Privacy Policy
This policy explains how we collect, use, share and protect your personal information when you visit our website or contact us, and the rights you have under South Africa's Protection of Personal Information Act, 2013 (POPIA). We have written it in plain language on purpose.
1. Who we are
The responsible party for your personal information is:
Riot 5 Systems (Pty) Ltd, trading as "R5 Systems".
Company registration number: 2026/122980/07
We are a fully remote business and do not operate a public office. Please send any correspondence, including privacy requests, to the email address or phone number below.
Telephone / WhatsApp: +27 79 925 7395
Email: info@r5systems.co.za
Website: https://r5systems.co.za
In this policy, "we", "us", "our" and "R5 Systems" all refer to Riot 5 Systems (Pty) Ltd. A "responsible party" is the person or organisation that decides why and how your personal information is processed. We are the responsible party for the information described here.
Information Officer
Our Information Officer is accountable for how we handle personal information and is your first point of contact for any privacy question, request or concern.
Information Officer: Alex Bantjies
Title: CEO
Email: info@r5systems.co.za
Telephone: +27 79 925 7395
Contact: by the email address or phone number above (we operate fully remotely)
Our Information Officer must be registered with the Information Regulator of South Africa, as POPIA requires.
2. What personal information we collect
We keep collection to a minimum. We do not sell your personal information, and we do not run user accounts, logins or e-commerce on this site.
2.1 Information you give us through the contact form
When you complete the contact form, we collect:
- Your name (required) - so we know who we are speaking to and can address you properly in our reply.
- An email address or phone number (required, a single "contact" field) - a way for us to reach you. If you give an email address, we use it to send you an automated acknowledgement and to reply to your enquiry.
- The type of service or project you are interested in (optional) - to help us understand your enquiry.
- Your message (optional) - whatever you choose to tell us about your project.
Please only include in the message field what is necessary. There is no need to send us identity numbers, banking details or other sensitive information through the form.
2.2 Information collected automatically
- Your IP address. When you submit the contact form, your IP address and a timestamp are recorded in the enquiry email we receive, and your IP address is sent to Google as part of the anti-spam check described below. Our web host may also log your IP address as part of normal server operation.
- Anti-spam signals (Google reCAPTCHA v3). To stop automated spam, our contact form uses Google reCAPTCHA v3. When you interact with the form, Google's reCAPTCHA script loads and collects device, cookie and browsing-interaction signals to work out whether you are a real person. This produces a score that we check on our server. Please note that reCAPTCHA loads as soon as you start using the contact form and is not part of the cookie-consent choice described in section 4. This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.
- A hidden anti-spam field ("honeypot"). The form contains a hidden field that people never see or fill in. If it is completed, we treat the submission as automated and quietly discard it. This is a spam-filtering technique and is not used to identify you.
2.3 Advertising and analytics data (only if you accept cookies)
If, and only if, you accept cookies through our consent request, we load the Meta (Facebook) Pixel. From that point it may collect:
- Pages and actions on our site - for example that you loaded a page, scrolled to our live demos, clicked a WhatsApp link, or submitted the contact form (with the selected project type attached to that event).
- Cookies and identifiers set by Meta (such as the
_fbpcookie), together with your IP address, browser/user-agent and the page you came from.
If you decline, the Meta Pixel is never loaded and none of this advertising data is collected. See section 4 for the detail.
2.4 Your cookie choice
We store your accept-or-decline choice in your browser (in local storage, under the key r5-cookie-consent) so we do not ask you every visit. This choice stays on your device and is not sent to us.
One other key, r5-analytics-off, is created only if somebody has explicitly asked not to be counted in our own site statistics, which is normally only our own staff. It holds a date and nothing else, it identifies nobody, and it stays on your device and is never sent to us. It lasts a year.
2.5 WhatsApp
Our site includes WhatsApp links (to +27 79 925 7395). If you click one and message us, WhatsApp and Meta process your phone number and message content under their own terms. These links are always available and are not affected by your cookie choice.
We do not knowingly collect personal information from children. We also do not deliberately collect special categories of personal information (such as health, religious or biometric data). Please do not send us such information through the contact form.
3. Why we collect it and our lawful basis
POPIA requires that every use of your personal information rests on a lawful basis (section 11). The table below sets out each purpose and the basis we rely on.
| What we do | Personal information used | Lawful basis (POPIA section 11) |
|---|---|---|
| Reply to your enquiry, answer questions and prepare a quote or proposal | Name, email or phone, project type, message, IP and timestamp on the enquiry | Steps to enter into or perform a contract at your request, and our legitimate interest in responding to people who contact us |
| Send you an automated acknowledgement that we received your message | Name and email address (only where you supplied an email) | Our legitimate interest in confirming receipt, and steps taken at your request |
| Protect the contact form against spam and abuse (reCAPTCHA and the honeypot) | IP address and reCAPTCHA device/interaction signals | Our legitimate interest in keeping the site secure and free of automated abuse |
| Measure how our site performs and improve our advertising (Meta Pixel) | Page and action events, Meta cookies/identifiers, IP, user-agent, referring page | Your consent, which you can withdraw at any time |
| Remember your cookie choice | Your accept/decline value, stored on your device | Necessary to give effect to the choice you made |
Is it mandatory to provide your information? You do not have to give us any personal information to browse the site. If you choose to contact us, your name and a way to reach you are required, because without them we cannot reply. The project type and message are optional. Accepting advertising cookies is entirely voluntary, and declining does not affect your visit in any way.
