This policy explains how Global Software Services (Pty) Ltd handles personal information in the GSS Support Portal at support.globalsoftwareservices.co.za, in the support pages of our products that the portal hosts, and in the enquiry forms and support requests that reach it from our websites and products. We follow the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible
The responsible party is Global Software Services (Pty) Ltd ("GSS", "we", "us"), a private company registered in South Africa, registration number 2021/476309/07. NewHost, SimpliSend, Summarix, Cinemasoft (GSS Cinema), CentraPoint, Cobra Connect and GSS Support are trading names and products of Global Software Services (Pty) Ltd.
- Information Officer: Nathan Avis (Director)
- Email: [email protected]
- Phone: +27 16 001 0395 (office), +27 71 680 9898 (mobile)
- Address: 7 Kromiet Avenue, Waldrift, Vereeniging, 1939, Gauteng, South Africa
2. Whose information this covers
- Clients and client contacts: the businesses we work for and the people at those businesses who use the portal.
- People who register themselves on the portal.
- Users of our products (NewHost, SimpliSend, Summarix, Cinemasoft, CentraPoint, Cobra Connect) and visitors to globalsoftwareservices.co.za who send us an enquiry or a support request.
- Prospective clients (leads) whose details our staff record.
- Our staff, including people who worked for us before.
- End users of our clients' apps, where error reports from those apps reach us (see section 6).
3. What we collect and where it comes from
Account and contact details (from you, your organisation or our staff)
Name, username, email address, phone number, company, position, and the company registration number, VAT number and address that you choose to give. Your password is stored only as a one-way hash. For contacts that a client adds, we also keep which parts of the portal they may see and their notification choices.
Tickets, messages and attachments (from you and from us)
The content of support tickets, replies, internal notes and files that you or our staff attach. Attachments are stored in our database and may be up to 10 MB each. Emails that you send to our support mailbox become ticket messages, together with the sender's name and email address.
Enquiries and support requests from our websites and products
When you use the contact form on globalsoftwareservices.co.za, an enquiry form or help widget of one of our products, or a product sends us your support request, we receive your name, email address, phone number, company, subject and message, and may receive the page you sent it from, how you reached it (referrer and campaign tags) and your consent choices. Each one becomes a support ticket in this portal, and our staff are told about it by email and, if they allow it, by push notification. When a product passes on a request, it may also send its own user ID for you, so that your tickets can be linked to your account there.
Client-issue reports
When something fails for a user in the portal or on globalsoftwareservices.co.za, we record a short report: a reference number, the area and action that failed, the error status, the page path and, if you were signed in, your user ID. Email addresses, numbers, passwords and tokens are removed from these reports before they are saved, and the reports are deleted automatically after 180 days.
Leads, referrals, client records and contracts (from our staff and our clients)
Company name, contact name, email address, phone number and notes about prospective work. For referrals, the names, email addresses and phone numbers of the person who made the referral and of the person referred, and any commission. Contracts and agreements signed in the portal, with the names, titles, dates and electronic signatures of the people who sign them.
Sign-in and security (from you and your browser)
- If you sign in with Google, Facebook or GitHub, we receive your name, email address and an account ID from that provider, directly or through Google Firebase Authentication.
- If you turn on two-factor authentication: an authenticator-app key and backup codes (both encrypted), or, for the SMS second factor, your mobile number. Firebase Authentication, a Google service, sends the SMS code to that number, so the number goes to Google.
- For sign-in codes by email: your email address, a hash of the code and your IP address.
- If you tick "Remember this device for 30 days": a record of the trusted browser (its browser description) and the
device_trustcookie (see section 15). - An audit log of actions in the portal, with the user, IP address and browser description.
Push notifications (only if you allow them)
If you allow notifications in your browser, Firebase Cloud Messaging (Google) gives us a device token, which we store with your browser description. A service worker (firebase-messaging-sw.js) shows the notifications. You can turn them off in your browser at any time.
Information from integrations
- Error reports from our clients' projects: Sentry and Firebase Crashlytics send us error alerts, and we read error event counts from the Google Analytics 4 property of a linked client project. Alerts can contain technical details such as app version, device and the error text, and may open a ticket.
- Microsoft Graph: meetings in our own Microsoft 365 calendar, including the names and email addresses of attendees.
- Google Drive: files uploaded to the portal's file area are stored in our Google Drive, in a folder named with the user's name and email address.
- Google Places: public Google reviews of GSS (the reviewer's name, rating and text).
- Google Play and App Store Connect: statistics and build information for apps we publish for clients.
- GitHub: source code repositories that we manage for clients, and records of code downloads with the user and IP address.
- Email (IMAP and SMTP): we read our support mailbox to turn emails into tickets, and send ticket and account emails.
