Privacy Policy
Draft — pending legal review. Not yet in effect.
Who we are
Utility Revenue Systems (Pty) Ltd ("URS", "Gridix", "we", "us", "our") is the responsible party for the personal information described in this policy.
Utility Revenue Systems (Pty) Ltd
10 Onse Jan Avenue, Somerset West, 7130, South Africa
Registration No: 2019/040426/07
Email: info@ursystems.co.za
Scope
This policy explains how we collect, use, store, and protect personal information in connection with the Gridix website and customer portal, in line with the Protection of Personal Information Act, 2013 (POPIA). It applies to property owners and landlords who register with Gridix ("you", "Meter Owner"). It does not currently cover tenants, who don't interact with our systems directly.
What we collect
When you register, we collect:
- Identity information: full name or company name, SA ID number or company registration number, VAT number (if applicable), cell number, landline, and email address.
- Property information: stand/unit number, complex or building name, suburb, city/town, province, municipality, supply authority, and municipal/Eskom account number.
- Metering information: meter serial number(s), meter type, billing type, previous supplier, and installation details.
- Account security information: a hashed (never plaintext) password, and login session data.
- Consent records: which version of our Terms & Conditions you accepted, and when.
We do not currently collect banking details or supporting documents through this portal. That's planned as a future, separately hardened stage with additional access controls before it's added.
Why we collect it
We process your personal information to:
- create and administer your Gridix account and the property/meter records linked to it;
- provide prepaid metering administration services described in our Terms & Conditions, including token vending, transaction reporting, and settlement payouts;
- verify your identity and confirm you're entitled to act for the property you register;
- communicate with you about your account, meters, or support requests; and
- meet our own legal, tax, and regulatory obligations.
Our lawful basis is that this processing is necessary to perform our contract with you (see the Terms & Conditions), together with the consent you give at registration.
Consent
When you register, you're asked to explicitly accept our Terms & Conditions, which incorporate this policy. We record that acceptance — which version, and when — against your account. You can withdraw consent at any time by closing your account, subject to our right to retain information where the law requires it (see "How long we keep it" below).
Who we share it with
We don't sell your personal information. We share it only where necessary to provide our service — for example, with the vending platform that issues prepaid tokens against your registered meter serial numbers — and with regulators, auditors, or law enforcement where we're legally required to.
Data residency
Our servers and databases are hosted in South Africa. We don't transfer your personal information across South Africa's borders.
How we protect it
We apply technical and organisational safeguards including:
- encrypted transport (HTTPS) for all traffic to and from the site and portal;
- passwords stored as one-way hashes, never in plain text;
- access to your account records restricted to you — enforced at the database query level, not just in the interface;
- server-side validation on every field we collect, not just client-side checks; and
- rate limiting on login and registration to reduce automated abuse.
Cookies
We use one strictly necessary session cookie to keep you signed in. We don't use advertising or analytics cookies, and we don't track you across other websites.
How long we keep it
[Legal to confirm retention period] — we intend to keep your information for as long as your account and property registration are active, and for a defined period afterward to meet our legal, tax, and dispute-resolution obligations. The exact retention period will be set here once confirmed.
Your rights
Under POPIA, you have the right to:
- access the personal information we hold about you;
- ask us to correct or update it — you'll be able to do this yourself via the customer portal once it launches;
- ask us to delete it, subject to our legal retention obligations;
- object to certain processing, or withdraw consent; and
- lodge a complaint with the Information Regulator (see below).
To exercise any of these rights, contact us using the details in "Who we are" above.
Children's information
Our services are intended for adult property owners and landlords. We don't knowingly collect personal information from children.
Changes to this policy
We may update this policy from time to time. The latest version is always available at this page. Material changes will be communicated to registered account holders.
Information Officer
[Legal/URS to provide: Information Officer's name and direct contact details] — POPIA requires every responsible party to register an Information Officer and disclose their contact details here.
Complaints to the Information Regulator
If you're not satisfied with how we've handled your personal information, you can complain to South Africa's Information Regulator. [Legal to verify these details are current before publishing]
Email: enquiries@inforegulator.org.za ·
complaints: POPIAComplaints@inforegulator.org.za
Website: justice.gov.za/inforeg