LEGAL
Privacy Policy
Last updated 2 September 2026 · Applies to keystonecyber.co.za
Keystone Cyber is a specialist cybersecurity recruitment agency based in Cape Town, South Africa. This policy explains what personal information we collect through this website, why we collect it, who we share it with, and the rights you have over it.
We process personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Where we handle the information of people in the United Kingdom or the European Economic Area, we also apply the UK GDPR and EU GDPR.
Who is responsible
- RESPONSIBLE PARTY
- Keystone Cyber, Cape Town, South Africa
- INFORMATION OFFICER
- Scott Hayward, Managing Director — hello@keystonecyber.co.za
- TELEPHONE
- +27 62 168 8985
What we collect
Information you give us
When you complete the enquiry form on this site we collect your first name, last name, email address, your company or current role, and the content of your message. We also record whether you identified yourself as an employer or a candidate, so that the right person responds.
Information collected automatically
We use website analytics to understand how the site is used — pages viewed, approximate location at country level, device and browser type, referring source, and interactions such as clicking a phone number or submitting the form. This is aggregate behavioural data. We do not use it to build advertising profiles and we do not sell it.
Information we do not ask for here
This website does not collect CVs, identity numbers, salary details, criminal record information or health information. If you become a candidate on our books, the Candidate Data Notice covers that processing separately.
Why we process it
- To respond to your enquiry. Our lawful basis is your consent, given when you submit the form.
- To provide recruitment services that you or your organisation have asked us for. Our basis is the performance of a contract, or steps taken at your request before entering one.
- To operate and improve the website. Our basis is our legitimate interest in a site that works, measured through aggregate analytics.
- To meet legal and regulatory obligations, including tax and record-keeping requirements.
Who we share it with
We use a small number of processors, each bound to process personal information only on our instructions:
- CRM & FORM DELIVERY
- HubSpot, Inc. receives submissions from the enquiry form on this site and stores them in our customer relationship management system, hosted in the European Union.
- ANALYTICS
- Our website analytics provider, which processes aggregate usage data.
- EMAIL & FILE STORAGE
- Our business email and document storage provider.
Where you are a candidate, we share your details with a prospective employer only with your knowledge and agreement, on a role-by-role basis. We never sell personal information and we do not share it for third-party marketing.
Transfers outside South Africa
Our HubSpot customer relationship management system is hosted in the European Union. This means the information you submit through the enquiry form is transferred outside South Africa. We rely on section 72(1)(a) of POPIA — the European Union provides a level of protection substantially similar to POPIA — and on the contractual terms in our agreement with HubSpot. Where you have consented to analytics cookies, HubSpot also processes your page-view history on the same basis.
If you would rather your details did not leave South Africa, email or telephone us directly using the details above instead of using the form.
How long we keep it
- WEBSITE ENQUIRIES
- 24 months from your last contact with us, unless the enquiry becomes an active engagement.
- CLIENT RECORDS
- For the duration of the engagement and for five years afterwards, to meet tax and record-keeping obligations.
- ANALYTICS DATA
- Retained in aggregate form only, on our analytics provider's standard retention schedule.
How we protect it
Submissions are transmitted over HTTPS. Access to enquiry inboxes and candidate records is limited to Keystone Cyber staff who need it, protected by individual accounts and multi-factor authentication. We review who has access when someone joins or leaves.
If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as POPIA requires.
Your rights
Under POPIA you have the right to:
- ask what personal information we hold about you, and receive a copy;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully;
- object to processing, and withdraw consent you have given, at any time;
- complain to the Information Regulator.
To exercise any of these, email hello@keystonecyber.co.za. We will respond within 30 days. Withdrawing consent does not affect processing that already took place, and may mean we can no longer help with your enquiry.
Complaints
If you are not satisfied with our response, you may complain to the Information Regulator of South Africa: inforegulator.org.za, POPIAComplaints@inforegulator.org.za. If you are in the United Kingdom, you may complain to the Information Commissioner's Office: ico.org.uk.
Cookies
This site sets no advertising cookies. On your first visit we ask whether you accept analytics cookies. If you accept, HubSpot sets first-party cookies that let us see how visitors find and move through the site, and connect a later enquiry to the pages you read first. If you decline, no analytics cookies are set and nothing is loaded. Your choice is stored in your browser and you can change it by clearing your browser data for this site. Declining costs you no functionality — the enquiry form works either way.
Changes to this policy
We update this policy when our processing changes. The date at the top reflects the current version. Material changes will be signposted on the homepage for 30 days.