1. Who we are and what this policy covers

Hiksurveillance is a division of Forbtech (Pty) Ltd ("Forbtech"), a South African IT, networking and security systems company established in 2007 and based at 28 Padstow Street, New Redruth, Alberton. Forbtech (Pty) Ltd is the responsible party, as defined in the Protection of Personal Information Act 4 of 2013 ("POPIA"), for personal information processed through Hiksurveillance.

In this policy, "we", "us" and "our" mean Forbtech (Pty) Ltd, including its Hiksurveillance division. "You" means any person whose personal information we process, including website visitors, online shop customers, people requesting quotes, installation and maintenance clients, and contact persons at businesses we deal with.

This policy applies to the Hiksurveillance website and online shop, quotations, product sales, installations, maintenance contracts, remote and on-site support, and our communications with you. It should be read with our website Terms and Conditions and the Forbtech PAIA Manual.

Hikvision is a third-party manufacturer. Hikvision's own processing of personal information, for example through the Hik-Connect app or Hikvision cloud services, is governed by Hikvision's privacy policy, not this one.

As a general rule, we only process your personal information where it is needed to sell you a product, deliver a service, complete a transaction, meet a legal obligation, or where you have consented.

2. Key terms

• Personal information means information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person (such as a company). It includes names, identity and registration numbers, contact details, physical and installation addresses, location information, online identifiers such as IP addresses, financial and account information, correspondence, opinions, and images or recordings from which a person can be identified.
• Special personal information means information about religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour. We do not ask for special personal information. See section 5 for how it may arise in CCTV and access-control systems.
• Processing means any operation involving personal information, including collecting, receiving, recording, storing, updating, using, disclosing, sharing, linking, restricting, erasing and destroying it.
• Responsible party means the party that decides why and how personal information is processed.
• Operator means a party that processes personal information on behalf of a responsible party, under a contract or mandate.
• Data subject means the person to whom the personal information relates.

3. Information we collect and where it comes from

We collect only what we need for the purpose concerned.

We obtain personal information:

• directly from you, when you browse our website, place an order, request a quote, complete a form, contact us or sign a contract;
• from people acting for you, such as your employer, property manager, body corporate, managing agent or the person who places an order on your behalf;
• from our suppliers, distributors and couriers, in the course of delivering your order or processing a warranty claim;
• from credit bureaus, where you apply for a credit account and consent to a check; and
• from public sources, such as the CIPC company register.

4. Why we process your information

We process personal information only for lawful purposes connected to our business, on one of the grounds in section 11 of POPIA.

We will not use your information for a new purpose that is incompatible with the purpose for which we collected it, unless you consent or the law permits it.

5. CCTV footage, security systems and remote access

Footage and data recorded by a CCTV, intercom, alarm or access-control system we supply or install belongs to you, the system owner. You are the responsible party for that information and for using the system lawfully. This includes placing clear CCTV signage, positioning cameras so they do not intrude unreasonably on neighbours or public spaces, limiting who can view footage, and keeping recordings only as long as needed.

When we install, configure, maintain or remotely support your system, we act as your operator under sections 20 and 21 of POPIA. This means that we:

• process footage and system data only on your instructions and only to the extent needed for the work, for example checking that a camera records correctly or retrieving footage you ask for;
• do not view, copy, export or keep footage unless you ask us to or it is necessary to resolve a fault;
• treat everything we see on your system as confidential and limit access to authorised technicians;
• keep appropriate security safeguards in place; and
• tell you without delay if we believe your system data has been accessed by an unauthorised person.

If you ask us to keep device or recorder login details for support purposes, we store them in an encrypted credential vault with access limited to authorised technicians. You may ask us to delete them at any time. We strongly recommend that you change default passwords and keep firmware up to date.

Hik-Connect and cloud services. If you use the Hik-Connect app or other Hikvision cloud or remote-viewing services, Hikvision processes your account, device and video data under its own terms and privacy policy, and that data may be stored outside South Africa. We set these services up only on your instruction.

Facial recognition, number-plate recognition and biometric access control. Some products identify people by their face, fingerprint or vehicle. Biometric information is special personal information under POPIA and carries stricter rules. We will point this out when quoting, but you remain responsible for having a lawful basis, for notifying the people concerned and, where required, for obtaining their consent.

6. Direct marketing

We may send you information about security, networking and IT products, specials, firmware and security advisories, and services offered by Hiksurveillance and other Forbtech divisions, by email, SMS, WhatsApp or telephone.

In line with section 69 of POPIA, we send electronic direct marketing only:

• if you have opted in, for example by ticking a box on our website or in-store form; or
• if you are an existing customer, and the marketing concerns products or services similar to those you bought from us, provided you were given the chance to opt out when we collected your details.