Staff records
For staff we keep account, role, task, project and meeting information. We also still hold employee records that were collected before we removed the HR and payroll part of the portal in October 2026: employee profiles with identity and tax numbers, dates of birth, addresses, emergency contacts, pay rates, bank details (account numbers encrypted) and copies of identity documents; payslips; and time-clock records with the IP addresses used to clock in and out. No part of the portal reads or changes these records any more.
Older billing and hosting records
Before October 2026 the portal also handled hosting orders, quotes and payments, which now run in NewHost and CentraPoint. Those records are still in our database: orders, quotes, payment history and saved-card references (card type, last four digits, expiry date and a token from the payment provider; never the full card number). No part of the portal uses them any more.
4. What you must give us
To create an account we need your name, email address, a username and a password. To handle a ticket or an enquiry we need your name, email address and a description of the request. Everything else, such as your phone number, company details, position, the SMS second factor and push notifications, is optional. Without the required information we cannot create your account or respond to your request.
We do not ask for special personal information, such as health information, religious or political beliefs or criminal records. Please do not put it in tickets or attachments unless the request needs it.
5. Why we use it
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Running your account, handling tickets, enquiries and projects, and communicating with you about them | Needed to perform our agreement with you or your organisation, or to take steps you asked for |
| Signing you in securely, two-factor authentication, preventing spam and abuse (reCAPTCHA, rate limits), audit logs | Our legitimate interest in keeping the portal and your information secure |
| Finding and fixing errors in the portal and in the apps we look after for clients | Our legitimate interest, and our agreements with our clients |
| Push notifications and the SMS second factor | Your consent, which you can withdraw at any time |
| Keeping leads and client records, and sending service and occasional news emails to clients | Our legitimate interest in running our business, and our existing client relationship |
| Keeping staff, payroll and financial records | Our legal obligations under tax and labour law |
6. When we act for our clients
Some information reaches us on behalf of the businesses we work for: error reports and alerts from our clients' apps, and support requests from the end users of businesses that use our products (for example a cinema's customers using Cinemasoft, or the customers of a business on CentraPoint). For that information we act as an operator under POPIA. We process it only to provide our services to that business, keep it confidential and secure (sections 19 to 21), do not use it for our own purposes and tell the business without delay if we suspect a security compromise. If you are such an end user, the business you dealt with is responsible for your information, and you may contact it or us.
7. Who we share it with
We do not sell personal information. We share it only with these service providers, as far as each needs it:
| Provider | What it does | Where |
|---|---|---|
| Google (Firebase Authentication, Firebase Cloud Messaging, reCAPTCHA, Google sign-in, Drive, Places, Play Developer API, Analytics Data API) | Sign-in, SMS codes, push notifications, bot protection, document storage, reviews, app statistics, client error statistics | USA and other countries |
| Meta (Facebook Login) | Sign-in with Facebook | USA and other countries |
| GitHub | Sign-in with GitHub; client code repositories | USA |
| Microsoft (Microsoft Graph) | Our calendar of meetings | May be outside South Africa |
| Apple (App Store Connect) | App statistics and builds | USA |
| Cloudflare | Delivers the portal and protects it against attacks; all traffic to the portal passes through it | Global network |
| Sentry | Sends us error alerts from client projects that use it | USA |
| Our email servers | Send portal emails and receive emails to our support mailbox | Run by GSS |
| Our products (NewHost, SimpliSend, Summarix, Cinemasoft, CentraPoint, Cobra Connect) | Receive updates about the tickets their users raise | As in each product's privacy policy |
We may also disclose information when the law requires it, to protect our rights, or to our professional advisers under a duty of confidentiality.
8. Transfers outside South Africa
Our portal server and database are hosted in South Africa. The providers in section 7 that are based outside South Africa process information in the United States, the European Union and other countries. Under section 72 of POPIA we transfer information to them only under their data processing terms, which commit them to protect it to a standard similar to POPIA, or where the transfer is needed to provide the service you asked for, such as signing in with Google or receiving an SMS code.
9. How long we keep it
| Information | How long |
|---|---|
| Accounts | While the account is active. When an account is deleted, it is deactivated at once; we remove the remaining details on request, unless the law requires us to keep them. |
| Tickets, messages, attachments, enquiries and contracts | While the client relationship lasts and as long as we need them for the agreement or a legal claim. We delete them on request, unless the law requires us to keep them. |
| Client-issue reports | 180 days, then deleted automatically. |
| Unsubscribe list (your email address, and when and how you opted out) | As long as we send news and announcement emails, so that we keep honouring your choice. |
| Email sign-in codes | Valid for 10 minutes and cleared out automatically once expired. |
| Trusted devices (device_trust) | 30 days. |
| Push device tokens | Deleted when you turn notifications off in the portal. A token that stops working is disabled and kept with your account. |
| Audit logs, leads, referrals and integration data | As long as we need them for security or for our business, then deleted. |
| Staff, payroll and older billing records | As long as tax and labour law requires, then deleted. |
10. How we protect it
- All traffic is encrypted (HTTPS).
