1. Who we are

iTRINITY Consulting (Pty) Ltd, registration number 2012/170337/07 (“iTRINITY”, “we”, “us”, “our”), is an information technology services provider based at Clearwater Office Park, Building 5, Ground Floor, Millennium Blvd, Strubens Valley, Roodepoort, 1724, South Africa. We are the responsible party for the personal information described in this policy.

Our Information Officer is Terence Holding, Managing Director, registered with the Information Regulator under registration number 2026-052897. You can reach the Information Officer at info at itrinity.co.za, on +27 11 664 6219, or by post at the address above.

2. What information we collect, and where it comes from

We collect only what we need, and almost all of it comes directly from you:

Enquiries and assessment requests: your name, company, email address, telephone number and message, when you complete a form on this site, call us or email us.
Client and support data: if you are a client, the contact details of your staff, and information about your IT environment (devices, users, systems, licences, tickets and incidents) that we need in order to support and secure it. Support tickets are handled in Nucleus, our support system, whether you call us, email us or use our support portal (opens in a new tab). A ticket holds your name, email address, telephone number and company, the subject and content of your request, the messages exchanged about it, and any files attached to it. We design, build and host Nucleus ourselves (Forged is the name of our development department). Tickets, their contents and their attachments are stored on our own systems at Teraco, a data centre in South Africa, and are backed up daily to separate hardware, also at Teraco.
Billing and supplier records: the business contact and payment details we need to invoice clients and pay suppliers.
FIREWALL game entries: if you submit a score, your name, email address, optional company name and score. Your name, company and score appear on the public leaderboard; your email address is never displayed and is used only to contact the monthly winner.
Job applications: the CV, contact details and supporting information you send us when applying for a role we have advertised on our careers page. We do not accept unsolicited CVs.
Website technical data: our web server keeps standard access logs (IP address, browser type, pages requested, date and time) for security and fault-finding. We do not run analytics or advertising trackers on this site (see section 10).

Giving us your information is voluntary. Without contact details we cannot reply to an enquiry or deliver a service you have asked for, but there is no other consequence of choosing not to provide it. We do not knowingly collect personal information from children, and we do not collect special personal information (such as health, biometric or religious data) unless a client’s systems happen to contain it, in which case we process it only as the client’s operator and on their instructions.

3. Why we process it, and on what basis

To provide, support, monitor and secure the IT services you have engaged us for: performance of a contract.
To respond to enquiries, quotes and assessment requests you initiate: steps you have asked us to take before entering a contract.
To run the FIREWALL leaderboard and award its prize: your consent, given when you submit a score.
To meet legal, tax and regulatory obligations: legal obligation.
To protect our systems and our clients’ systems against security threats, and to keep this website working: our legitimate interests.
To send you marketing about our services: your consent, or the existing-customer basis described in section 9.

We do not use personal information for automated decision-making that has legal or similarly significant effects on you.

4. Who we share it with

We do not sell personal information. We share it only where necessary to deliver our services, with operators who process it on our behalf under contract and are required to keep it confidential and secure:

Microsoft: Microsoft 365, Azure and related services run our email, documents and much of our clients’ infrastructure. Microsoft 365 receives all helpdesk email in and out, including names, addresses, message content and attachments.
Our endpoint-security, monitoring and backup vendors: the tools we use to protect and monitor client systems.
Cloudflare: its Turnstile service checks that the public forms on our support portal are being used by a person. It may process your IP address and browser details, and may set strictly necessary security cookies. It is not used on this website.
Anthropic: its AI model receives the sender, subject and body of automated backup-report emails that our rules cannot classify, to identify the client and whether the backup succeeded, so that we can log a ticket when one is needed. That is the only thing we use it for, and support tickets are never sent to it. These emails can contain incidental personal information such as a name or email address.
TeamViewer: for remote support sessions, when you connect to us through the link on this site.
Website forms: the enquiry and Cyber Health Check forms are sent by this website itself, from our hosting provider’s server, as email to our support inbox. No outside form service is involved.
e-Purifier: filters incoming email before it reaches Microsoft 365, and so receives that email.
Xero: our invoicing system, which receives invoice details, including the ticket number and a work description that can contain names.
Our website hosting provider: a South African shared-hosting provider, which holds the web server logs and the FIREWALL leaderboard data.
Our accountants, auditors, insurers and legal advisers: where needed for our own compliance.

We will also disclose personal information where the law requires it, for example to a court, regulator or law-enforcement agency acting within its powers.

