Terms of Use & Privacy Policy

1About NetVault VMS

Fibre Net (Pty) Ltd ("Fibre Net", "we", "us", or "our") operates the NetVault VMS mobile application ("App"), a visitor management and physical access-control platform used by estates, complexes, and managed buildings. The App integrates with on-site access-control and camera infrastructure (including HikCentral) to open gates and doors, enrol and verify residents and visitors, and log access events.

Fibre Net acts as the Responsible Party as defined under the Protection of Personal Information Act, 2013 (POPIA), in respect of the personal information processed through the App.

2Who May Use the App

The App is deployed within managed estates and buildings. Access to the App is granted exclusively by an authorised estate administrator or manager ("Admin"), who enrols users on behalf of the estate, complex, or building.

• Admins are solely responsible for determining who is granted access and for ensuring that enrolment of any individual complies with applicable laws, including the rights of minors.
• Where an Admin enrols a person under the age of 18, the Admin warrants that they have the authority and, where required by law, the consent of a parent or legal guardian to do so.
• Fibre Net does not independently verify user ages. Age eligibility is governed by the Admin's own access and enrolment policies.
• You may not use the App for any unlawful, fraudulent, or unauthorised purpose.

3User Responsibilities

• You are responsible for the accuracy and completeness of all information you provide.
• You must keep your device, login credentials, and any access tokens secure and confidential.
• You must not share access, impersonate another person, or attempt to circumvent security controls.
• You agree to report any suspected unauthorised use of your account to your estate administrator and to support@fibre-net.co.za promptly.

4Information We Collect

We collect the following categories of personal information:

5Lawful Basis for Processing

Under POPIA, we process your personal information on one or more of the following lawful grounds:

• Contract performance: Processing is necessary to provide the App's access control and visitor management services to your estate.
• Consent (biometrics): Facial and fingerprint biometrics are special personal information under POPIA and are processed on the basis of your consent, given at enrolment, and/or as necessary to establish and exercise the estate's access-control rights. You may withdraw biometric consent at any time (see Sections 15 and 16); doing so will disable biometric access and you will use an alternative access method offered by your estate.
• Legitimate interest: To maintain security, prevent fraud, improve App functionality, and serve contextual advertising — balanced against your privacy rights.
• Consent (other): Where we rely on your consent (e.g., for personalised advertising or optional features), you may withdraw it at any time without affecting prior processing.
• Legal obligation: Where processing is required by applicable South African law.

6How We Use Your Information

• Authenticate users and manage estate/building access
• Enrol and verify facial and fingerprint biometrics for gate and door access
• Process and log visitor arrivals and departures, including vehicle/licence-plate (ANPR) reads
• Send push notifications and in-app alerts relevant to your estate
• Enable Bluetooth-based proximity access features
• Facilitate voice/intercom communication features
• Detect and prevent fraudulent or unauthorised access
• Analyse usage to improve performance and user experience
• Serve in-app advertisements via Google AdMob (see Section 8)
• Comply with legal obligations and respond to lawful requests

7Device Permissions Explained

The App requests the following device permissions. You will be prompted to grant each permission before it is accessed:

You may revoke any permission at any time via your device settings. Revoking a permission will disable the associated feature but will not affect the rest of the App.

8Advertising & Tracking (Google AdMob)

What AdMob may collect:

• Your device's advertising identifier (IDFA on iOS; GAID on Android)
• IP address and approximate location
• Ad interaction data (impressions, clicks)
• App usage context for ad targeting

Personalised vs. Non-Personalised Ads:

• On iOS: When you first open the App, you will be shown Apple's App Tracking Transparency (ATT) prompt. If you allow tracking, personalised ads may be served. If you decline, only non-personalised ads will be shown. You can change this at any time under Settings → Privacy & Security → Tracking.
• On Android: You can opt out of personalised ads under Settings → Privacy → Ads → Opt out of Ads Personalisation.

Google's Privacy Policies: Data collected by AdMob is governed by Google's Privacy Policy. We do not control how Google uses data collected through the AdMob SDK. We recommend reviewing Google's policy independently.

9Third-Party Services

We use the following third-party service providers to operate the App. Each provider processes data on our behalf under a data processing agreement:

We do not sell your personal information to any third party. Providers are contractually prohibited from using your data for any purpose beyond the service they provide to us.

10Cross-Border Data Transfers

Our infrastructure is hosted by Supabase Inc. and Google LLC, which may process and store data on servers located outside South Africa (including in the United States and the European Union).

Under POPIA Section 72, personal information may be transferred outside South Africa only where the recipient country or organisation provides an adequate level of protection, or where we have put appropriate contractual safeguards in place.

• Supabase and Google operate under internationally recognised data protection frameworks and Standard Contractual Clauses.
• By using the App, you acknowledge and consent to this cross-border processing as necessary to provide the service.

