Last updated: 31 October 2026
This Privacy Policy describes how Elestack Digital Solutions ("Elestack", "we", "us") collects, uses and protects personal information through ComplianceDesk (the "Service").
For account, billing and marketing information, Elestack is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA). For information a customer uploads to the Service, the customer is the responsible party and Elestack acts as its operator, under a written agreement. Our Information Officer is the head of Elestack Digital Solutions, who can be reached at legal@compliance-desk.com.
Account information (name, email, organisation), authentication data (hashed passwords, MFA enrolment status), content you upload to the Service (control statuses, evidence files, policy documents, incident records), and operational data such as audit log entries, IP address and request metadata used for security and rate limiting.
To provide and secure the Service, authenticate users, send transactional emails (verification, password reset, invites), process billing, and — where you opt into AI features — to generate gap analyses, summaries and chatbot responses. Prompt and response content sent to AI features is not persisted; only metadata about the request (timestamp, feature used, organisation) is logged.
Each organisation's data is logically isolated. Every request is checked against the requesting user's organisation membership before any tenant-scoped data is read or written, enforced at the application layer on every code path that serves data. Members of one organisation cannot access another organisation's data through the Service.
Depending on configuration, the Service may use third-party sub-processors for email delivery (Cloudflare Email Service, or an SMTP provider), file storage (Cloudflare R2 or another S3-compatible provider, or a self-hosted disk), and payment processing (Paystack or PayFast, depending on the configured gateway). AI-assisted features, where enabled, currently run against an internal, non-third-party engine — no prompt or document content is sent to an external AI provider. Each sub-processor only receives the data necessary to perform its function.
Some of our service providers, including our cloud infrastructure providers, store or process information outside South Africa, in the countries where they operate their data centres. We send personal information abroad only where the recipient is bound by a contract or rules that give protection similar to POPIA, where you consent, or where POPIA otherwise allows it. Customers who need to know where their data is held can ask us at legal@compliance-desk.com.
We use one strictly-necessary cookie to keep you signed in, which does not require consent under POPIA or the GDPR. We do not use advertising or analytics cookies, and we do not load analytics scripts from third parties on this website.
Customer Data is retained for as long as an organisation's account is active, plus a reasonable period after termination to allow export, after which it is deleted. The audit log is insert-only and is not deleted on a per-action basis, consistent with its purpose as a tamper-resistant compliance record.
Depending on your location, you may have rights to access, correct, export or delete your personal information (for example under POPIA or the GDPR). Requests can be directed to your organisation administrator or to legal@compliance-desk.com. If you are unhappy with how we handle your personal information, please contact us first. You also have the right to complain to the Information Regulator (South Africa) at inforegulator.org.za.
We use measures including encrypted transport, application-enforced multi-tenant isolation, rate limiting and security headers to protect personal information. No system is completely secure, and we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. Material changes will be communicated to account owners before they take effect.
An Elestack Digital Solutions product · © 2026 Elestack Digital Solutions. All rights reserved.