Privacy Policy

1. Who we are

Authentikor is a product of Villiers Vision Works (Pty) Ltd ("we", "us"), a company registered in South Africa.

When we decide why and how information is used, we are the responsible party. This covers website visitors, people who check a code or a file, people who contact us, our customers' users, and companies that apply to be verified.

When a customer uses Authentikor for its own email and documents, the customer decides why that information is processed. In that case the customer is the responsible party and we process the information for it as its operator. An example is the sender and recipient addresses of an email that carries a code.

Back to contents

2. What Authentikor does

Authentikor lets companies put unique verification codes, QR codes and seals on their emails, documents and websites. Anyone can check them at authentikor.co.za/verify.

We also provide:

• email signatures and campaign banners;
• an email relay (smtp.authentikor.co.za) that adds codes and banners to a company's outgoing mail and then sends it through that company's own mail server;
• a dashboard and API;
• website verification (proof that a company controls a domain) and a website seal;
• verification certificates for companies;
• licence certificates that verified companies issue to their own licensees.

Companies apply to be verified through a "Get verified" application.

Back to contents

3. What we collect, and from whom

We collect only what each feature needs. Where a field is optional, we say so.

3.1 People who check a code, seal or file on our website

• The code you type, or the picture or file you choose to check.
• When you check a code, we store your IP address, browser and device details (user agent), browser language and the time of the check. We store these against that code. The code's owner and we can then see when and how often it was checked, and spot copied or misused codes.
• Pictures and files:
  • QR codes and printed codes are read on your own device.
  • To read a seal, the picture is sent to our server, read in memory and then discarded. It is not stored, and its content and file name are not logged.
  • For a PDF, we also send a fingerprint (hash) of the file so the result can be matched to it.
• Rate limits: to stop abuse, we count the code and picture checks from each IP address over a short period. These counts are kept only in memory.
• Our server logs also record your IP address, the time, the page or address requested and your browser details (section 3.7).
• You do not need an account to check anything, and we do not ask for your name or email.

3.2 People whose email addresses appear on a customer's email

When a customer sends an email through the Authentikor relay, or attaches a code to an email, the code record holds:

• the sender address; and
• the To, CC and BCC addresses.

These people usually have no relationship with us. We process their addresses on the customer's instructions.

Message content:

• The relay processes the content in memory, only to add the code, banner or seal, and then sends the message on through the customer's own mail server.
• We do not store the body, the subject or the attachments.
• Our server logs can contain technical message details, such as the names of attached files.

What the public verify result shows:

• the sender address, in full, because the point of the check is to show who sent the email;
• up to five To and CC addresses, each masked (for example j***@example.com).

It never shows BCC addresses or the customer's internal user details. The full addresses are visible only to the customer's own signed-in users.

Seals on emails: when an email carries a seal, we keep a permanent signed record of it so that anyone can check it later. The record holds:

• the sender address;
• up to five masked recipient addresses;
• the number of recipients.

Images in the email: when someone opens the email, it may load the code image, seal or campaign banner from our servers.

• For banners, we count views and, if the customer turned it on, clicks. We store only the counts and the time of the last view or click, not who viewed it.
• Our server logs record the IP address, time and browser details of each image request (section 3.7).
• Some email signatures load social media icons from the jsDelivr public content network (section 8). jsDelivr then receives the reader's IP address.

3.3 Our customers' users (dashboard and API)

• Name, work email address, phone, address details, the company they belong to, and their role.
• Sign-in data:
  • the password, stored only as a one-way hash and never in plain text;
  • sign-in sessions;
  • one-time links (password reset, email verification);
  • API and email-relay credentials.
• Email signature details a user chooses to enter: full name, job title, department, company, phone, mobile, website, address, social media links, and profile photo, logo and banner images.
• Company details:
  • company name, registration number, address, website, contact number and email domain;
  • email-sending settings, including the company's own outgoing mail server details. The mail server password is held encrypted.
• Records of security events, such as failed sign-in attempts, which can include an IP address.

3.4 People who contact us (contact and enquiry forms)

• Required: your full name, your email address and your message.
• Optional: your company name and phone number.
• Added by the form: the product and type of enquiry. For a company-verification question or a misuse report, a public reference you give us.
• How we handle it:
  • We store your enquiry and email it to our mailbox through our email provider (section 8). Your address is set as the reply address so we can answer you.
  • To prevent abuse, we keep a scrambled (hashed) form of your IP address for a short time, to limit how many enquiries can be sent.