11Data Sharing

We share personal information only in the following circumstances:

• Estate Administrators: Access logs and visitor records are visible to authorised admins of your estate or building — this is a core function of the App.
• Service Providers: As described in Section 9, solely for operating the App.
• Legal Obligations: Where required by law, court order, or lawful request from a competent authority.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you in advance via the App or email.

We do not sell, rent, or trade your personal information to any third party for marketing or commercial purposes.

12Data Retention

We retain personal information only for as long as necessary:

• Active account data: Retained for the duration of your enrolment on the App.
• Biometric templates: Retained only while your access enrolment is active, and deleted from the access-control system when your enrolment ends or you withdraw biometric consent.
• Access and visitor logs: Retained for up to 24 months for security and audit purposes, unless a shorter or longer period is required by law or the estate's own retention policy.
• Deleted accounts: Upon successful deletion (see Section 16), personal data is purged or anonymised within 30 days, except where retention is required by law.
• Ad interaction data: Governed by Google AdMob's own retention policies.

13Security

We implement reasonable and appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls that restrict who can view personal data, applied at the database and application layers
• Authenticated API endpoints and token-based authentication for privileged operations
• Regular security assessments, penetration testing, and vulnerability monitoring

No system is entirely secure. While we strive to protect your information and continuously improve our controls, we cannot guarantee absolute security against cyberattacks, third-party failures, or other unforeseen events outside our reasonable control.

14Data Breach Notification

In the event of a security compromise involving your personal information that is likely to result in harm, Fibre Net will comply with its obligations under POPIA Section 22:

• We will notify the Information Regulator of South Africa as soon as reasonably practicable after becoming aware of the breach.
• We will notify affected data subjects (users) in writing, describing the nature of the breach, the information affected, and the steps taken in response.
• Notifications will be sent to your registered email address and/or via in-app notification.

15Your Rights

Under POPIA and applicable law, you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that inaccurate or incomplete information be corrected.
• Deletion: Request the deletion of your personal information (subject to legal retention requirements — see Section 16).
• Objection: Object to the processing of your data on grounds of legitimate interest.
• Withdraw Consent: Withdraw any consent you have given, including biometric consent, at any time without penalty.
• Complain: Lodge a complaint with the Information Regulator of South Africa if you believe your rights have been violated.

To exercise your rights, contact us at support@fibre-net.co.za. We will respond within 30 days.

16Account & Data Deletion

How to request deletion:

1. Email support@fibre-net.co.za with the subject line "Data Deletion Request", including your full name and the estate you are registered to.
2. Alternatively, contact your estate administrator who can initiate deletion on your behalf.

What happens after a deletion request:

• Your account will be deactivated immediately upon verification.
• Personal data, including any enrolled biometric templates, will be permanently deleted or anonymised within 30 days.
• Certain records (e.g., access logs) may be retained for up to the legally required period before deletion.
• Ad interaction data held by Google AdMob is subject to Google's own deletion policies.

We will confirm completion of the deletion by email within the 30-day window.

17Limitation of Liability

To the fullest extent permitted by applicable South African law:

• Fibre Net shall not be liable for any indirect, incidental, special, or consequential damages, including loss of data, revenue, or business opportunity.
• We are not responsible for unauthorised access caused by factors beyond our reasonable control, including cyberattacks, third-party infrastructure failures, or a user's own negligence in securing their device or credentials.
• We are not responsible for the content, accuracy, or practices of any third-party services referenced in this policy (including Google AdMob).

Nothing in this policy excludes or limits liability where it would be unlawful to do so, including liability for gross negligence or fraud.

18Termination

Fibre Net reserves the right to suspend or permanently terminate your access to the App, without prior notice, if you violate these Terms, engage in fraudulent or abusive behaviour, or if your estate administrator removes your enrolment.

Upon termination, your right to use the App ceases immediately. Sections relating to data retention, liability, and governing law survive termination.

19Governing Law & Disputes

These Terms are governed by and construed in accordance with the laws of the Republic of South Africa, including the Protection of Personal Information Act, 2013 (POPIA) and the Electronic Communications and Transactions Act, 2002 (ECTA).

Any dispute arising from these Terms shall first be referred to Fibre Net at support@fibre-net.co.za for informal resolution. If unresolved within 30 days, the dispute shall be subject to the jurisdiction of the competent South African courts.

20Updates to This Policy

We may update these Terms and Privacy Policy from time to time. When we do, we will:

• Update the version number and effective date at the top of this document.
• Notify you via in-app notification and/or email at least 7 days before material changes take effect.
• For significant changes affecting how we use your data, we may request fresh consent.

Continued use of the App after the effective date constitutes your acceptance of the updated Terms.

Previous versions of this policy are available on request by contacting support@fibre-net.co.za.