FaceCamAlert is a national, centralised facial recognition subscription service providing facial recognition matching and alert services for private properties and businesses for security and commercial purposes. FaceCamAlert achieves this by using the infrastructure such as CCTV cameras, access control and reception management devices of its subscribers to receive images and match it against watchlists of individuals.

The facial recognition matching services are provided to pre-vetted and approved companies such as residents' associations, property owners and managers, retail companies and companies in the insurance and financial services industries for the purpose of loss prevention, asset protection, safety and security and other rights afforded to them under statute and contract.

The facial recognition devices are positioned so that they record private property. Footage of these areas is not recorded or stored. Information of data subjects who are not on a watchlist will not be stored. If a data subject passes a facial recognition camera and no match is found against a watchlist then their data is immediately deleted.

It is our commitment to our employees, directors, affiliates, partners and/or clients and members of the general public to continually implement practices and procedures that respect and give effect to your right to privacy. Therefore, we have compiled this Facial Recognition Policy ("FR Policy") to ensure our commitment to your privacy and compliance with the applicable laws and regulations, in particular the Protection of Personal Information Act 4 of 2013 ("POPIA").

We recognise that everyone has the right to privacy which includes protection against the unlawful collection, retention, dissemination and use of personal information. Consequently, this FR Policy sets out to –

This FR Policy applies to FaceCamAlert and all of our employees, directors, affiliates, partners and/or clients.

The authorisation for the collection, location and access to the FR matching records lies with us as permitted by the relevant lawful bases. As such, the personal information may be accessed through our systems and only with our express prior written consent. Moreover, such access will only be granted to pre-vetted, third-party companies such as a security services providers in line with the applicable legislative and regulatory requirements.

FaceCamAlert shall fully comply with its obligations in terms of POPIA and any company appointed by FaceCamAlert will be required to act within the prescripts of the law.

FaceCamAlert further commits to process personal information where, given the purpose for which it is processed, such processing is adequate, relevant and not excessive.

Any unlawful disclosure of personal information, or data breach, will be reported to the Information Regulator, together with all details relating to the breach as required by POPIA.

FaceCamAlert is a national, centralised facial recognition subscription service providing facial recognition matching and alert services for private properties and businesses. FaceCamAlert achieves this by using the infrastructure such as CCTV cameras, access control and reception management devices of its subscribers to receive images and match it against watchlists of banned individuals or individuals on the SAPS wanted list.

The FR matching data will only be made available in a manner consistent with the requirements and restrictions imposed by POPIA, whilst always considering each individual's right to privacy.

All FR matching data shall be reviewed by the operational staff employed by the Responsible Parties/subscribers who will monitor the FR matches for appropriate purposes which may include, but are not limited to –

We will be primarily responsible for processing your personal information either as a responsible party or operator. In this regard we undertake to fully comply with the obligations of POPIA, depending on the capacity in which we are acting in any given circumstance.

We will mainly process your personal information in the following respects –

Personal information collected by our FR matching service will not be used for any other purposes other than those listed above or as permitted by law.

We understand that through our FR matching service, we may be able to establish certain facts relating to your race, for example. The information about the race of data subjects is not captured separately on the watchlist or alerts, and can only be deduced from the photographs on the watchlist / alerts. This information is also only used to identify the data subject to make a match between the alert and the person on site, and such identification is integral to the purpose (section 29(a)). Watchlist are also not created and differentiated based on race.

Processing information about children is generally not permitted. Section 35(1)(b) of POPIA provides that information about children may be processed, amongst others, if it is necessary to exercise a right in law. The customers of FCA have a right to protect their premises against theft, vandalism and robbery, and if children are involved in such crimes, such processing is permissible. If children are regularly involved in such crimes the Responsible party (subscriber) must first obtain authorisation from the Information Regulator in terms of section 35(2) of POPIA.

The data is stored on a secure server(s) in a secure hosted data center with all necessary security measures in place.

Access to the data center and server(s) are secure and managed.

The data subject personal information is secured against loss and unlawful access.

We adopt a "need to know" approach to access to our CCTV surveillance footage. Individuals who have such access include, from time to time –

The grounds for processing are that it is the legitimate interest of the customer, i.e. the occupier of the premises to keep the premises secure and to guard against offences and misdemeanors commonplace to such premises. These are usually crime, damage to property and trespassing to name a few.

