POPIA
Privacy policy
Last updated 15 October 2026
1. Who we are
GFRIS (Provincial Food Relief Integrated System) at gfris.trustem.africa is published and operated by Hill City Solutions (HILLCITY SOLUTIONS (PTY) LTD). For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), Hill City Solutions is the responsible party for personal information processed through this service.
Where a government department, municipality or relief organisation uses GFRIS under its own mandate, that organisation may also be a responsible party for its programme records, and the written agreement with it sets out each party's role.
Hill City Solutions (HILLCITY SOLUTIONS (PTY) LTD)21 Woodlands Drive, Woodmead, Sandton 2191, South AfricaPhone: 067 651 3930Email: John@hillcity.co.zaInformation Officer: Sandile John Thembekwayo — John@hillcity.co.za
2. Demonstration status — please read
- The environment at this address is a demonstration. Its households, identity numbers, wards, partners and contracts are synthetic. Do not enter real personal information into it.
- Government verifications — Home Affairs / National Population Register, SACSSP and professional councils, and the NPO register — are mocked in the demonstration. No query is sent to any government system.
- Face matching is a prototype. It is not a certified biometric matcher and is not used to decide anyone's identity or entitlement on its own.
3. What we process and why
GFRIS is an operational and audit system for food relief programmes. It processes personal information to:
- identify a household across a relief cycle and prevent double allocation;
- record the observed need behind a referral, and the named person who decided on it;
- prove that relief reached the right household (receiver, witness, GPS location, seal);
- operate the register of practitioners permitted to refer households;
- give staff and partner users accounts with role-based access, and record who did what;
- publish ward-level statistics in which any figure below five is suppressed.
Full identity numbers are not stored: only a salted hash and the last four digits. Logs of external checks store a hash of the payload, not the payload. No decision that affects a person is made solely by automated means — a named person decides, and a failed or unavailable check never withholds service.
4. Lawful basis
- Consent (POPIA s11(1)(a)) — for face and fingerprint verification and for optional features. Declining is always available and never withholds relief.
- Contract (s11(1)(b)) — to provide user accounts to staff and partner organisations.
- Public law duty (s11(1)(e)) — where a public body uses the system to deliver a relief programme it is mandated to run.
- Legitimate interest (s11(1)(f)) — security, access logging and fraud prevention.
5. Face templates — special personal information
Biometric information is special personal information under section 26 of POPIA. We process it only on the basis of the person's explicit consent (section 27(1)(a)), and only to confirm that the person in front of an officer is the person already identified on the record.
- On-device extraction: the camera image is processed in the browser on the officer's device. The face is located, cropped and reduced to a list of numbers (a template). The camera image is not uploaded or stored.
- Server-side storage and comparison: the numeric template is sent to and stored in the GFRIS database, and the comparison against the stored template runs on the server so the threshold cannot be changed from a device.
- One-to-one only: a capture is compared with the single template on the record already opened. There is no search across people, no watchlist and no ranking.
- Consent is recorded with a timestamp; a refusal is stored as an outcome in its own right. A refusal, a non-match or an unavailable camera never withholds relief — the handover proceeds with a named witness and is flagged for review.
- Only registrars and administrators can read stored templates. Check events record the outcome and score, never the template or an image.
- Fingerprint: on a device with a fingerprint sensor only an opaque credential reference is stored — the print never leaves the sensor. The on-screen demonstration pad stores a numeric template and is labelled as demonstration capture.
- Retention: a template is kept while the person participates and is deleted when they withdraw consent or leave the programme.
- Withdrawing consent: tell the officer serving you, or contact the Information Officer. A registrar or administrator records the withdrawal in GFRIS, which immediately and permanently deletes every biometric value held for you — the face template, any fingerprint credential or template, and the related quality and liveness scores — across all methods. The consent log records that consent was withdrawn, when, by whom and how you asked; it never keeps the template. Earlier check records (outcome and score, no template or image) remain as audit evidence. You can enrol again later with fresh consent, and withdrawing never affects your access to relief.
6. Children and other sensitive records
Child protection and victim empowerment cases may contain personal information about children. These cases are automatically marked restricted and can be opened only by staff assigned to them.
