Privacy Notice
GreenFile is a compliance platform operated by Astrium Software Solutions for South African businesses. We take the lawful handling of personal information seriously — it is, after all, much of what the product helps our customers do. This notice explains what we collect, why, and the rights you have under the Protection of Personal Information Act (POPIA).
Information we collect
- Account details — when you register: your name, email address, and company name, used to create and secure your account.
- Enquiry & webinar details — when you submit a form (e.g. a webinar registration): your name, work email, company, and role, so we can send the information you asked for.
- Compliance content you create — documents, obligations, registers, and related records you store in the platform. This is your data; we process it to provide the service.
- Technical & security data — limited information such as your IP address and browser user-agent, captured on public form submissions and sign-in attempts solely to prevent abuse and rate-limit requests. It is not used for advertising or profiling.
Responsible party
GreenFile is operated by Astrium Software Solutions CC (registration number 2002/061588/23), of 675 Saranton Estate, 678 Cedar Avenue West, Sandton, Gauteng, 2191.
Why we use it
- To provide, secure, and operate the GreenFile service.
- To send communications you requested (account email, webinar joining details, and a short, related follow-up).
- To protect the service against abuse, fraud, and unauthorised access.
We do not sell your personal information.
Who we share it with
We share personal information only with service providers that help us run GreenFile — for example, our email delivery provider (to send the messages above) and our hosting infrastructure. These providers process data on our behalf under appropriate safeguards. We do not share your information with third parties for their own marketing.
How long we keep it
We retain personal information only for as long as needed to provide the service and meet legal, tax, security, contractual and audit obligations. The schedule below is Astrium's approved retention policy. A legal hold, dispute, investigation, audit, active request or longer tenant-specific legal duty suspends ordinary disposal until that requirement ends.
These periods are policy limits, not claims of automated deletion. GreenFile does not currently run a verified general tenant-data purge. Until deletion, de-identification, backup ageing and evidence controls are implemented and tested, authorised staff apply disposal decisions through a controlled manual process.
| Record class | Approved period or trigger | Current operation and exceptions |
|---|---|---|
| Account, profile, authentication and membership data | Active service period, then 90 days after account or tenant closure | No verified general account purge. Disposal is handled through an authorised manual process until automation is implemented and tested. Retain only the minimum needed for security, fraud, a dispute, a legal hold or another statutory duty after the export and recovery window. |
| Tenant compliance content and evidence | Active service period, then 90 days after subscription or tenant closure | Pack data may become cleanup-eligible after the configured period, but no verified general tenant-data purge currently runs. A tenant-specific law, contract, preservation duty or legal hold may require a longer period. Give the tenant a reasonable export opportunity before disposal. |
| Append-only registers and material audit events | Active service plus 7 years after the relevant entry, event or tenant closure, whichever is later | Append-only preservation is implemented; timed disposal is not verified and must not break the integrity of retained audit evidence. Apply any longer tenant-specific statutory period, dispute requirement or legal hold. |
| Subscription, invoice, payment and tax records | At least 5 years from the relevant tax return submission | Timed disposal is not verified. Keep longer while a SARS audit, investigation, objection, appeal, non-filing issue or legal hold remains open. |
| Employment particulars and time or remuneration records | At least 3 years from the applicable BCEA trigger; 5 years where the same record supports a tax obligation | Timed disposal is not verified. Keep longer where another employment law, tax rule, dispute or legal hold applies. |
| Sales leads and unanswered enquiries | 24 months after the last meaningful interaction | Timed disposal is not verified. Delete or de-identify at expiry, retaining only a minimal suppression record where needed to honour an opt-out. |
| Marketing consent and opt-out evidence | Consent lifetime plus 5 years after withdrawal or last reliance | Timed disposal is not verified. Keep only the evidence necessary to prove or honour the person's marketing preference. |
| Security, access and abuse-prevention logs | 12 months from collection | Complete system-wide expiry is not verified. Extend and restrict access for an incident, fraud case, investigation or legal hold. |
| Support, complaint, privacy and PAIA case files | 5 years after final closure | Timed disposal is not verified. Keep longer for litigation, regulator action or a legal hold, and minimise identity evidence where possible. |
| Contracts, supplier and insurance records | Contract term plus 7 years after expiry or termination | Timed disposal is not verified. Keep longer where a claim, tax rule, another law or a legal hold applies. |
| Backups | Rotate or expire backups within 180 days of creation | Infrastructure rotation must be verified operationally; application-level deletion may not remove an item from every immutable backup immediately. Use backups only for recovery. Restoration procedures must re-apply disposal decisions and legal holds. |
Your rights under POPIA
You have the right to:
- Ask what personal information we hold about you, and request a copy.
- Ask us to correct or update inaccurate information.
- Ask us to delete information we no longer have a lawful basis to keep.
- Object to a particular use of your information.
- Lodge a complaint with the Information Regulator (South Africa).
To exercise any of these, email support@greenfile.co.za and we will respond within a reasonable time.
Information Officer
Our Information Officer is Corne Beukes. Email cornebeukes@astrium.co.za or call 083 632 4281. General data-protection enquiries may also be directed to support@greenfile.co.za.
Effective 2 September 2026 · Version T-087-v2. Questions: support@greenfile.co.za.