6. Cross-border transfers and safeguards
Some of our providers are based outside South Africa, so your personal information may be processed in other countries. In particular, Meta Platforms and Google are headquartered in the United States, and their processing of the data described above takes place partly outside South Africa.
POPIA (section 72) allows these transfers where a recognised safeguard applies. We rely on the following, depending on the transfer:
- The recipient is bound by binding rules or agreements that provide an adequate level of protection similar to POPIA. Meta and Google publish data-processing and transfer terms that provide such protection.
- The transfer is necessary to perform, or take steps towards, a contract with you (for example, delivering your enquiry email so we can respond).
- Where neither applies, we rely on your consent, which for advertising cookies you give through the consent request and can withdraw at any time.
Because we self-host our website and email, your enquiry and our correspondence stay on our own systems rather than with a third-party email or hosting company. The cross-border transfers that occur are those to Meta and Google described above.
7. How long we keep it
We keep personal information only for as long as we need it for the purpose we collected it, unless the law requires us to keep it longer (POPIA section 14). The periods below reflect our current retention policy.
- Enquiry emails. Your enquiry and our correspondence stay in our mailbox while we deal with you and for a reasonable period afterwards, so we can pick up the conversation again or handle any follow-up. Our current policy is to retain enquiry emails for up to 24 months after our last contact, then delete them, unless they relate to a project or a legal or tax obligation that requires longer.
- Project and accounting records. Where an enquiry becomes a paid engagement, related records may be kept for as long as South African tax and company law require (generally five years).
- Server and spam logs. Technical logs held by our host, and reCAPTCHA data held by Google, are kept for the shorter periods those providers apply.
- Advertising data. Data held by Meta through the pixel is retained under Meta's own retention policies.
- Your cookie choice. The accept/decline value stays in your browser until you clear it or change it through "Cookie preferences".
We do not keep a database of website submissions on our own systems; each enquiry lives as an email. When information is no longer needed, we delete or de-identify it.
8. How we protect it
We take appropriate, reasonable technical and organisational measures to keep your personal information secure and to guard against loss, damage and unauthorised access (POPIA section 19). These include:
- Encryption in transit: the site and contact form are served over HTTPS (TLS), and enquiry emails are sent from our server over an encrypted (TLS) connection.
- Access controls: only the people who need it can reach our mailbox, and administrative access is limited and password-protected.
- Reputable providers: we use established email, hosting and security providers and rely on their security controls.
- Secrets kept off the public site: sensitive keys and mail credentials are stored in server configuration that is not exposed to the web.
- Anti-abuse measures: reCAPTCHA and the hidden honeypot field reduce spam and automated attacks on the form.
No system is ever completely secure. If a security compromise affects your personal information, we will notify the Information Regulator and you, as soon as reasonably possible, in line with POPIA section 22.
9. Your rights under POPIA
POPIA gives you the following rights in relation to your personal information. You can exercise any of these rights without unnecessary hurdles, and we will not treat you unfairly for doing so:
- To be informed that we are collecting your information, and to be told if it has been accessed by an unauthorised person (sections 18 and 22).
- To access your personal information that we hold, and to ask what we hold and who we have shared it with (sections 23 and 24, read with PAIA).
- To correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24).
- To object, on reasonable grounds relating to your situation, to our processing of your information (section 11(3)).
- To object to direct marketing, including electronic marketing, at any time (section 69).
- To withdraw consent where we rely on it (for example, the advertising cookies), without affecting processing that already took place before you withdrew (section 11(2)).
- Not to be subject to a decision based solely on automated processing that significantly affects you (section 71). We do not make such decisions about you.
- To complain to the Information Regulator (sections 5(h) and 74; see section 11 below).
10. How to exercise your rights
To make any request, email us at info@r5systems.co.za, or write to our Information Officer at the address in section 1. Please tell us what you would like us to do and enough detail for us to find your information. We may ask you to verify your identity before we act, so that we do not disclose your information to the wrong person.
We aim to acknowledge requests promptly and to respond within 30 days, the timeframe PAIA sets for access requests, though this may be extended in the limited circumstances the law allows. For the fastest handling, use the words "POPIA request" in your subject line.
Formal requests for access to information are handled under the Promotion of Access to Information Act, 2000 (PAIA), using the prescribed forms. Our PAIA manual explains how to make such a request, any applicable fees and our procedures. It is available at /paia, or from our Information Officer on request at info@r5systems.co.za. Requests to correct or delete information can also be made using POPIA Form 2 (Request for Correction or Deletion), which we will provide on request.
11. Complaints to the Information Regulator
We would like the chance to resolve any concern first, so please contact us before escalating. You also have the right to complain to the Information Regulator, which oversees and enforces POPIA and PAIA in South Africa. You can lodge a POPIA complaint on the prescribed form (POPIA Form 5) or through the Regulator's eServices Portal.
Information Regulator (South Africa)
Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Toll-free: 0800 017 160
POPIA complaints: POPIAComplaints@inforegulator.org.za or via the eServices Portal
PAIA complaints: PAIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za
12. Changes to this policy
We may update this policy from time to time, for example when our services, tools or legal obligations change. When we do, we will change the "Last updated" date below and publish the new version on this page. Where a change is significant, we will take reasonable steps to bring it to your attention. Please check this page from time to time to stay informed.