- Passwords are hashed; authenticator keys, backup codes, bank account numbers, integration credentials and other secrets are encrypted in the database.
- Two-factor authentication, role-based access for staff, audit logs, rate limits and reCAPTCHA protect accounts and forms.
11. If there is a security compromise
If we believe that someone has accessed or acquired personal information without authority, we will tell the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires, with enough information for them to protect themselves.
12. Emails and marketing
We send ticket, account and security emails that you need to use the portal. From time to time we also send service announcements and news by email to our clients and their contacts, with whom we have a business relationship. We do not send marketing to people who are not our clients unless they agreed to receive it. We send these emails only on weekdays between 08:00 and 20:00 and on Saturdays between 09:00 and 13:00 (South African time), never on Sundays or public holidays.
You can opt out at any time. Every such email has an unsubscribe link at the bottom: it opens a page where one click unsubscribes you, and many email apps show an Unsubscribe button that does the same. You can also reply to the email or write to [email protected], and we will stop. We then keep your email address on our unsubscribe list so that we do not send you these emails again (see section 9). Opting out does not stop the ticket, account and security emails.
13. Automated decisions
We do not make decisions about you that have legal or similarly significant effects solely by automated means. Two automated checks can affect you: reCAPTCHA scores whether a form was sent by a person, and our mail filter can flag emails as possible spam for staff to review. If a form will not go through, email us at [email protected] instead.
14. Children
The portal is meant for businesses and adults. It is not aimed at children under 18, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
15. Cookies and browser storage
The portal uses only the cookies and browser storage it needs to work and to stay secure. We do not use analytics or advertising cookies. If we ever add analytics, we will ask for your consent first.
| Name | Set by | Purpose | How long |
|---|---|---|---|
authjs.session-token | GSS Support | Keeps you signed in | Until you sign out, at most 30 days |
authjs.csrf-token | GSS Support | Protects sign-in against cross-site request forgery | Browser session |
authjs.callback-url | GSS Support | Remembers which page to return to after sign-in | Browser session |
authjs.pkce.code_verifier | GSS Support | Secures sign-in with Google, Facebook or GitHub while it is in progress (with authjs.state and authjs.nonce where used) | 15 minutes |
device_trust | GSS Support | Skips the second factor on a device you chose to remember | 30 days |
| reCAPTCHA cookies and storage | Tells people and bots apart; reCAPTCHA loads on every page of the portal | Google's privacy policy | |
| Cloudflare security cookies (such as __cf_bm) | Cloudflare | May be set to filter out malicious traffic before it reaches the portal | Up to 30 minutes |
| Firebase storage (IndexedDB) and service worker | Sign-in with Google, Facebook or GitHub, the SMS code, and push notifications if you allow them | Until you sign out or clear your browser data | |
theme | GSS Support (local storage) | Remembers light or dark mode | Until you clear your browser data |
gss-push-prompt-dismissed | GSS Support (local storage) | Remembers that you dismissed the notifications prompt | Until you clear your browser data |
In production the sign-in cookie names start with __Secure- or __Host-. You can delete or block cookies in your browser settings, but you cannot sign in without the session cookies.
16. Your rights
- Access: ask whether we hold information about you and for a copy of it (POPIA section 23). Our PAIA manual explains how to make a formal request.
- Correction and deletion: ask us to correct or delete information that is wrong, out of date, excessive or no longer needed (section 24). You can also update most account details yourself in the portal.
- Objection: object to processing based on our legitimate interests, and to direct marketing at any time (section 11(3)).
- Consent: withdraw consent you gave, for example for push notifications or the SMS second factor.
- Complaints: complain to the Information Regulator (section 17).
Send requests to the Information Officer at [email protected]. We may need to confirm your identity first.
17. Complaints and the Information Regulator
Please contact us first so that we can try to resolve a complaint. You may also complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za; eServices portal: eservices.inforegulator.org.za
- Complaints: [email protected] (POPIA), [email protected] (PAIA)
- General enquiries: [email protected]
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
18. PAIA manual
The PAIA manual of Global Software Services (Pty) Ltd explains how to request access to records we hold: globalsoftwareservices.co.za/paia-manual.
19. Changes to this policy
We will publish any change on this page with a new date. If a change materially affects you, we will tell you by email or in the portal. Read our Terms of Use for the rules of using the portal.