Platform Privacy Policy

Who we are

The Augos platform is run by Finishing Touch Trading 516 (Pty) Ltd, trading as Augos (registration number 2009/014994/07). In this policy, "Augos", "we" and "us" mean that company. Our address is The Crest Office Estate, 154 Goedemoed Road, Durbanville, 7550, South Africa.

What this policy covers

This policy covers:

• the Augos platform at live.augos.io
• the Augos Load Curtailment and Augos Community Curtailment mobile apps, and the alerts, reports and service emails the platform sends
• the support we give its users

It explains what the platform holds, how we use it, who receives it, where it is stored and what your rights are under the Protection of Personal Information Act, 2013 (POPIA). Our website, augos.co.za, has its own Website Privacy Policy.

Our role, and your organisation's

Our customers are organisations that use the platform to measure and manage their sites. Our role depends on the information.

• Your user account and audit record. Augos is the responsible party.
• Measurement data about your organisation's sites, and information about your staff that your organisation puts into the platform. Your organisation is the responsible party, and we act as its operator. We process this information on your organisation's instructions and for the purposes it sets.

If you work for one of our customers, occupy a site we measure or receive its alerts, send questions about that information to the organisation that runs the site. We'll help it respond.

Information Officer

Eduan Shuda · support@augos.io

What the platform holds

Measurement data

The platform records readings from the meters, sensors and control equipment installed at your organisation's sites. These cover:

• electricity, water, gas and fuel consumption
• demand and power factor
• flow, pressure, level and volume
• temperature, humidity, vibration and other environmental readings
• equipment state, including doors, beams, tamper and smoke detection, and sound level

These readings measure equipment and environment. They do not identify individuals. No Augos sensor enrols, recognises or identifies a person. A door sensor records that a door opened; it does not record who opened it. Sound sensors measure sound level only. They do not record, transmit or store audio.

Readings can relate to an identifiable person in two cases:

• A measurement point may serve premises occupied by one person or business, such as a sub-metered tenancy. The readings may then be attributable to that occupant.
• Your organisation names its own measurement points. If it names a point after a member of staff, that name is stored with the readings.

Named machine operators

If your organisation uses manufacturing analysis and has set up named operators, the platform records production, compliance and stoppage figures against those individuals.

This is personal information about your organisation's employees, and your organisation is the responsible party for it. We process it only on your organisation's instructions and under our agreement with it. Under that agreement, your organisation confirms that it has a lawful basis for this monitoring and has told the individuals concerned.

User accounts and audit records

For each user, we hold:

• your name, email address and telephone number
• your role and access permissions

We also log:

• when you sign in
• what you retrieve
• what control actions you take, such as switching a relay, valve or variable-speed drive

This is your account and audit record, and we keep it to give you access, to keep the platform secure and to keep a trail of control actions. Your organisation's administrator usually gives us your details when setting up your account. We need at least your name and email address to create it.

Alerts, reports and support

We hold the contact details of the people your organisation sets up to receive alerts and scheduled reports. That means email addresses and, where alerts go by text message or a messaging app, mobile numbers. When you ask for help, we keep your support request and the correspondence about it.

Billing

The platform holds tariff, cost and bill-verification information for your organisation's sites. This relates mainly to your organisation. POPIA protects organisations as well as people, so we treat it as personal information.

The platform isn't designed to hold special personal information, such as details of health, religion or biometrics. Please don't enter it in measurement point names, notes or support requests.

Mobile apps

The Augos Load Curtailment and Augos Community Curtailment apps show load curtailment performance from the platform. When you use them, we collect app-usage analytics: when the app is opened, your device type and an app identifier. We keep this analytics data for two months. Anything else you enter in an app is handled as described in this policy.

The Community Curtailment app is for households. The consumption data it shows for your home is personal information about you. The organisation that runs your estate's curtailment programme is the responsible party for it, and we process it as its operator. Send questions about your data to that organisation.

Cookies and analytics

The platform uses essential cookies to keep you signed in. It also uses analytics, set by a third-party analytics service, to show us how the platform is used so that we can improve it. Analytics uses cookie identifiers, your IP address and device information. We keep analytics data for 14 months after your last visit. If you block essential cookies, you won't be able to sign in.

How we use it

We use platform information to:

• collect, store, calculate and report your organisation's measurement data, including tariff and cost calculations, bill verification and alerts
• run automated analysis for your organisation (see below)
• give you access, keep the platform secure and keep a trail of control actions
• answer support requests
• send service emails about your account, alerts and reports; these aren't marketing
• invoice your organisation and keep the records tax and company law require

For your user account and audit record, we rely on our legitimate interest in providing and securing the service your organisation has contracted for. For information we process for your organisation, your organisation decides the lawful basis.