5. Cross-border transfers

Some of the operators above may process personal information outside South Africa, and clients can ask us for details. Nucleus and its backups are hosted in South Africa, and this website itself is served from South Africa and loads nothing from third-party servers. Where personal information leaves South Africa we rely on section 72 of POPIA: the recipient is bound by contractual terms or a legal framework that gives substantially similar protection to POPIA, or the transfer is necessary to perform a contract with you or at your request.

6. How long we keep it

Enquiries that do not become client relationships: up to 12 months, so we can follow up and answer questions about our previous contact.
Client data: for the life of the engagement, then for the period we need to defend our legal position and to meet statutory record-keeping (typically five years for financial and tax records).
FIREWALL entries: the month’s scores are deleted when the board resets on the 1st. The winner’s name, company, score and email address are kept until the prize has been delivered, and the name, company and score remain in the hall of fame for up to 24 months.
Job applications: applications for an advertised role are kept for up to 12 months after the position is filled, unless you ask us to delete them sooner. Unsolicited CVs, sent when no role is advertised, are deleted without being reviewed.
Web server logs: rotated by our hosting provider on a short cycle, usually within a few weeks.

When information is no longer needed we delete it or de-identify it so that it can no longer be linked to you.

7. How we protect it, and what happens if something goes wrong

Security is our core business. We apply appropriate technical and organisational measures (access control and multi-factor authentication, encryption in transit, endpoint protection, monitoring, patching and backups) to guard against loss, unauthorised access and misuse, and we require the same of our operators. No system is perfectly secure. If we become aware of a security compromise that affects your personal information, we will notify the Information Regulator and, as required by section 22 of POPIA, notify you as soon as reasonably possible after we have taken steps to contain it.

8. Your rights under POPIA

You have the right to:

Ask whether we hold personal information about you, and request a copy of it.
Ask us to correct, update or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
Object, on reasonable grounds, to processing that relies on our legitimate interests.
Object at any time to direct marketing, and we will stop.
Withdraw consent where we rely on it. This does not affect processing already carried out.
Not to be subject to a decision based solely on automated processing.
Complain to the Information Regulator (section 12).

To exercise any of these rights, email info at itrinity.co.za or write to the Information Officer. You may use the Information Regulator’s prescribed forms, but you do not have to. We may need to verify your identity before we act, and we will respond within a reasonable time and in any event within 30 days. Requests for access to your own information are free; we may charge the prescribed fee for copies.

9. Direct marketing

We send marketing by email only if you have opted in, or if you are an existing client and the message is about services similar to those you already use from us, in which case you were given the chance to opt out when we first collected your details. Every marketing message identifies us as the sender and includes a way to unsubscribe. You can opt out at any time by using that link or by emailing us, and we will not send you marketing again unless you ask us to.

10. Cookies, local storage and website technical data

This website sets no cookies of its own and runs no analytics or advertising trackers. It stores a small amount of data in your browser’s local storage (your cursor preference and your FIREWALL name and personal best). That data never leaves your device and does not identify you. Our support portal runs on its own domain. Nucleus sets no cookies on its public form. The form uses Cloudflare Turnstile for its spam check. Turnstile runs from Cloudflare’s domain under Cloudflare’s policies, and Cloudflare may set strictly necessary security cookies for that check. If you sign in to the portal, it sets a cookie to keep you signed in. Our staff also get cookies for their sign-ins and screen preferences. The portal sets no analytics or advertising cookies. TeamViewer, which we link to, sets its own cookies on its own domain under its own policies. Full detail is in our Website & Cookie Policy.

11. Access to records (PAIA)

Requests for access to records we hold, under the Promotion of Access to Information Act, 2 of 2000 (PAIA), are handled by the Information Officer. Our PAIA manual (PDF) sets out the categories of records we hold, how to make a request and the fees that may apply. It is also available for inspection at our office during business hours, and the Information Regulator’s Guide on how to use PAIA is at inforegulator.org.za (opens in a new tab).

12. The Information Regulator

If you believe we have not handled your personal information lawfully, you may lodge a complaint with the Information Regulator (South Africa):inforegulator.org.za (opens in a new tab)· JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. We’d appreciate the chance to put it right first, so please contact us too.

13. Changes to this policy

We may update this policy from time to time, for example when we change the operators we use. The “last updated” date at the top reflects the current version, and material changes will be highlighted on this page.

14. Contact us

Questions about this policy or about how we handle your information:
Email: info at itrinity.co.za
Phone: +27 11 664 6219
Post: Clearwater Office Park, Building 5, Ground Floor, Millennium Blvd, Strubens Valley, Roodepoort, 1724