Privacy

Cedrus is software for insurers, MGAs and UMAs. In this notice “we”, “us” and “our” mean the business behind Cedrus. We are the responsible party, under the Protection of Personal Information Act 4 of 2013 (POPIA), for personal information collected through this website and in emails you send us. You can reach us at hello@cedrusure.com.

• Through the contact form: your name, email address, organisation, what you run (an insurer, an MGA or UMA, or other) and your message. Every field is required so we can understand and answer your enquiry; if you would rather not fill them in, email us instead.
• When you email us, including about a role: your email address and whatever you choose to include, such as a CV.
• When you visit: like any website, the servers that host it receive what your browser sends with each request, such as your IP address, browser type and the page requested. These servers belong to our hosting provider, Cloudflare, and are usually in the data centre nearest to you. We do not use this to identify you.

We do not ask for special personal information, such as health details or religious beliefs, or for information about children. Please do not include it in a message.

• To reply to your enquiry and carry on the conversation you started.
• To consider you for a role, if you write to us about one.
• To run this website and keep it secure.
• To meet our legal obligations.

We rely on the grounds in section 11 of POPIA: our legitimate interest in answering business enquiries and keeping the site secure; steps you ask for before a possible contract with you, such as a job application; and our legal obligations. We do not make automated decisions about you.

We do not send marketing emails, and the contact form does not sign you up for anything. If that changes, we will update this notice first, send electronic marketing only as section 69 of POPIA allows, and let you opt out of every message.

This website sets no cookies and stores nothing in your browser, with one exception: if our hosting provider, Cloudflare, has to check that a visit is not an automated attack, it may show a short check page and set a security cookie (cf_clearance) so it does not ask again. That cookie is needed to let you through and is not used to track you. The website has no analytics, advertising or tracking tools, and it loads nothing from other websites: even its fonts are served from our own domain. If that changes, this notice will say so first.

We do not sell, rent or trade personal information. We share it only with:

• the service providers that host this website and deliver and store our email, who process it on our instructions. Our hosting provider, Cloudflare, also uses traffic data such as IP addresses on its own account to protect its network against attacks;
• professional advisers, such as lawyers and auditors, when we need their advice;
• regulators, courts or law enforcement, when the law requires it.

Some of those providers store or process information outside South Africa. Our hosting provider, Cloudflare, is based in the United States: it handles each visit at a data centre near you and keeps its records mainly in the United States and the European Economic Area. Contact form messages are delivered by an email service based in the United States. We send personal information across the border only as section 72 of POPIA allows, such as to a recipient bound by law or agreement to protect it to a standard substantially similar to POPIA.

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, and only people who need it for the purposes above can see it. No system is completely secure. If there are reasonable grounds to believe that someone has accessed or acquired your personal information without authority, we will notify the Information Regulator and you as section 22 of POPIA requires.

We keep an enquiry, and the emails that follow, for as long as we need them to deal with it and any business that results. We keep a job application for as long as the hiring process needs it. Then we delete them, unless the law requires us to keep them longer. Our hosting provider keeps server request logs for a limited period.

You have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or that we are no longer allowed to keep;
• object to how we use it, and withdraw any consent you gave;
• complain to the Information Regulator.

To use these rights, email hello@cedrusure.com. We may ask you to confirm who you are before we act. Requests for access follow the procedure in the Promotion of Access to Information Act 2 of 2000.

This notice covers this website. When an insurer, MGA or UMA uses Cedrus to run its business, that business, or the insurer it acts for, decides what personal information about its customers is processed and why. It is the responsible party and its own privacy notice applies; we process that information only on its instructions, as its operator.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Regulator (South Africa):

• Website: inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• Telephone: 010 023 5200
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

We update this notice when what we collect, or how we use it, changes. The date at the top shows when it last changed.