POPIA Compliance

Last updated: 6 April 2026

OCR Forge is committed to complying with the Protection of Personal Information Act, 2013 (POPIA) of the Republic of South Africa. This page outlines how we protect your personal information and your rights as a data subject.

1. Responsible Party

The responsible party for processing personal information is:

• Name: BoerTech (trading as OCR Forge)
• Contact: support@ocrforge.co.za
• Location: Cape Town, South Africa

2. POPIA Principles We Follow

Accountability

We take responsibility for all personal information we process and have implemented appropriate policies, procedures, and technical measures to comply with POPIA.

Processing Limitation

We process personal information only for the specific purpose of providing OCR services. We do not use your documents for model training, analytics, or any secondary purpose.

Purpose Specification

Personal information is collected for:

• Account management and authentication
• Providing the OCR processing service
• Billing and invoicing
• Service communications and support

Further Processing Limitation

We do not process your information beyond the stated purposes. We do not sell, share, or transfer personal information to third parties for marketing or profiling.

Information Quality

We strive to keep personal information accurate and up to date. You can update your account information at any time via the dashboard or by contacting support.

Openness

This page and our Privacy Policy document how we handle your information. We are transparent about our data practices.

Security Safeguards

We implement robust technical and organisational measures:

• Encryption at rest: AES-256 via AWS KMS (per-environment keys)
• Encryption in transit: TLS 1.3 on all connections
• Zero-knowledge processing: Source documents are deleted after OCR
• Access control: API key authentication, client isolation
• Audit trail: All API operations are logged (without document content)
• Data residency: All data stays in af-south-1 (Cape Town)

Data Subject Participation

You have the right to access, correct, and delete your personal information. See Section 3 below.

3. Your Rights Under POPIA

As a data subject, you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Objection: Object to the processing of your personal information
• Data portability: Receive your data in a structured, machine-readable format
• Complaint: Lodge a complaint with the Information Regulator

To exercise any of these rights, email support@ocrforge.co.za with the subject line "POPIA Request". We will respond within 30 days.

4. Data Retention

• Uploaded documents: Deleted immediately after processing
• Processing results: Retained for 30 days, then permanently deleted
• Account data: Retained while your account is active, plus 90 days after deletion
• API logs: Retained for 90 days for debugging and security monitoring (no document content)

5. Cross-Border Transfers

OCR Forge does not transfer personal information outside South Africa. All processing, storage, and backup occurs within AWS af-south-1 (Cape Town). Our infrastructure does not replicate data to other AWS regions.

6. Information Regulator

If you believe your personal information has been mishandled, you may lodge a complaint with:

• The Information Regulator (South Africa)
• Website: inforegulator.org.za
• Email: complaints.bi@inforegulator.org.za

7. Contact

For any POPIA-related queries, contact us at support@ocrforge.co.za.