Every marketing message includes a way to opt out. You can unsubscribe using the link in an email, reply STOP to an SMS or WhatsApp message, or email info@forbtech.co.za at any time, free of charge. We keep a record of your opt-out so that we do not contact you again.

We do not sell, rent or trade your personal information to third parties for their own marketing.

7. Who we share information with

We share personal information only where you have consented, where it is needed to perform a contract with you, where the law requires it, or where it is needed to protect a legitimate interest. Depending on the circumstances, we may share it with:

• service providers acting as our operators, such as our e-commerce and website hosting platform, payment gateway, couriers, business software providers (for CRM, accounting, help desk and email), cloud backup and telephony providers;
• installation subcontractors who work on your site under our supervision and confidentiality obligations;
• manufacturers and distributors, including Hikvision and its South African distributors, to process warranty, repair and return claims;
• credit bureaus, if you apply for a credit account and consent to a check, and attorneys and debt collectors, to recover overdue amounts;
• professional advisers, auditors and insurers;
• SARS, regulators, law enforcement and courts, where the law requires or permits disclosure; and
• a prospective buyer or successor, if all or part of our business is sold or restructured, under confidentiality.

Every operator we use must sign a written agreement to keep your information confidential and secure, and to use it only for the services they provide to us.

Transfers outside South Africa

Some of our service providers, including cloud software and email platforms, store data on servers outside South Africa. In line with section 72 of POPIA, we transfer personal information across borders only where:

• the recipient is bound by a law, binding corporate rules or an agreement giving protection substantially similar to POPIA;
• the transfer is necessary to perform a contract with you, or a contract with a third party that is in your interest;
• you have consented; or
• the transfer is for your benefit and it is not reasonably practicable to obtain your consent.

8. Security, breaches and retention

How we protect your information: We take appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised access and unlawful processing, as required by section 19 of POPIA. These include:

• encrypted (HTTPS) connections on our website and shop;
• role-based access, strong passwords and multi-factor authentication on our business systems;
• encrypted storage of system credentials;
• confidentiality undertakings from staff and subcontractors, and written agreements with operators;
• regular backups, monitoring and security updates; and
• secure destruction of paper and electronic records we no longer need.

You can help by keeping your shop password private, and by securing the devices and accounts you use to view your security system.

If a breach happens

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as required by section 22 of POPIA. We will tell you what happened, what information was involved, and what you can do to protect yourself.

How long we keep information

We keep personal information only as long as needed for the purpose for which it was collected, unless the law, a contract or your consent requires us to keep it longer. We then delete, destroy or de-identify it.

We may keep information longer where needed to establish, exercise or defend a legal claim.

9. Your rights, children and cookies

Your rights

Under POPIA you have the right to:

• ask whether we hold personal information about you, and request a copy or description of it and the categories of third parties who have had access to it;
• ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds, to our processing of your information, and object at any time to direct marketing;
• withdraw your consent, where we rely on consent (this does not affect processing already done, and we may continue where the law or a contract permits);
• not be subject to a decision with legal effect based solely on automated processing; and
• lodge a complaint with the Information Regulator (section 10).

Send requests in writing to our Information Officer (section 10). We will ask for proof of identity before acting, so that we do not disclose your information to the wrong person. Access requests are handled under the Forbtech PAIA Manual, and a prescribed fee may apply; we will tell you the fee before proceeding. We respond within 30 days. Please let us know whenever your details change.

Children

Our website and products are not aimed at children under 18, and we do not knowingly collect their personal information without the consent of a parent or guardian. Security cameras installed at homes and schools may record children; the system owner is responsible for that footage (section 5).

Cookies

Cookies are small files that a website stores on your device. We use:

• essential cookies to run the shop cart, keep you logged in and protect the site, which cannot be switched off;
• analytics cookies to understand how visitors use the site so we can improve it; and
• marketing cookies to measure and tailor our advertising.

We set analytics and marketing cookies only with your consent, given through the cookie banner. You can change your choice at any time through the cookie settings link or your browser settings. Blocking essential cookies may stop parts of the shop from working.

10. Contact us, complaints and changes

Information Officer: For questions, requests or complaints about your personal information, contact:  We will try to resolve your complaint as quickly as possible.

Information Regulator

If you are not satisfied with our response, you may complain to the Information Regulator (South Africa):

Changes to this policy

We may update this policy when the law or our business practices change. The version published on our website, with its effective date, applies to your dealings with us. We will notify registered customers of material changes by email.

Effective date: 23 October 2026