Data Privacy
Version 1.1 · Effective 30 October 2026
No copy of your uploaded files is kept, not in backups and not in logs. Measured results and your reports are retained for 30 days after the scan, then deleted automatically; hash records are kept to allow your reports to be verified. Your estate measurements are not shared, benchmarked or aggregated with any other party; the single exception, a one-way estate fingerprint used only to enforce one scan per estate, is described in section 6. The following sections of this notice sets out the detail required by the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible
BridgeCore Technologies (Pty) Ltd (registration 2026/131186/07) is the party responsible for this notice. Its contact details and Information Officer are listed in section 14 and in the Legal Notice. In this notice, "you" means the organisation that requests an evaluation (the Organisation) and the individuals who act for it (Users).
2. What this notice covers
This notice covers personal information and data that BridgeCore receives through:
- this website;
- the CorePulse™ application, including the evaluation; and
- business dealings with the Organisation and its representatives.
It does not cover the licensed BridgeCore STRATA platform deployed under the BridgeCore STRATA Master Agreement. That platform is deployed and executed within the client's own environment, and data processing under it is governed by the Data Processing Agreement in Annexure C of that agreement.
3. The data we receive
| Category | What it contains | Source |
|---|---|---|
| Account Data | Names, business email addresses, telephone numbers, job titles and organisation names of Users; the activation key; sign-in and access records, including date and time and the IP address, which is stored in hashed form | Users, when requesting a key or using CorePulse |
| Scan Data | The SAP export files uploaded for the evaluation. These are structural metadata. They may contain SAP user identifiers or assigned usernames linked to system objects (for example, the creator of an object or transport) | The Organisation, through CorePulse |
| Results | The measured figures, registers and findings produced from the Scan Data, and the issued report. Findings may include readable SAP user IDs, for example the connection topology and logon user IDs of RFC destinations | Computed by CorePulse |
| Intake Record | A cryptographic hash of each uploaded file and of the issued report; the activation key; the Organisation's name; the date the exports were taken; the date of the scan; and a one-way fingerprint of the SAP estate, from which no system values can be read | Generated by CorePulse at intake |
| Website Data | Page-load speed measurements, taken without cookies on every visit; and, only if you click Allow measurement, the pages you visit, how you use the site, device and browser information and approximate location, collected by Google Analytics and the LinkedIn Insight Tag. See section 12 | Your browser |
4. Roles, purposes and lawful basis
| Category | BridgeCore's role | Purpose | Lawful basis (POPIA s11(1)) |
|---|---|---|---|
| Account Data | Responsible Party | Issuing and administering activation keys; verifying that the requester acts for the Organisation; delivering reports; support; security; enforcing the Terms of Use and Conditions | Performance of the agreement (s11(1)(b)); BridgeCore's legitimate interest in securing CorePulse and enforcing its terms (s11(1)(f)) |
| Scan Data | Operator, acting on the Organisation's instruction | Producing the Results. Nothing else | Performance of the agreement (s11(1)(b)); the Organisation's own lawful basis for the information in its exports |
| Results | Operator, acting on the Organisation's instruction | Issuing the report, so that the Organisation can evaluate STRATA, and allowing the report to be verified | Performance of the agreement (s11(1)(b)) |
| Intake Record | Responsible Party | Verifying the authenticity and integrity of reports; enforcing one scan per estate | Legitimate interest (s11(1)(f)); performance of the agreement (s11(1)(b)) |
| Website Data | Responsible Party | Measuring website performance; with consent, measuring how the website is used, measuring the response to BridgeCore's LinkedIn activity, and showing BridgeCore advertising on LinkedIn to website visitors | Legitimate interest (s11(1)(f)) for cookieless performance measurement; consent (s11(1)(a)) for Google Analytics and the LinkedIn Insight Tag |
For Scan Data and Results, the Organisation is the Responsible Party. It must have a lawful basis for any personal information contained in the exports it uploads, and must give any notice its own data subjects require.
5. Is the information mandatory?
Account Data and Scan Data are required to issue and execute an evaluation. Without them BridgeCore cannot issue a key or produce a report. Google Analytics and LinkedIn Insight Tag data are collected only if you click Allow measurement. Declining has no effect on your use of the website.