Where our agreement with your organisation allows it, we may also use measurement data in anonymised, aggregated form to improve the platform. Once anonymised, it no longer identifies your organisation or any person.

Automated analysis

We use contracted third-party artificial-intelligence services to help analyse platform data and to answer questions about it. Where your organisation has set up named operators, this includes their names and figures. Under our contracts with those providers:

• your data is not used to train their models
• they may process it only to provide their service to us
• they delete it within 30 days, except content flagged for a safety review, which may be kept longer

This processing takes place outside South Africa, under the section 72 safeguards described below.

Automated analysis produces reports and answers for your organisation. It doesn't make decisions about individuals. Any decision about a person, such as one about an operator's performance, is made by your organisation, not by the platform. Our agreement with your organisation requires it not to make such a decision based solely on this output.

Where your organisation has named operators, its use of their data in automated analysis is governed by its agreement with us.

Who receives it

• People in your organisation. Your organisation's administrators decide who can see which sites and measurement points, and each user sees only what their role allows.

• Our staff. Only the staff who need the information to run, support or secure the platform can see it.

• Service providers that work for us. We use providers for:

  • platform hosting
  • email, email delivery and document services
  • accounting and invoicing
  • the automated analysis described above, platform and app analytics, and delivery of alerts by text message and messaging app

  They process information to provide their service to us, under terms that require them to protect it.

• Anyone the law requires. For example, a regulator or a court.

• A buyer of the business. If Augos or part of it is sold, platform information may pass to the new owner, who must protect it on the same terms.

We do not sell your data, and we do not share it for anyone else's marketing.

Where it is stored and processed

The platform stores your measurement data, including its backups, in South Africa.

Some information, including copies of measurement data, is processed or held outside South Africa:

• Automated analysis. The data sent for automated analysis is processed outside South Africa. So are platform and app analytics data, and alerts sent through messaging apps.
• Business records. We keep records about your organisation's account in the email, document and accounting services we use to run the business. These include correspondence, contracts, quotes, invoices and the reports we email you. The services are run by international providers and store data outside South Africa. They are not used to analyse your measurement data.

When we transfer personal information outside South Africa, we do so under section 72(1)(a) of POPIA. The recipient must be bound by a law, binding corporate rules or a binding agreement that gives the information a level of protection substantially similar to POPIA.

How long we keep it

Information	How long we keep it
Measurement data, including named operator data	For as long as your organisation's contract runs. After it ends, we archive it for at least five years in case the contract is reactivated, then delete it, unless your organisation asks us to delete it sooner under our Data Deletion Policy
User accounts	While the account is active. Your organisation's administrators can remove a user at any time
Audit records of sign-ins and control actions	As for measurement data
Alert and report recipients	Until your organisation removes them
Support requests	As for measurement data
Invoices and account records	For as long as tax and company law require, currently up to seven years

When a retention period ends, we delete the information or de-identify it so it can no longer be linked to anyone.

You can also ask us to delete platform data. Our Data Deletion Policy explains how.

How we protect it

• The platform runs in a Tier III or higher data centre, with firewalls and intrusion prevention. It is backed up on-site and off-site.
• Traffic between your browser or API client and the platform is encrypted in transit (HTTPS).
• Your organisation's administrators set each user's role, which controls access down to individual measurement points.
• Our staff can see platform data only on a need-to-know basis. All access is logged.
• We carry out security audits twice a year.

If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we'll act under POPIA sections 21 and 22. For information we process for your organisation, we'll tell your organisation immediately, so it can notify the Information Regulator and the people affected. For user accounts, we'll notify the Information Regulator and you.

Your rights

Under POPIA you may:

• ask whether we hold personal information about you, and ask for a copy of it
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained
• object to processing that relies on legitimate interests
• withdraw your consent, where it is relied on
• complain to the Information Regulator

Your user account. Send requests about your account to the Information Officer at support@augos.io. We may ask you to confirm your identity first.

Information an organisation holds on the platform. The organisation that runs the site is the responsible party for measurement data about its sites and for operator data about its staff. Send requests about that information to that organisation. If you send them to us, we'll pass them on and help it respond.

Requests for access are handled under the Promotion of Access to Information Act. The Information Officer will send you the form to use.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You may also complain to the Information Regulator:

• Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• POPIAComplaints@inforegulator.org.za
• 010 023 5200
• inforegulator.org.za

Changes to this policy

We'll update this policy when our practices change, and the version number and date at the top will show when it last changed. We'll tell our customers about significant changes before they take effect.