1. Who we are
Pulse 24 is an online system that security and staffing companies use to roster their staff, record clock-ins, work out hours and leave, and run payroll.
Pulse 24 is run by Nabz Enterprise (Pty) Ltd (registration number 2022/479377/07), trading as Pulse 24 ("Pulse 24", "we", "us").
Pulse 24 plays two roles under the Protection of Personal Information Act, 2013 (POPIA):
- Operator for our clients. When a company (our client) uses Pulse 24 for its guards and staff, that company is the responsible party for its staff's information. It decides what is collected and why. Pulse 24 is its operator: we store and process the information for the company, on its instructions, under a written operator agreement. If you are a guard or staff member, your employer is the first place to go with questions about your information (see section 9).
- Responsible party for our own information. For our own business contacts - the people who sign up, sign in to the web app as administrators, ask for a demo or are billed by us - Pulse 24 is the responsible party.
Information Officer: Nabeel Ahmed Gani - [email protected]
Registered with the Information Regulator on 11 October 2026, registration number 2026-068904.
General contact: [email protected]
All privacy requests and notices are handled by email at the addresses above.
2. What information we hold
Guards and staff (held for the employer)
Loaded by the employer or captured by the guard app:
- Identity and contact: name, employee number, cellphone number, email address, date of birth, South African ID number.
- Work and compliance: PSIRA registration number, grade and expiry date, firearm competency dates, job role, site, contract dates, employment type.
- Pay: pay rate, tax number, bank name, bank account number and branch code, hours worked, overtime, allowances, leave and payslip figures.
- Clock-in and clock-out records: the time, the site, the GPS position of the phone at the moment of the punch, whether it was inside the site's geofence, the device used, the network (IP) address the punch came from, and whether the phone reported a fake (mock) location.
- Clock-in selfie: a photo taken by the guard app when the guard clocks in.
- Leave, incidents and documents: leave requests, sick notes (medical certificates) for sick leave, incident reports and photos, and documents the employer uploads such as ID copies, bank letters and PSIRA certificates.
- App problem reports: if the guard app crashes or hits an error, it sends the error message, the screen it happened on, the app version, the phone model and the Android version. These reports never include GPS positions, photos, names, ID numbers or what was typed.
Client administrators and our own contacts
- Name, email address, company, role and permissions.
- Password - stored only as a one-way scrambled value (bcrypt). We cannot see your password.
- Two-step sign-in: the sign-in codes we email you, stored only as one-way scrambled values for a few minutes, and the browsers you asked us to remember (a one-way value of a random key, a short description such as "Chrome on Windows", and dates).
- Sign-in history and an audit trail of actions in the web app, including the network (IP) address seen by the server.
- Billing details: the billing name, email and address on invoices, and payments received.
- Emails you send us.
3. What we do NOT do
- No tracking outside clock-in. The guard app reads GPS only at the moment a guard clocks in or out. It does not track location in the background, between punches or when the app is closed. The app does not ask for background location permission.
- No face recognition. Selfies are stored as photos only, so the employer can see who clocked in. Pulse 24 does not run face matching or create face templates.
- No selling or advertising. We do not sell personal information, and we do not use it for advertising or to build profiles.
- No use for our own purposes. We use client staff information only to provide the Pulse 24 service to that client.
4. Why we use it
| Purpose | Information used | Lawful basis (POPIA s11) |
|---|---|---|
| Rostering staff to sites and shifts | Name, role, site, PSIRA and firearm details | Employer's employment contract and legal duties |
| Proving attendance and paying the right hours | Clock records, GPS at punch, selfie | Employer's contract and legitimate interest; pay law (BCEA) |
| Working out pay, leave, tax and payslips | Pay rate, hours, leave, bank and tax details, ID number | Employer's contract and legal duties (BCEA, Income Tax Act, UIF) |
| Sick leave above the employer's threshold | Sick note | Employer's duty under BCEA s23 |
| Site and PSIRA compliance | PSIRA and firearm competency details | Private Security Industry Regulation Act and Firearms Control Act |
| Running and protecting the service | Sign-in history, audit trail, error reports | Our legitimate interest in a secure, working service |
| Billing our clients | Billing name, email, address, payments | Our contract with the client; tax law |
Health information (sick notes) and information about criminal behaviour that may appear in an incident report are special personal information under POPIA. They are handled only because employment and labour law requires or allows it, and only the employer's authorised users can see them.
5. Who can see it
- The employer's own users, limited by the roles and company scopes the employer sets. ID numbers and bank details are shown masked unless a user with the right permission chooses "reveal", and every reveal is recorded.
- Pulse 24 support, only to help a client. Support uses a read-only session that lasts at most 30 minutes, shows a banner, and is listed on the client's own Support access page. Making any change needs a typed reason, which is recorded.
- The service providers in section 6, only as needed to run the service.
