Privacy & Data Processing Policy
Last Updated: 10/20/2026
1. POPIA Compliance & Data Subjects
In accordance with the Protection of Personal Information Act (POPIA), Kronos Sqwasha guarantees the lawful processing of personal data. Clients have the right to request access to, correction of, or deletion of their personal records within 72 hours of written notice to our security contact.
2. Encryption Standards
All data in transit is secured using TLS 1.3 cryptographic protocols with AES-256-GCM authenticated encryption. Data at rest (including backups) is encrypted using AES-256 block-level encryption via our primary subprocessor.
3. Subprocessors & Hosting
Our core infrastructure is hosted on dedicated instances provided by Contabo GmbH (Germany) and Hostinger (US/EU), ensuring ISO 27001 compliance. We do not sell data to third-party marketing brokers.
4. Backup, Recovery & Retention
We perform daily automated snapshot backups with a retention period of 30 days. Our Disaster Recovery Plan guarantees a Recovery Point Objective (RPO) of 24 hours and a Recovery Time Objective (RTO) of 4 hours for critical infrastructure failure.
5. Breach Notification Protocol
In the event of an unauthorized data exposure, Kronos Sqwasha will notify the South African Information Regulator and affected data subjects within 72 hours of verified discovery, providing a detailed incident report and remediation roadmap.
6. Security Contact
For data subject requests or security vulnerability disclosures, contact our team at security@kronossqwasha.co.za.