This notice explains how we handle personal information when you visit usta.co.za and when you buy and use the Üsta Cyber Risk Snapshot (the Snapshot). It is written under the Protection of Personal Information Act 4 of 2013 (POPIA).
It does not cover organisations that use Üsta under a signed agreement (for example the enterprise SaaS platform or a partner licence). Their agreement and its data processing terms apply.
1. Who we are
Usta Digital (Pty) Ltd, registration number 2025/284709/07 (Üsta, we, us). For the Snapshot and this website we are the responsible party: we decide why and how your personal information is processed.
Information Officer: Boris Kouambo, registered with the Information Regulator (registration number 2026-070818). Contact: privacy@usta.co.za Access to records: paia@usta.co.za
2. A note on organisations
POPIA protects information about companies and other organisations, as well as about individuals. Information about your organisation, such as its domain, its answers to our questions and its result, is therefore personal information under South African law, and we treat it that way.
3. What we collect
About you, the person who signs up - Your name and work email address. - Your password, which we store only in scrambled (hashed) form. - Whether you have verified your email address. - Which versions of our Terms of Sale and this notice you accepted or were shown, and when. - When you start a run: your confirmations (your authority and the accuracy of your answers), with the date and time, your IP address and your browser type. This is our authorisation record. - Your choices about marketing emails. - What you write to us, if you contact us.
About your organisation - Its name and domain. - Your answers to the Snapshot questions: for example revenue, sector, number of employees, the kinds and volumes of records it holds, how its customers pay it, and the state of its security controls. - The results of the outside-in check of its domain: public information such as its domain registration and email security records, its website's security settings, lookalike domains, the hostnames and IP addresses linked to the domain, and public exposures such as published API documentation. - The result we issue, and the version of our model that produced it.
About your payment - The order, the amount, the payment status and reference, and the email address used. Payment is taken by Manza and Paystack (section 6). We never see or store your card details.
On the website and in the app - See section 10 (cookies and analytics).
We do not ask for special personal information (such as health or biometric information) about you. One Snapshot question asks what kind of data your organisation holds; that is a fact about your organisation, not information about any person.
4. Why we use it, and on what basis
POPIA allows processing only on certain grounds (section 11). This is what we rely on:
| What we do | Why | Ground under POPIA |
|---|---|---|
| Create and secure your account; verify your email | To provide the Snapshot you are buying, and to keep accounts secure | Performance of the contract; our legitimate interest in security |
| Confirm that the domain belongs to your organisation, and keep the authorisation record | To prevent misuse of the Snapshot, and as evidence that a check was authorised | Our legitimate interest, and that of the organisations whose domains could otherwise be checked without authority |
| Run the outside-in check and produce your result | This is the service you bought | Performance of the contract |
| Take payment, confirm it and make refunds | To complete your purchase | Performance of the contract; compliance with our accounting obligations |
| Send service emails (verification, payment confirmation, result ready, refund) | To deliver the Snapshot | Performance of the contract |
| Keep your issued result and its model version | So you can see what you were shown, and so we can answer any question or dispute about it | Performance of the contract; our legitimate interest in establishing or defending legal claims |
| Answer your questions and complaints | To support you | Performance of the contract; our legitimate interest |
| Send occasional emails about our related services | See section 5 | Your consent, or, if you are a customer, the customer rule in POPIA section 69(3), with an opt-out at any time |
| Publish a quote or case study you have approved (launch-price orders only) | So other organisations can hear from early customers | Your consent, given when you approve the text. You can withdraw it at any time and we take it down |
| Improve our model and publish benchmarks from de-identified, aggregated information | To make the Snapshot more accurate and to publish industry figures that identify no one | Our legitimate interest. Never in a group small enough to identify an organisation; never your answers or findings as such |
| Prevent abuse; apply limits; keep logs | To protect the service and its users | Our legitimate interest |
| Website analytics on usta.co.za | To see how the website is used | Our legitimate interest |
Do you have to give us this information? The information marked as required in the sign-up and questionnaire is needed to provide the Snapshot. Without it we cannot provide one. Marketing choices are optional.
We do not sell personal information or share it for advertising.
How we use AI. We may use AI services from carefully chosen providers to help us run and support the Snapshot, for example to answer your questions or check our work. AI does not set your result: the figure comes from our actuarial model. A provider that handles your answers or results does so only on our instructions, under written terms that stop it using your information to train its models, and with the protections in section 7 where it is outside South Africa.
5. Marketing emails
- If you are not a customer, we send marketing emails only if you have ticked the box asking for them.
- If you buy a Snapshot, we may email you occasionally about our related services, unless you tell us not to at checkout.
- Every marketing email says who it is from and has an unsubscribe link. You can also email privacy@usta.co.za. Unsubscribing does not affect service emails about a Snapshot you bought.
