Privacy Policy

Privacy Policy
Smart Five Card Solutions
Last updated: 30 September 2026

We respect your privacy. This policy explains what personal information we collect, why we collect it, how we protect it and what rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are
Smart Five Card Solutions (“Smart Five”, “we”, “us”) is the responsible party for the personal information described in this policy.

Address: 13 Morester Street, Glen Marais, Kempton Park, Gauteng, 1619, South Africa
Phone: +27 11 391 4693
Email: support@smartfive.co.za
Registered legal entity name and registration number: Smart Five Card Solutions cc (1998/029773/23)
Information Officer:  Hermann Hafenscher, privacy@smartfive.co.za

2. What this policy covers
This policy applies when you:

  • visit our website, online store or campaign pages (including our IDaaS pages);
  • contact us, complete a form or book a meeting or demo;
  • buy products, consumables or services from us;
  • use our technical support, training, card printing or ID as a Service (IDaaS) services;
  • receive our emails or newsletters.

3. Information we collect
Depending on how you deal with us, we may collect:

  • Contact details: name, job title, organisation, email address, phone number and address.
  • Enquiry and project information: your card printing needs, equipment, card types, volumes, locations, timing, answers to questionnaires or readiness checks, and any notes you give us.
  • Order and account information: products ordered, delivery details, invoices and payment status. We do not store full card payment details; payments are handled by our payment provider Wallet Doc.
  • Support information: details of your equipment, fault reports and the communication needed to resolve them. This may include remote-support sessions you agree to.
  • Marketing preferences: whether you have agreed to receive updates, and your unsubscribe choices.
  • Website and email data: basic technical information such as browser type, pages visited, and which email or link brought you to our site. Our emails may record opens and clicks.
  • Website comments and accounts: if you leave a comment, we collect what you enter in the comment form, plus your IP address and browser details to help detect spam. If you register or log in, we store the details in your user profile.
    We do not intentionally collect special personal information, such as health or biometric information, about you as our customer. For card data we handle on your behalf, see section 6.

4. How we collect it

  • Directly from you, when you contact us, complete a form, place an order or use our services.
  • From your organisation, when a colleague gives us your details as a contact person.
  • Automatically, through our website, forms and emails (see section 10).

5. Why we use it
We use personal information only for purposes connected to our business with you:

  • to respond to enquiries, give quotes and advise on suitable solutions;
  • to supply, install, deliver, support and invoice products and services;
  • to schedule demos, meetings, training and follow-ups you have asked for or agreed to;
  • to manage our relationship with you as a customer, including service reminders;
  • to send you updates about card printing, our products and services, where you have agreed or where you are an existing customer (you can opt out at any time);
  • to improve our website, communications and services;
  • to meet legal, tax and accounting obligations, and to protect our legal rights.

Under POPIA, we process your information because:

  • it is needed to carry out actions for a contract with you or your organisation; or
  • we have a legal obligation; or
  • it serves our legitimate interests in running and improving our business, where these do not override your rights; or
  • you have given your consent.

6. Card and cardholder data we process for our clients
When we print cards, supply card systems or provide IDaaS, we may handle cardholder information on behalf of our client organisation. This can include names, photographs, identity or employee numbers and similar card data. In these cases:

  • our client is the responsible party for that data, and Smart Five acts as its operator;
  • we process that data only on the client’s instructions and only to provide the agreed service;
  • we keep it confidential and protect it with appropriate security measures;
  • we do not use it for our own purposes, including marketing;
  • we return or securely delete it when the service ends, or as agreed with the client

Cardholders who have questions about their data should first contact the organisation that issued their card.