A severity level framework is utilised to differentiate between data subjects in different watchlist. Subjects in different watchlist are treated differently. Records of data subject in different watchlists are retained for a period applicable to that watchlist and range between a period of 3 months to 60 months from the date the last incident has been loaded in respect of the data subject.

Records of alerts are retained for a minimum of 30 days.

No records are retained of persons who are not on the watchlist.

The information will not be processed for any other purpose than the stated purpose of protecting the premises and preventing crime and illegal activity.

Each customer/subscriber is a Responsible Party in own right and can have their own segregated watchlist.

Section 15 of POPIA provides that further processing is permitted when the further processing is compatible with the original purpose and sets out a few criteria to determine compatibility:

When information from other databases is used for matching or alerts, FCA will evaluate the purpose of that specific database, and if relevant the laws in terms of which that database operates, to make an assessment for each such source database whether further processing is compatible with the original purpose.

FCA takes the following steps to mitigate the potential privacy risks:

The following processes are in place to ensure the information of data subjects on the watchlist is accurate:

The customer is the responsible party in respect of the processing and FCA acts as the operator.

The customer decides on the purpose for the processing, namely to keep its premises secure and to prevent illegal activity. The customer selects the FCA solution as the means of processing.

FCA has no relationship with the data subjects, whereas the customer either encounters data subjects on its premises or had prior interaction with the data subjects.

We may share or transfer your Personal Information as follows or as otherwise described in this Policy –

• with our customers, affiliates and/or partners who only have access to such information as is necessary to perform their functions or give effect to an agreement to which you are a party or legal obligation and not any other purpose;

• any operators will act on our instructions and be contractually bound to take all reasonable steps to protect your personal information;

• in response to a request for information if we believe disclosure is in accordance with any applicable law, regulation, or legal process, or as otherwise required by any applicable law, rule or regulation; and

• in connection with, or during negotiations of, any merger, sale of our assets, financing, or acquisition of all or a portion of our business to another company (we will request a purchaser to treat our data under the privacy/confidentiality statement in place at the time of its collection).

Where we transfer personal information about you to a company or any other entity outside of South Africa, we will ensure that –

• the company receiving the information is subject to a law, binding corporate rules or a binding agreement which provides an adequate level of protection of your personal information; and/or

• we obtain your consent if need be; and/or

• there is a contractual necessity/obligation to transfer the personal information.

You have a number of rights under law which, in certain circumstances, you may exercise in relation to the personal information we process about you. these include –

Where we rely on consent as the legal basis on which we process your personal information, you may also withdraw that consent at any time.

We have designated an Information Officer who shall be responsible for –

should you wish to raise any questions, concerns or reportable conduct, please contact our Information Officer at – info@FaceCamAlert.co.za

Any contravention(s) of this Policy may result in disciplinary action being instituted against an employee, which action may include dismissal or termination of employment and any other legal action that may be available to us.

we also reserve the right to exercise any appropriate form of legal action against any party which may cause us harm and/or damages by way of non-compliance with this CCTV Policy. Parties also risk statutory penalties.

Where this service is deployed FaceCamAlert will take all reasonable steps to ensure that the Responsible party places the necessary signage at the property entrance where the service is being utilized.

This Policy, along with our Privacy Notice and PAIA will also be made available on our publicly accessible website at https://www.FaceCamAlert.co.za/.

This Policy is subject to review and amendment without prior notice. However, we undertake to ensure that any amendments hereto are communicated clearly and effectively, for the benefit of the persons who may be affected by this Policy.

Last updated March 2026.

For the purposes of this CCTV Policy, the following definitions apply –

"Consent" means an informed, unconditional, specific and voluntary expression of will in terms of which permission is given for the processing of personal information.

"Data Subject" means the natural or juristic person to whom personal information relates.

"Employee" means any such person as defined in the Labour Relations Act 66 of 1995, under the employ of FaceCamAlert, and any other such person who may conduct work for or on behalf of FaceCamAlert on a once off or ongoing basis, as the case may be.

"Information Officer" means the person/s designated by us to direct compliance with POPIA within our company.

"Legal Obligation" – means we are required by law to process your personal information.

"Operator" means any person who processes personal information for or on behalf of ourselves in terms of a contract or mandate concluded between ourselves and such person.

"Process/Processing" means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, and includes the meaning given to it in the POPIA.

"Responsible Party" means any public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information.