6. What BridgeCore does not do
BridgeCore does not:
- share, sell, rent or disclose Scan Data or Results to any third party, except as set out in section 7;
- benchmark, compare or aggregate the Organisation's Results with those of any other party, whether identifiable or de-identified. The sole exception is the estate fingerprint in the Intake Record. To support the one scan per ERP estate limit, BridgeCore retains only a one way cryptographic fingerprint derived from the technical exports. No readable values or file contents are stored;
- use Scan Data or Results to train, fine-tune or evaluate any artificial-intelligence or machine-learning model;
- use Scan Data or Results for research, product development or marketing; or
- make any automated decision about any individual based on the Scan Data (POPIA s71). The evaluation measures technical system structures, not people.
7. Who receives personal information
BridgeCore discloses personal information only to:
- its operators (service providers) that host CorePulse or deliver email, under written contracts that require them to secure the information and process it only on BridgeCore's instructions (POPIA ss20 and 21). The current list is: Hetzner Online GmbH (hosting and backups, Germany); Let's Encrypt (certificates); Microsoft 365 (business email, including delivery of activation keys); GitHub (source code only, never client data). The list is available on request from the Information Officer;
- Cloudflare, which measures website speed without cookies, and, only if you click Allow measurement, Google (Google Analytics) and LinkedIn (LinkedIn Insight Tag), which receive Website Data through the tools described in section 12 and process it under their own privacy terms;
- its professional advisers, under a duty of confidentiality, where needed to establish, exercise or defend legal rights; and
- a court, regulator or authority where the law requires it. BridgeCore will notify the Organisation first unless the law prohibits it.
8. How long BridgeCore keeps it
| Category | Retention |
|---|---|
| Scan Data (uploaded files) | Uploaded files are held in memory only, read once, and deleted when the scan completes; none is written to disk, kept in backups, or retained in any form |
| Results and reports | Results and reports are retained for 30 days from scan completion, then deleted automatically; deleted earlier on request. Deleted data may persist in encrypted backups for up to 35 further days. Verification of a report you hold remains available indefinitely, whether or not BridgeCore still holds a copy. |
| Intake Record (hash records and estate fingerprint) | Held in append-only registers. The registers record one-way hashes of the uploaded files and issued reports, and the names and sizes of the files uploaded, but never their contents. Retained indefinitely as verification and one-scan-per-estate evidence, and not erasable (see section 11). A hash cannot be used to reconstruct the Scan Data |
| Audit trail | Append-only. Holds event types, timestamps, the Organisation's name and hashed IP addresses, but no personal names. Retained indefinitely |
| Account Data | Contact details are kept for the relationship and for the periods required by tax and company law, then deleted or de-identified. Entries in the activation-key issuance register are append-only and retained indefinitely. |
| Website Data | Cloudflare speed measurements: six months (Cloudflare Web Analytics documentation, developers.cloudflare.com/web-analytics/faq/). Google Analytics: 14 months. LinkedIn Insight Tag: as set by LinkedIn. |
Backup copies are retained for up to 35 days. As a result, data deleted from the production environment may continue to exist in encrypted backup archives for a maximum of 35 days before being permanently removed.
9. Where the data is processed
BridgeCore is established in South Africa. CorePulse is deployed on Hetzner Cloud in Nuremberg, Germany, and its backups are held in Hetzner Object Storage in the same region. CorePulse data is hosted in the European Union throughout. Germany is subject to the GDPR, which provides protection substantially similar to POPIA, and the transfer is made as permitted by POPIA s72(1)(a). Where personal information subject to the GDPR or UK GDPR is accessed from outside the European Economic Area, BridgeCore does so under the applicable Standard Contractual Clauses or UK International Data Transfer Addendum.
Website Data collected by Cloudflare, Google and LinkedIn may be processed outside South Africa, including in the United States, under those providers' data transfer terms and as permitted by POPIA s72.
10. Security
BridgeCore applies the following technical and organisational measures (POPIA s19):
- Uploaded files are held in memory only, read once, and deleted when the scan completes; none is written to disk, kept in backups, or retained in any form.
