Questions about your privacy?
Our service is for businesses and is not directed at children. If you think we hold information we shouldn't, or you want to use one of your rights, get in touch and we'll respond as quickly as we can.
Contact us