3.5 Companies applying to be verified ("Get verified")

• Company: legal and trading name, registration number, VAT number, registered and operating addresses, phone, general email, and websites or domains.
• People (directors and authorised signatories):
  • full name, ID or passport number, role, email and phone;
  • copies of identity documents and proof of address.
• Company documents: registration certificate and director list. Optionally, a letterhead and a bank confirmation letter.
• Declaration and consent: your typed name and the time you gave it.
• Sign-in to the application: the application link is sent to the invited contact's email address, and a one-time code is sent to that address before any data is shown. This step uses Cloudflare Turnstile to check for bots (section 12).
• Domain proof: the DNS record or file you publish to show you control a website, and the results of our checks of it.
• Your authority: the person who applies must have the authority and the consent of the directors and signatories whose details they submit. We ask the applicant to declare this.

3.6 Licence holders

A verified company that issues a licence certificate enters the licence details. These are:

• the holder's display name and reference;
• the licence type, number and scope;
• the validity dates.

Anyone who checks the certificate can see the licence details, so that they can confirm what the licence allows.

3.7 Website visitors and server logs

• Our servers keep standard logs for security and fault-finding. The logs record:
  • the IP address and time;
  • the page or address requested;
  • the response;
  • your browser details.
• The website uses no analytics, advertising or tracking tools. See section 12 for cookies.

3.8 Payments

Online payment is switched off at present; purchases are made through an enquiry. When online payment is switched on:

• payments are processed by Paystack;
• we keep your billing email address (encrypted), the payment reference, transaction number, amount, currency, status and time;
• we never receive or store card details.

3.9 Special personal information and children

• We do not ask for special personal information (POPIA s26), such as health, religious or biometric information.
• Identity documents can contain a photograph. We handle them only as described in 3.5, and only to verify identity.
• Our services are for businesses and are not directed at children under 18. We do not knowingly collect children's information.

Back to contents

4. Why we use it, and our lawful basis (POPIA s11)

We use information only for these purposes, and not in a way that is incompatible with them.

Back to contents

5. Collecting only what we need

• Checking a code, seal or file needs no account or personal details from you.
• Recipients' addresses are masked on public results, and BCC addresses are never shown publicly.
• Pictures you check for a seal are read in memory and not kept.
• Identity documents, company documents and the sensitive personal details in an application are encrypted the moment they arrive (section 9) and are used only for the review.
• The public certificate page shows:
  • the company's legal and trading name;
  • its verified domains;
  • the certificate's status, level and dates;
  • the registration number in masked form.

  It never shows documents, ID numbers, individuals' addresses or contact people.

Back to contents

6. How long we keep it (POPIA s14)

When we no longer need information, we delete it or de-identify it, unless the law requires us to keep it.

Back to contents

7. Sharing

We do not sell personal information. We share it only with:

• operators who process it for us (section 8);
• the owner of a code, seal or licence, who can see that a check of it happened and the details in 3.1;
• anyone who checks a code, seal, certificate or licence, who sees only the information described in 3.2, 3.6 and 5;
• authorities, where the law requires it or to protect rights; and
• a buyer or successor of the business, who must protect the information in the same way.

Back to contents

8. Operators and other service providers

Each customer's outgoing email is delivered through that customer's own mail server, which the customer chooses and is responsible for.

We require our operators to keep personal information secure and confidential and to use it only to provide their service to us. We rely on their published data protection terms for this.

Back to contents

9. Security safeguards (POPIA s19)

We take reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised access and unlawful processing. These measures are in place:

• Encryption in transit:
  • Connections to our websites, API and email relay are encrypted (HTTPS and TLS), and browsers are told to always use HTTPS.
  • Our databases accept only encrypted, mutually authenticated connections.
• Passwords and sessions:
  • Passwords are stored only as strong one-way hashes (Argon2id).
  • Repeated failed sign-ins lock the account for a short time.
  • Sign-in sessions expire.
• Verification documents:
  • Documents and sensitive application details (such as ID numbers) are encrypted the moment they arrive, each with its own key.
  • They can be opened only on a separate, protected Authentikor review device. Our server cannot read them.
  • Every file is scanned for malware before it is stored, and an infected file is rejected.
  • Each time a reviewer opens a case or a document, it is recorded in a tamper-evident audit log.
• Administration:
  • Administration requires a second factor.
  • It is reachable only over a private, encrypted network connection, not over the public internet.
• Separation: each customer's data is kept separate from other customers' data, and the database enforces this.
• Abuse protection: code checks, picture checks, enquiries and sign-ins are limited per IP address to prevent abuse and guessing.
• Payments: card details never reach our servers.

