ESG Navigator Platform — TIS Holdings (Pty) Ltd
TIS Holdings (Pty) Ltd ("TIS Holdings", "we", "us", or "our"), registered in the Republic of South Africa, operates the ESG Navigator platform at esgnavigator.ai ("the Platform"). We are committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPIA"), the Promotion of Access to Information Act, 2000 (Act No. 2 of 2000) ("PAIA"), and all applicable data protection legislation.
This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use the Platform.
Responsible Party: TIS Holdings (Pty) Ltd
Information Officer: Dr. Terry Ramabulana
Email: terry@tisholdings.co.za
You may contact our Information Officer for any queries regarding this Privacy Policy, to request access to your personal information, or to lodge a complaint.
We do not collect special personal information as defined in POPIA Section 26, including race, ethnic origin, political opinions, religious beliefs, trade union membership, health information, sexual orientation, biometric data, or criminal records — unless explicitly required for a specific ESG assessment and with your express consent.
| Purpose | Legal Basis (POPIA) |
|---|---|
| Account creation and authentication | Section 11(1)(a) — Consent |
| Delivery of ESG compliance assessment services | Section 11(1)(b) — Contractual obligation |
| AI-powered compliance analysis and recommendations | Section 11(1)(a) — Consent |
| Platform security, fraud prevention, and access control | Section 11(1)(d) — Legitimate interest |
| Compliance with legal and regulatory obligations | Section 11(1)(c) — Legal obligation |
| Service improvement and analytics | Section 11(1)(d) — Legitimate interest |
| Communication regarding your account and services | Section 11(1)(b) — Contractual obligation |
The Platform uses AI models, including Anthropic Claude and IBM Watsonx, to provide ESG compliance analysis, risk assessments, and recommendations. When you interact with the AI assistant or submit assessment data:
In accordance with POPIA Section 71, you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. You may request human review of any AI-generated assessment or recommendation.
In accordance with POPIA Section 72, we transfer personal information outside the Republic of South Africa to the following service providers:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Anthropic (Claude AI) | AI processing | United States | Contractual clauses, data minimisation |
| Amazon Web Services | Infrastructure | Various | AWS DPA, encryption |
| Neon Tech | Database | United States | Encryption at rest and in transit |
| Railway | Backend hosting | United States | Environment isolation |
| Vercel | Frontend hosting | Global CDN | Edge-only static delivery |
| Cloudflare | Security, DNS | Global | Cloudflare DPA |
| DRATA | SOC 2 compliance | United States | SOC 2 Type II certified |
All cross-border transfers are protected by encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control, and data processing agreements with all providers.
| Data Category | Retention Period |
|---|---|
| Account information | Active account + 12 months after closure |
| Assessment data and reports | 5 years from assessment date |
| AI interaction logs | 12 months |
| Authentication and access logs | 24 months |
| Financial and billing records | 5 years |
Technical Measures: JWT-based authentication with token expiry, role-based access control (RBAC), bcrypt password hashing, TLS 1.2+ encryption, database encryption at rest, session management with automatic timeout, and CORS policy restricting API access.
Organisational Measures: Information security policies, staff access limited to role-required data, regular security assessments, incident response procedure, and SOC 2 compliance pathway via DRATA.
Contact our Information Officer at terry@tisholdings.co.za. We will respond within 30 days.
In accordance with POPIA Section 22, in the event of a security compromise we will notify the Information Regulator and affected data subjects as soon as reasonably possible, document the breach, and take remedial steps.
The Platform currently does not use cookies, third-party tracking scripts, or advertising technologies.
The Platform is not directed at children under 18. We do not knowingly collect personal information from children.
Material changes will be communicated via the Platform or email.
Contact our Information Officer at terry@tisholdings.co.za, or lodge a complaint with the Information Regulator:
This Privacy Policy is governed by the laws of the Republic of South Africa, including POPIA and PAIA.