Privacy notice
Version 2026-11. How Bedrock Advisory (Pty) Ltd processes personal information in Bedrock Registry, under the Protection of Personal Information Act 4 of 2013 (POPIA), Kenya's Data Protection Act 2019, Nigeria's Data Protection Act 2023 and Botswana's Data Protection Act, 2024 (Act 18 of 2024).
Who we are
Bedrock Advisory (Pty) Ltd, registration 2022/829263/07, 40 Ranksuikerbos Street, Protea Valley, Cape Town, 7530, South Africa. Telephone +27 72 475 7667. Information Officer: Louis Jordaan, information@bedrockadvisory.africa.
Two roles
Operator for your registers. For the personal information in a company's registers (shareholders, holders of other securities, directors, officers and beneficial owners) the company is the responsible party and Bedrock processes the information on its behalf, under the terms of service. Responsible party for accounts and billing. For users' sign-in details and for billing, Bedrock is the responsible party.
What we process and why
- Register information: names, contact details, identity or registration numbers, addresses, dates of birth, nationality, holdings and transactions. Companies must keep it in their securities, directors' and beneficial ownership registers (Companies Act 71 of 2008 ss24, 50, 56 and reg 32; Kenya Companies Act 2015 ss93 and 93A; CAMA 2020 ss109 and 119). Lawful basis: compliance with the law and the company's legitimate interests (POPIA s11(1)(c) and (f)).
- Users: name, e-mail, password hash, two-factor settings, sessions and an audit log of what each user did. Basis: performing the contract and security.
- Billing: the account owner's name and e-mail, invoices, and from Paystack only a reference to the authorised card (encrypted), its brand, last four digits and expiry. Card numbers never reach our servers. Basis: performing the contract and tax law.
Protection
Encryption in transit; identity numbers, addresses and other sensitive fields encrypted again in the application (AES-256-GCM, bound to the company and field) before storage; masked identity numbers on screens; access limited by role and company; two-factor sign-in for administrators and approvers; a hash-chained audit log verified daily against an external anchor.
Sub-processors and transfers abroad
Cloudflare (hosting, database and storage), Resend (transactional e-mail) and Paystack (card payments). Their servers may be outside your country; transfers are made under binding agreements that give protection comparable to POPIA (s72) and the Kenyan and Nigerian Acts.
Retention
- While you subscribe: register records are kept for as long as the company keeps them on the service; the law requires the company to keep its registers for at least seven years after a person ceases to hold securities (Companies Regulations 2011 reg 32(7), s24).
- After cancellation: read-only for 90 days for export, then the company's records (registers, holders, certificates, actions, documents) are deleted and users who belonged only to that company are anonymised.
- Kept after deletion: invoices and payment records for five years (Tax Administration Act 28 of 2011 s29), and the audit log's hash chain as our security record. On deletion the audit entries of the company are pseudonymised: names, e-mail addresses and the before-and-after details are removed and only their cryptographic digests stay in the chain, so the log can still be verified without identifying anyone.
Your rights
You may ask for a copy of your information (signed-in users: "Download my data" on the account page), ask us to correct or delete it, object to processing, and complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg; telephone 010 023 5200; enquiries@inforegulator.org.za; inforegulator.org.za, the Office of the Data Protection Commissioner (Kenya) or the Nigeria Data Protection Commission. Holders' requests about register entries go first to the company that keeps the register.
Contact
information@bedrockadvisory.africa