CLK Joint Operations Group — Privacy & POPIA Notice

1. About this Notice

CLK Protection Services (Pty) Ltd operates the Joint Operations registration Portal for persons aged 18 years or older who are associated with SAPS, Metro Police, Private Security, CPF, Ambulance/EMS, Fire & Rescue, and other approved participating organisations.

This Notice explains how personal information is processed under the Protection of Personal Information Act 4 of 2013 (POPIA), including the notification contemplated by section 18 of POPIA.

2. Responsible Party and Privacy Contact

The suitable public-facing address is being confirmed. Formal privacy correspondence should presently be initiated through the published privacy/PAIA email. Information Officer registration with the Information Regulator is pending; this Notice does not represent that registration as completed.

3. Information collected

Applicant-provided information

• first name and surname;
• contact number, optional WhatsApp username, and optional email;
• organisation/division and, conditionally, a security company or Other organisation;
• optional role, operational area, and Additional Information; and
• the declaration and legal acknowledgements.

Administrative or generated information

• CLK reference and submission date/time;
• status, review/status history, confirmation dates, and due dates;
• proposed updates, administrative/verification notes, and reasons relevant to decisions; and
• secure confirmation/update-link audit information.

4. Required versus optional information; adults only

Registration is voluntary, but the required fields are necessary if a person chooses to register. The Portal is for persons aged 18+ only.

5. Purposes and lawful grounds

Information is used to receive and administer registrations; identify applicants; verify affiliation where reasonably necessary; determine eligibility; maintain a participant register; and add or invite approved users to the Joint Operations WhatsApp group. It also supports operational coordination, safety-related communication, annual confirmation, applicant updates, administrative history, duplicate application identification, and group security and integrity.

Where necessary and lawful, it may be used in relation to suspected material misrepresentation or misuse, relevant legal or security evidence, and lawful obligations. It is not collected for unrelated commercial marketing and is not sold to advertisers.

Lawful grounds

Submission is not treated as blanket consent to all processing. Depending on the activity, processing may rely on one or more POPIA grounds: consent where appropriate; processing necessary for the conclusion or performance of the participation arrangement where applicable; compliance with a legal obligation; protection of a legitimate interest of the data subject; or pursuit of legitimate interests of CLK or an appropriate third party where this does not unjustifiably interfere with privacy.

Withdrawal of consent affects only activities actually based on consent and does not invalidate lawful processing on another applicable ground.

6. Verification, access and sharing

Verification ordinarily uses phone or WhatsApp contact, professional or operational networking, and—where reasonably necessary—contact with the stated employer, company, organisation, or division. There is no routine requirement for an identity document or proof of employment.

An identity document may exceptionally be requested for a high-assurance privacy/access request or other legitimate verification. If a copy is obtained solely for that verification, it will be handled carefully and deleted promptly after verification unless retention is lawfully required.

Full registration records are restricted to authorised administrators. Limited information may be supplied as reasonably necessary to a stated employer/company/organisation/division, another appropriate verification contact, technology providers, advisers, or lawful authorities. The registration database is not made available to WhatsApp group members.

7. WhatsApp and communication

Approved participants may be added or invited to the CLK Joint Operations WhatsApp group. According to WhatsApp functionality and each user's privacy settings, other participants may potentially see a phone number, username, profile name, profile image, status or profile information, and content deliberately posted to the group.

WhatsApp is a separate third-party platform and its own policies apply. Principal communication is by WhatsApp and phone. Optional email, or the stated employer/company, may exceptionally be used where reasonable if an applicant cannot otherwise be reached.

8. Cloudflare and transborder processing

The Portal uses Cloudflare Pages, Workers and D1. Relevant Cloudflare infrastructure may process or store information outside South Africa. WhatsApp may also process information outside South Africa. No particular foreign hosting country is promised.

Transborder processing is intended to be dealt with in accordance with section 72 of POPIA and applicable safeguards.

9. Security safeguards

Current safeguards include restricted administrator access, authentication, role-based permissions, secure confirmation/update links, and reasonable technical and organisational safeguards. No online system can be represented as completely or “100%” secure.

10. Annual confirmation

Information is confirmed approximately every 12 months, and changes may require review. If confirmation is overdue, CLK may attempt contact. After a reasonable period—ordinarily around 30–60 days without response—the registration may be archived, the participant may be removed from the Joint Operations WhatsApp group, and notice may be sent where reasonably practicable.

11. Retention and deletion

• Active approved: retained while the participant remains active and the record remains necessary.
• Rejected: retained approximately 12 months in Rejected, then moved to Archived.
• Archived: retained approximately another 12 months, then eligible for permanent deletion after authorised review.
• Withdrawn/cancelled: ordinarily deleted within 3 months where no lawful reason remains.
• Abandoned/incomplete database records, if any: ordinarily retained approximately 3 months after last meaningful activity.
• Status, confirmation and secure-link audit history: ordinarily retained with the underlying registration and removed when it is permanently deleted.

Longer retention may be legitimate where required for law, a dispute, complaint, security incident, suspected fraud or misrepresentation, malicious disclosure or misuse, a police investigation, or legal rights and evidence.

Deletion while an active participant

Active participation requires minimum identification, contact, and affiliation information. A person cannot necessarily require removal of information that remains lawfully necessary while simultaneously continuing as a verified active participant. If complete deletion of necessary participation information is requested, participation may first need to end. This does not override any POPIA right, and each request will be assessed under applicable law.

12. Special personal information and internal notes

Applicants should not place unnecessary special personal information in Additional Information, including information about religion, race or ethnicity, political views, union membership, health, sex life, biometrics, or criminal behaviour.

Administrators may retain relevant verification, review, decision, or security notes. These are restricted, may themselves constitute personal information, and must be relevant rather than gratuitous.

13. Data-subject rights

Subject to POPIA, a person may request confirmation whether information is held; access; correction; deletion or destruction where legally applicable; objection where applicable; withdrawal of consent where consent is the actual ground; and may complain to the Information Regulator.

Send privacy requests to clkgrp.identify@gmail.com. Reasonable identity verification may be required to protect the requester and other people.

14. Information Regulator

15. PAIA, Participation Terms and changes

For access-to-information information, see the PAIA Manual. Participation is also governed by the Joint Operations Participation Terms.

This Notice may be updated as practices or law change. Material changes requiring further notification or consent will be handled as required; continued use is not treated as automatic acceptance of future privacy processing where law requires something more.