6. Who we share it with, and where
| Recipient | What they receive | Why | Where |
|---|---|---|---|
| Amazon Web Services (AWS) | Everything in our Snapshot service, including backups | Hosting our application and database | South Africa (Cape Town region) |
| AWS Simple Email Service | Your name, your email address, and the links in our emails | Sending our service emails | Sweden (Stockholm region) |
| Manza (Manza Finance), and the payment providers it uses, such as Paystack South Africa (Pty) Ltd | Your email address, the order reference and amount. You give your card details directly to them | Taking card payments and processing refunds. They handle payment information as responsible parties in their own right, under their own privacy notices | South Africa |
| Public lookup services (for example domain registries, DNS services and a list of malicious websites) | Your organisation's domain, hostnames and IP addresses, and nothing about you as a person | Running the outside-in check you bought | South Africa, the United States and Europe |
| Microsoft 365 | Emails you send us | Our mailbox | South Africa |
| Google (Google Analytics, on usta.co.za only) | Website usage information (section 10) | Website analytics | United States and elsewhere |
| AI service providers we have approved | Only the answers, results or messages needed for the task | Helping us support you and check our work | Where the provider processes it, which may be outside South Africa |
| Our professional advisers | What they need to advise us, under confidentiality | Legal, accounting and audit | South Africa |
| Regulators, courts and law enforcement | What the law requires | Legal obligations; establishing or defending legal claims | South Africa |
| A buyer of or investor in our business | What a transaction requires, under confidentiality | A sale, merger or investment | As applicable |
Service providers who process personal information for us do so under written contracts that require them to keep it secure.
7. Information sent outside South Africa
Some of the recipients above are outside South Africa. POPIA (section 72) allows a transfer abroad only on listed grounds. We rely on these:
- Email sending (Sweden). Sweden is subject to the EU General Data Protection Regulation, and AWS is bound by its data processing terms with us. Both provide protection substantially similar to POPIA's. Sending these emails is also necessary to perform our contract with you.
- Lookup services (the United States and Europe). They receive only your organisation's domain, hostnames and IP addresses. Sending these is necessary to perform the contract your organisation entered into with us, because the check cannot be run without them.
- Google Analytics. Google is bound by its data processing terms with us, which provide protection substantially similar to POPIA's.
- AI service providers. Each is bound by written data processing terms with us that provide protection substantially similar to POPIA's and stop it using your information to train its models.
8. Where we get information
From you; from your organisation's public internet presence, through the outside-in check; and from Manza, which tells us whether a payment succeeded.
9. How long we keep it
| Information | How long |
|---|---|
| A sign-up whose email is never verified | 7 days |
| An account with no completed payment, and its unsubmitted answers | Deleted after 90 days without activity |
| Your account details and acceptance records | While your account is open, and 3 years after your last order |
| Your answers, the scored results of the outside-in check, and the issued result with its model version | 3 years after the run |
| The raw output of the outside-in check | 60 days after the run |
| The authorisation record | 3 years after the run |
| Orders, payments and refunds | 7 years, as company and tax law require |
| Emails and support correspondence | 3 years after the last contact |
| Server logs (which include IP addresses) | 90 days |
| Backups | Overwritten on a rolling 7-day cycle |
| A record that you unsubscribed | For as long as we need it to honour your choice |
| Website analytics | 2 months |
| De-identified, aggregated information | Indefinitely; it no longer identifies anyone |
If you ask us to delete your account, we delete your account details and answers. We keep the issued result, the authorisation record and order records for the periods above, because we may need them to answer a question or dispute about the Snapshot and to meet our legal obligations.
10. Cookies and analytics
The Snapshot app (snapshot.usta.co.za) uses no analytics or advertising cookies. It stores a sign-in token in your browser's local storage so that you stay signed in. This is necessary for the app to work and is removed when you sign out.
The website (usta.co.za) uses Google Analytics, which sets cookies to count visits and show which pages are used. Google processes this information in the United States and elsewhere. We do not use Google's advertising features. You can block these cookies in your browser settings or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.
We do not send your email address, your answers or your result to Google Analytics.
11. How we protect it
- Our application and database are hosted in AWS's Cape Town region, encrypted in transit and at rest, with encrypted backups.
- Access to personal information is limited to the people at Üsta who need it.
- Card details never reach us.
- If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you, as POPIA requires.
No system is completely secure. Measuring cyber risk is our business, and we apply the same discipline to our own systems.
12. Automated processing
The Snapshot is an automated estimate about your organisation that you ask us to produce. We do not use it to make decisions about you or your organisation. What you do with the result is your decision.
13. Your rights
Under POPIA you may:
- ask whether we hold personal information about you or your organisation, and ask for a copy;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
- object, on reasonable grounds, to processing based on our legitimate interests;
- object to direct marketing at any time;
- withdraw consent you have given, without affecting what was done before; and
- complain to the Information Regulator.
To exercise these rights, email privacy@usta.co.za from the email address on your account, or tell us how to verify that the request is yours. We respond within the time the law requires, normally within 30 days. Requests for access to records go to paia@usta.co.za and follow the Promotion of Access to Information Act; some may carry the fee the law prescribes.
14. Complaints to the Information Regulator
We would like the chance to resolve any concern first, at privacy@usta.co.za. You may also complain directly to:
Information Regulator (South Africa) Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 Complaints: POPIAComplaints@inforegulator.org.za General enquiries: enquiries@inforegulator.org.za Website: inforegulator.org.za
15. Changes to this notice
We will publish any change here, with a new version number and date. Each earlier version stays available at its own address. If a change materially affects how we handle information you have already given us, we will email you first.
16. Contact
Privacy and data protection: privacy@usta.co.za Access to records: paia@usta.co.za Everything else: hello@usta.co.za