- All traffic is encrypted with HTTPS.
- Results, reports and hash records are backed up every 24 hours in encrypted form, and the decryption key is held offline.
- Administrative access to the server is restricted and key-based, and the hosting account is protected by two-factor authentication.
- A firewall limits inbound traffic, and the database is not reachable from the internet.
- Audit and verification records are append-only, and client IP addresses are stored in hashed form.
- Security patches are applied automatically, and backups are verified.
A detailed description of these measures is available to Organisations on request.
Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, BridgeCore will notify the Organisation, and where required the Information Regulator and affected data subjects, as soon as reasonably possible (POPIA s22).
11. Your rights
Individuals whose personal information BridgeCore processes may:
- ask whether BridgeCore holds their personal information and request a record of it (POPIA s23);
- ask for it to be corrected or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24);
- object to processing based on legitimate interest (s11(3)(a)), and object at any time to direct marketing (s11(3)(b));
- withdraw consent where processing is based on consent; and
- lodge a complaint with the Information Regulator (details in section 14).
What can and cannot be erased. On request, BridgeCore will delete the Organisation's reports and measured results from the server; backup copies roll over within 35 days. The hash records in the audit log, result register, estate-fingerprint register and key-issuance register cannot be erased. They hold one-way hashes, not readable client values, and they are the evidence on which report verification and the one-scan-per-estate rule depend.
Requests about Scan Data or Results should go to the Organisation, as Responsible Party. BridgeCore will assist it. Individuals in the EU or UK have the equivalent rights under the GDPR or UK GDPR. Requests for access to records may also be made under the Promotion of Access to Information Act 2 of 2000 (PAIA). BridgeCore's PAIA manual is available on request.
12. Cookies and tracking
On every visit, without cookies. Cloudflare measures how quickly pages load. It does not set cookies.
Only after you click Allow measurement. When you first visit bridgecore.io, a banner asks whether you accept analytics and marketing cookies. Only if you click Allow measurement:
- Google Analytics measures how the website is used, such as pages visited, time on site, device and browser type, and approximate location; and
- the LinkedIn Insight Tag measures visits and the response to BridgeCore's LinkedIn activity, and adds visitors to a website audience that BridgeCore can use to show its advertising on LinkedIn (retargeting). Retargeting is switched on. If you are signed in to LinkedIn, LinkedIn may link the visit to your LinkedIn account under its own privacy policy. BridgeCore receives aggregated reports only.
Both tools set cookies. If you do not click Allow measurement, neither will execute.
Withdrawing consent. Click Measurement consent in the footer of any page. This clears your stored choice and re-opens the banner. If you then choose Continue without measurement, BridgeCore stores your refusal, expires the Google Analytics cookies set on bridgecore.io, and no tag loads from the next page onward. LinkedIn's own cookies are held on linkedin.com and cannot be cleared from BridgeCore's website; you can clear them in your browser or in your LinkedIn settings. Withdrawing does not affect processing that took place before.
CorePulse. CorePulse sets only the cookies strictly necessary for it to work, such as session and security cookies, and runs no analytics or tracking.
13. Marketing
BridgeCore sends electronic marketing only to individuals who have consented, or to contacts of existing clients about similar BridgeCore products and services, as permitted by POPIA s69. Every message includes a way to opt out, at no cost to you. Receiving an evaluation does not, of itself, sign anyone up for marketing. If you accept the LinkedIn Insight Tag, BridgeCore may show you its advertising on LinkedIn, as described in section 12. You can withdraw that consent at any time through the Measurement consent link in the website footer.
14. Contacts
| BridgeCore Information Officer | hello@bridgecore.io · c/o Savage Jooste & Adams, 5 10th Street, Menlo Park, Pretoria, 0081 |
| Information Regulator (South Africa) | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 · 010 023 5200 · enquiries@inforegulator.org.za · complaints: POPIAComplaints@inforegulator.org.za · https://inforegulator.org.za |
BridgeCore is not intended for children and does not knowingly process children's personal information.
15. Changes
BridgeCore may update this notice. Material changes will be shown by a new version and date at the top of this page. An evaluation is governed by the version in force when its activation key was issued.