- Authorities, only where the law requires it.
6. Service providers and information leaving South Africa
The Pulse 24 server and database are in South Africa. Some service providers are outside South Africa:
| Provider | What it is used for | What it can see | Where |
|---|---|---|---|
| Cloudflare, Inc. | Secure connection (HTTPS) between users and the Pulse 24 server | All traffic to and from the web app and guard app passes through it, including screens and photos while in transit | United States company, global network |
| Zoho Corporation (Zoho Mail) | Sending email from Pulse 24 (password resets, notices, reports sent by email) | Email addresses and the content of those emails | United States data centre |
| Google LLC (Google Maps) | Finding a site's address and map position when an administrator sets up a site | The site address or map point being looked up - not guard information | United States |
| OpenStreetMap Foundation | Map pictures and address lookups shown in the web app | The administrator's internet address and the area of the map being viewed | United Kingdom / European Union |
| Anthropic, PBC (AI assistants) | AI assistants run on the Pulse 24 server computer and are used for maintenance and development. They have access to that computer and can reach the live system and its data while doing that work | Whatever information is on screen or in files during a maintenance task | United States |
POPIA section 72 allows information to go outside South Africa when the receiving party is bound by law, rules or an agreement that gives protection substantially similar to POPIA, or when it is needed to perform the contract. These providers are bound by their own data processing terms. We will tell our clients before we add or replace a provider that handles personal information.
Not switched on today (we will update this policy before any of them are used): Firebase push notifications, Sentry error reporting, SMS and WhatsApp messaging.
7. How we protect it
- All connections use HTTPS, with strict transport security.
- ID numbers, tax numbers and bank details are encrypted inside the database, with the key kept separately.
- The server's disks are encrypted with BitLocker.
- Each client's data is kept apart inside the database itself (row-level security), so one company cannot see another's data.
- Passwords are stored as bcrypt values; sign-in locks after 10 wrong attempts in 15 minutes; sessions are short and the web app signs out after 60 minutes of no use.
- Two-step sign-in: when a web app user (or Pulse 24's own superadmin) signs in on a browser we do not recognise, we email a 6-digit code that must be entered after the password. Wrong codes are limited and recorded.
- Looking at sensitive information (revealing an ID or bank number, viewing a selfie, document or incident photo, exporting or erasing) is recorded in an audit trail.
- Backups are taken every night. Copies are encrypted (AES-256) on two USB drives that are swapped weekly, so one copy is always kept away from the server.
- The database cannot be reached from the internet - only the Pulse 24 application on the same computer can reach it.
No system is perfectly secure. If a breach affects your information we will act under our breach response plan and tell the people we are required to tell.
8. How long we keep it
| Information | How long |
|---|---|
| Clock-in selfies | 1 year from the punch, then the photo is deleted (the punch record stays) |
| Incident photos | 3 years from the incident |
| Staff documents (ID copies, bank letters, certificates) | 5 years after the staff member leaves |
| Sick notes (medical certificates) | 5 years after the staff member leaves |
| Staff identity (name, ID, contact, bank details) | 5 years after the staff member leaves, then anonymised; pay history is kept without the name |
| Audit trail | 7 years |
| Push notifications and message logs | 1 year |
| Expired sign-in and password-reset tokens | 30 days after they expire |
| Sign-in codes and remembered browsers | Codes: 5 minutes, deleted within 30 days of expiry. Remembered browsers: up to 90 days, deleted within 30 days of expiry, or at once when you forget them |
| Server error log | 90 days |
| Our invoices and payments | 5 years (tax law) |
These rules are applied automatically by a job that runs every week. When a client cancels, its whole account is deleted one month after the agreement ends and the last backup copies expire within about 13 months after that. The full detail is in the Pulse 24 Data Retention Policy.
9. Your rights
Under POPIA you may ask:
- to see the information held about you;
- to correct information that is wrong or out of date;
- to delete information that is no longer needed or was collected unlawfully;
- to object to processing, on reasonable grounds;
- to be told if your information has been compromised.
Guards and staff: please ask your employer first - it is the responsible party and decides on your request. Pulse 24 helps your employer: it can export your information for you and, once you have left, anonymise your record. If your employer does not help, you can contact Pulse 24's Information Officer.
Client administrators and our own contacts: contact our Information Officer at [email protected].
We may need to check who you are before acting on a request. Some information must be kept for a legal period (for example pay records) even if you ask for it to be deleted - we will tell you if that applies.
Complaints: you may complain to the Information Regulator (South Africa):
website inforegulator.org.za, email [email protected], enquiries [email protected], toll free 0800 017 160.
10. Children
Pulse 24 is for employers and their adult staff. We do not knowingly hold information about children.
11. Changes to this policy
We will publish any change on pulse24.co.za with a new version number and date, and tell clients directly about material changes. Guards will be shown the updated notice in the app when it changes.