7. Who we share it with
We share personal information only where necessary, and never sell it. Recipients may include:

Service providers who work on our behalf, such as:

  • our customer management system (HighLevel);
  • our email service (Brevo);
  • IT, hosting and website providers;
  • payment, courier and delivery providers;
  • accounting providers.
  • Manufacturers and distribution partners (for example Entrust), where needed for warranty, repairs, licensing or technical support.
  • Authorities or professional advisers, where the law requires it or where we must protect our legal rights.
  • Website services:
  • Comments may be checked by an automated spam-detection service [for example Akismet].
  • An anonymised string made from your email address (a “hash”) may be sent to the Gravatar service to check whether you use a Gravatar profile picture. See Automattic’s privacy policy: https://automattic.com/privacy/. Once your comment is approved, your profile picture is shown publicly with it.
  • Our service providers must keep your information confidential and secure, and may use it only to provide their services to us.

8. Transfers outside South Africa
Some of our service providers store information outside South Africa, for example HighLevel (United States) and Brevo (European Union). When information is transferred abroad, we rely on providers bound by data-protection terms or laws that give substantially similar protection to POPIA, as section 72 of POPIA requires.

9. How we protect it
We use reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access. These include access controls, password-protected systems and limiting access to staff who need it. No system is completely secure, but we work to prevent incidents. If a security compromise affects your information, we will notify you and the Information Regulator as POPIA requires.

10. Cookies and similar technologies
Our website and campaign pages may use cookies and similar technologies:

  • to make the site work;
  • to remember your progress in forms or questionnaires during a visit;
  • to understand how the site is used [for example Google Analytics or Google Tag Manager].
  • Specific cookies on our website:

Comments: if you choose, your name, email and website are saved in cookies for one year, so you do not have to re-enter them.
Login: if you have an account, a temporary cookie checks whether your browser accepts cookies. It holds no personal data and is removed when you close the browser. When you log in, further cookies save your login (two days, or two weeks with “Remember Me”) and your screen settings (one year). They are removed when you log out.
Editors: if you edit or publish an article, a cookie with no personal data records the article ID for one day.
Embedded content: pages may include embedded content such as videos, images or articles from other websites. Embedded content behaves exactly as if you had visited the other website. That site may collect data about you, use cookies, add third-party tracking and monitor your interaction with the content, especially if you are logged in there.

You can block or delete cookies in your browser settings. Some parts of the site may then not work properly.

11. Direct marketing
We will only send you electronic marketing if:

  • you have agreed to receive it; or
  • you are an existing customer and the marketing is about similar products or services.
  • Every marketing email includes an unsubscribe link, and you can also ask us to stop at any time. Unsubscribing does not affect service messages about orders, support or requests you have made.

12. How long we keep it
We keep personal information only as long as we need it for the purposes above, or as the law requires. For example:

  • customer and transaction records: for the period required by tax and company law [5 years];
  • enquiries that do not lead to business: up to 48 months;
  • marketing records: until you unsubscribe, plus a record of your opt-out so we respect it;
  • website comments: kept with their details for as long as the comment is published, so follow-up comments can be recognised. You can ask us to remove them;
  • website accounts: until you close your account. You can view and edit your profile at any time, except your username.
  • After that, we delete, destroy or de-identify the information.

13. Your rights
Under POPIA you may:

  • ask whether we hold your personal information and request a copy;
  • ask us to correct or delete information that is inaccurate, out of date, incomplete or no longer needed;
  • object to our processing of your information, including for direct marketing;
  • withdraw your consent where we rely on it (this does not affect processing that has already happened);
  • lodge a complaint with the Information Regulator.
  • To make a request, contact our Information Officer using the details in section 1. We may need to verify your identity first. Access requests are handled in line with POPIA and the Promotion of Access to Information Act (PAIA)..

Information Regulator (South Africa)
Website: https://inforegulator.org.za/
Complaints: PAIAComplaints@inforegulator.org.za

14. Links to other websites and uploaded images
Our website may link to other sites, such as manufacturers or partners. We are not responsible for their privacy practices. Please read their policies.

If you upload images to our website, remove any embedded location data (EXIF GPS) first. Visitors can download images and extract that data.

15. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the “last updated” date shown at the top.

16. Contact us
If you have questions about this policy or how we handle your information, contact:

Email: privacy@smartfive.co.za / support@smartfive.co.za
Phone: +27 11 391 4693
Address: 13 Morester Street, Glen Marais, Kempton Park, 1619