Privacy & POPIA Notice

Last updated: 2026/10/08

Check My CoC ("we", "us", "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 4 of 2013 ("POPIA"). This notice explains what personal information we collect, why we collect it, how we use and share it, and what your rights are.

1. Responsible party

Check My CoC is the "responsible party" as defined in POPIA in respect of the personal information processed through the Check My CoC platform at checkmy.cc. You can contact us at any time via the Contact page for any privacy-related query.

2. Personal information we collect

We collect and process the following categories of personal information:

• Account information — your name, email address, password (stored as a salted hash), and (optionally) multi-factor authentication credentials.
• Documents you upload — Certificates of Compliance, test reports, and registration cards. These may contain personal information of third parties (e.g. the registered electrician, contractor, or property owner).
• Information extracted or entered — the certificate number, property address, registered person's name and ID number, contractor details, and supporting fields.
• Payment information — limited to a payment reference and amount. Card details are processed entirely by our payment gateway and are never stored on our servers.
• Technical information — IP address, browser type, device information, and basic request logs used for security, abuse prevention, and debugging.

3. Purpose and lawful basis for processing

We process personal information only for the following purposes and on the following lawful bases:

• To provide the verification service you have specifically requested (performance of contract).
• To generate, store, and deliver your verification report (performance of contract).
• To authenticate you and protect your account (legitimate interest and legal obligation).
• To comply with our legal, tax, and regulatory obligations.
• To detect, prevent, and respond to fraud, abuse, or security incidents (legitimate interest).
• To respond to your queries and to provide customer support.

4. Special note on third-party personal information

When you upload a CoC or test report, you may be submitting the personal information of an electrician, contractor, or other party. By submitting these documents, you confirm that you have a lawful basis to do so (e.g. you are the property owner, buyer, landlord, insurer, or authorised representative) and that you have informed the relevant party where required.

5. Use of artificial intelligence

We use a third-party large language model (currently Anthropic's Claude) to read your uploaded documents and pre-fill form fields. The document and the extracted text are sent to that provider strictly for this single purpose. We do not authorise the provider to use your data to train its models. You always review and may edit the extracted information before submitting.

6. Sharing of personal information

We do not sell your personal information. We may share it only with:

• Operators (POPIA's term for processors) acting on our written instruction — for example our cloud hosting provider, our database provider, our email delivery provider, our payment gateway, and our AI extraction provider.
• Law enforcement, regulators, or other authorities where we are legally required to do so.
• A successor in the event of a corporate transaction (sale, merger, or restructure), subject to equivalent confidentiality and POPIA obligations.

7. Cross-border transfers

Some of our service providers (including our AI extraction provider) are located outside South Africa. Where personal information is transferred outside the Republic, we rely on the exceptions in section 72 of POPIA, including binding contractual safeguards equivalent to those required by POPIA, and processing based on the conclusion or performance of a contract with you.

8. Security

We implement reasonable technical and organisational measures to protect your personal information, including encryption in transit (TLS), encryption at rest for sensitive identifiers (AES-256-GCM), strict access controls, role-based authorisation, audit logging, and regular patching of our systems. No system is 100% secure; if we become aware of a security compromise we will notify you and the Information Regulator as required by POPIA.

9. Retention

We retain verification records and uploaded documents for as long as necessary to provide the service, generate your downloadable report, and comply with our legal and regulatory obligations. You may request deletion at any time, subject to overriding legal or compliance retention requirements.

10. Your rights under POPIA

You have the right to:

• Be notified that your personal information is being collected.
• Request access to the personal information we hold about you.
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
• Object to the processing of your personal information on reasonable grounds.
• Object to direct marketing (note: we do not currently engage in direct marketing).
• Lodge a complaint with the Information Regulator of South Africa.

11. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to protect against cross-site request forgery (CSRF) attacks. We do not use advertising or third-party tracking cookies. See our Cookie Notice for details.

12. Children

The Check My CoC service is not intended for use by children under the age of 18. We do not knowingly collect personal information from children.

13. Changes to this notice

We may update this notice from time to time. The "Last updated" date above will reflect the latest version. Material changes will be brought to your attention via the platform.

14. Contact and complaints

For any privacy-related question or to exercise any of your POPIA rights, please use the Contact page. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.