7. Retention
| Record | What it holds | How long |
|---|---|---|
| User accounts (staff and partner users) | Name, work email, role, organisation, who granted access and why | While the account is active, then for the audit period of the programme |
| Access and audit logs | Who opened, exported or changed which record, and when | Kept until the customer's Information Officer sets a retention period; no automatic deletion today |
| Household register | Household reference, name, phone, household size, ward, salted hash and last four digits of the identity number | For the life of the household record, reviewed each relief cycle |
| Referrals, assessments and decisions | Observed need, named practitioner and assessor, decision and reason | For the audit period of the relief cycle |
| Delivery and redemption evidence | Receiver and witness names, GPS location, a photo reference entered by the officer, seal numbers | For the audit period of the relief cycle |
| Identity document photos | Only when the photo-reading option is switched on: the image is sent to the document reader to suggest fields and is not stored by GFRIS | Not retained by the application |
| Face templates (biometric) | A list of numbers derived from the face, a quality score, the consent time or a recorded refusal. No photograph | While the person participates in the programme; deleted immediately when consent is withdrawn, or when they leave |
| Consent log | That biometric consent was withdrawn, when, by whom, how it was requested and how many records were deleted. No template | Append-only, for the audit period |
| Face and fingerprint check events | Outcome, score, threshold, witness, device and operator. No template and no image | Append-only, for the audit period |
Event, delivery, decision and role records are append-only: a correction is a new record, not an edit, so the audit trail is preserved.
8. Who we share it with (operators)
- Microsoft Azure, South Africa North (Johannesburg) — the application server, the PostgreSQL database, file storage and the key vault that holds our secrets.
- Microsoft Entra External ID — sign-in. It holds your sign-in account: email address, display name and password credential.
- Azure OpenAI in South Africa North — only if photo reading of identity documents is switched on. It is off in the demonstration.
- Government verification services — only in a live deployment configured by the customer; mocked in the demonstration.
We do not sell personal information and do not use it for advertising. There are no advertising or analytics cookies, and fonts are served from our own server.
9. Where it is stored, and cross-border transfer
All application data — household records, referrals, decisions, delivery and redemption evidence, face templates, consent and audit logs, and stored files — is stored and processed in Microsoft Azure South Africa North and does not leave the Republic.
Your sign-in account (email, display name and password credential) is held by Microsoft Entra External ID. Entra stores it in the geography chosen for our tenant, which may be outside South Africa. Where it is, we rely on section 72(1)(a) and (b) of POPIA: Microsoft is bound by data protection terms that provide an adequate level of protection, and the transfer is necessary to provide the account you asked for. No household, case or biometric data is held in Entra.
10. How it is protected
- Encryption in transit (HTTPS/TLS) between the browser, the application and the database, and Azure encryption at rest for the database, disks and storage.
- Row-level security on every table, with role and geographic scope enforced in the database.
- Salted hashing of identity numbers; only the last four digits are shown.
- Append-only audit tables, and logging of record opens and exports.
- Small-number suppression (k=5) on public statistics.
If we believe personal information has been accessed by an unauthorised person we will notify the Information Regulator and affected people as section 22 of POPIA requires.
11. Browser storage
The application keeps your sign-in session in a secure, HttpOnly cookie that scripts cannot read, plus a five-minute access token in memory. Referrals, assessments and redemptions captured without signal are kept in the browser's IndexedDB until they sync. The camera, location and fingerprint sensor are used only when you start a capture that needs them, and your browser asks for permission first.
12. Your rights
- Ask whether we hold personal information about you and for a copy of it (s23).
- Ask for it to be corrected or deleted (s24).
- Object to processing (s11(3)), and withdraw consent at any time — including for face and fingerprint verification — without losing access to relief.
- Complain to the Information Regulator (South Africa): https://inforegulator.org.za.
Send requests to the Information Officer at John@hillcity.co.za or by post to 21 Woodlands Drive, Woodmead, Sandton 2191, South Africa. We may need to confirm your identity before acting on a request. Where a record must be kept to account for public funds we will explain why and what alternatives exist.
13. Changes
We will update this policy when the processing changes and show the date at the top of this page.