No system is perfectly secure. We review these measures regularly and update them when risks change.

Back to contents

10. Sending information outside South Africa (POPIA s72)

Our server is hosted in France, so the information we hold is stored outside South Africa. Some providers in section 8 also process information in other countries, including the United States.

We transfer personal information outside South Africa only where at least one of these applies:

• the recipient is subject to a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA (for example, our hosting in France is subject to the EU General Data Protection Regulation);
• the transfer is necessary to perform a contract with you, or to take steps you asked for; or
• you consent.

Back to contents

11. Your rights

You may:

• ask whether we hold information about you, what it is, and who has had access to it (POPIA s23);
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24);
• object to processing based on legitimate interest, or withdraw consent at any time (s11(3)). Withdrawing consent does not affect processing already done;
• object to direct marketing (s69); and
• complain to the Information Regulator (section 15).

How to make a request:

• Use the contact form at authentikor.co.za/contact and start your message with "Privacy request", or phone +27 87 150 9305.
• We may ask you to prove your identity first.
• We reply within 30 days.
• Requests under the Promotion of Access to Information Act (PAIA) can be sent to info@vvwsoftware.com.

If your address appears on a customer's email: you can ask us, or the company that sent the email.

• We can remove your address from the code record.
• If the email carried a seal, its permanent record keeps a masked form of your address (for example j***@example.com), which cannot be changed.

Closing an account: customers can ask us to close their account and delete their data through the contact form or by phone.

Back to contents

12. Cookies and browser storage

Public pages (home, products, pricing, verify, contact):

• We set no cookies.
• We use no analytics, advertising or tracking scripts.
• Fonts are hosted by us.

"Get verified" application pages:

• After you enter the emailed one-time code, a strictly necessary cookie keeps your application session open for up to 7 days.
• The one-time code step loads Cloudflare's Turnstile check. Our site sets no cookie for it; Cloudflare processes your IP address and browser details to run the check.

Signed-in areas (dashboard and administration):

• We use strictly necessary cookies to keep you signed in, refresh your session, confirm sensitive actions and protect against forged requests. These end when you sign out or when they expire.
• One cookie remembers your company ID for up to one year so that the sign-in form can fill it in for you. It stays after you sign out.
• While a session is being renewed, a short "pending" marker is kept in your browser's local storage.

When online payment is switched on: encrypted cookies keep your purchase and order in progress, for up to 7 days.

We use no cookie for tracking or advertising, so we do not show a cookie consent banner. If we add analytics later, we will update this section first and ask for consent where the law requires it.

Back to contents

13. Direct marketing (POPIA s69)

• Existing customers: we may email you about our own similar services. Every such message has a simple way to opt out, and you can opt out at any time.
• Newsletter: we send a newsletter only to people who sign up for it. You can unsubscribe at any time using the link in each newsletter.
• We do no other direct marketing.
• System emails (sign-in links, application links, certificates, renewal and security notices) are not marketing.
• To opt out or object: use the link in the message, the contact form, or phone us.

Back to contents

14. Data breaches (POPIA s22)

If we have reasonable grounds to believe that personal information has been accessed or acquired without authority, we will:

• notify the Information Regulator and the affected people as soon as reasonably possible;
• tell them what happened and what they can do to protect themselves; and
• where we act as an operator, notify the customer (the responsible party) without delay.

Back to contents

15. Complaints

Please contact us first, so that we can try to put things right. You can also complain to the Information Regulator (South Africa). Its current contact details and complaint forms are on its website, https://inforegulator.org.za.

Back to contents

16. Changes to this policy

We may update this policy. The effective date at the top shows the current version. For material changes, we will notify customers by email or in the dashboard before they take effect.

Back to contents

17. Contact

Villiers Vision Works (Pty) Ltd · Cape Town, South Africa · info@vvwsoftware.com · authentikor.co.za/contact · +27 87 150 9305 · Mon to Fri 8:00 to 17:00.

Back to contents