Privacy Notice

S3B is the responsible party for the personal information described below.

• Registered name and company registration number: to be completed
• FSP licence number, if S3B is itself an FSP: to be completed
• Physical and postal address: to be completed
• Information Officer name and contact address, as registered with the Information Regulator: to be completed

Enquiries from this website. If you complete the contact form we store your name, brokerage, email address, telephone number and message, for the sole purpose of responding to your enquiry. We ask for your consent before storing it, and record that you gave it. We do not use these details for anything else and do not share them.

Brokerage reporting data. For brokerages who use the S3B platform, the reporting tools read commission and policy records from that brokerage's own administration database. This includes client names, policy numbers, premium and commission amounts, and the broker attributed to each policy.

S3B acts as an operator in respect of that reporting data: it belongs to the brokerage, which remains the responsible party for it. We read it in order to produce the brokerage's own reports and for no other purpose. We do not copy it into our own database — each report is generated by querying the brokerage's database at the moment the report is opened.

Website analytics. When you move between pages, this site sends the name of the page to our hosting provider, Base44, so we can see which parts of the site are used. That request necessarily carries your IP address, and if you are signed in it can be associated with your account. No advertising or tracking cookies are set, and the information is not shared with anyone else or used to profile you.

Access is restricted to named user accounts that S3B creates on request. Each brokerage user account is tied to exactly one brokerage, and that link is enforced by our servers rather than by the web page — a user cannot reach another brokerage's data by altering anything in their browser.

Designated S3B staff can access any brokerage's reports in order to support and maintain the platform. Every report request is recorded, including who made it, which brokerage it concerned, the filters used and how many records it covered.

Nobody can register an account themselves.

The S3B platform is hosted on Base44, and the application code that queries brokerage databases runs in Base44's infrastructure, which is located outside South Africa. Brokerage database contents are therefore transmitted across borders in the course of producing reports.

Section 72 of POPIA restricts transfers of personal information outside the Republic. S3B must confirm the lawful basis it relies on for this transfer, and must have a written operator agreement in place with Base44 as required by sections 20 and 21. Both are outstanding.

Enquiry details are kept only as long as needed to deal with the enquiry, and the retention period must be stated here.

Brokerage reporting data is not retained by S3B at all — it stays in the brokerage's own database. Access records are retained so that unauthorised access can be identified and reported; the retention period for those must also be stated here.

Database credentials are held in encrypted secret storage that only server-side code can read, never in the website itself or in any table the application can query. Each brokerage's database is reached with a separate credential, so one cannot be used to reach another. Report data is never stored in your browser.

We are candid that this is a work in progress. S3B has identified specific shortcomings in the security of at least one brokerage database it connects to, including connections that are not encrypted in transit and a database server that is no longer receiving security updates. Remediation is underway and this notice will be updated when it is complete.

Under POPIA you may:

• ask what personal information we hold about you, and get a copy
• ask us to correct or delete information that is wrong, misleading or no longer needed
• object to our processing, and withdraw consent you previously gave
• complain to the Information Regulator

If your information is held by a brokerage that uses our platform, direct the request to that brokerage — they are the responsible party for it, and we will assist them.

Information Regulator (South Africa) — enquiries@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001.

Requests and complaints go to the Information Officer at the address in the first section. A formal request form and our PAIA manual must be published here.