Legal

Privacy Policy

Last updated: 21 September 2026

1. Who we are

This policy applies to Strata, an online platform made for Health, Safety and Environment (HSE), and to the public website at stratahse.com (“Strata”, “we”, “us”).

The website address is registered in South Africa. Client data is processed in the European Union. We handle personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA) and, where it applies, the General Data Protection Regulation (GDPR).

Questions: support@stratahse.com or info@stratahse.com.

2. Two roles

Website and account data. When you visit the site, open an account, or contact us, we decide why that information is processed. Under POPIA we are the responsible party. Under the GDPR, where it applies, we are the controller.

Workspace content. Records the Client stores in Strata belong to the Client. The Client is the responsible party (and controller where the GDPR applies). We process that content only to provide the service. We do not use it for marketing.

3. What we collect and why

We collect what you give us when you contact us or open an account (typically name, work email, organisation and message). The Client may store workplace and assessment records in its workspace. Some of those records can identify a person. The Client must have a lawful basis before entering that information.

We use personal information to provide and protect the service, to support the Client, and to meet legal duties. We do not sell it.

We share it only with operators who host or support the service, with advisers under confidentiality, or with authorities where the law requires it. Processing in the European Union, while we operate from South Africa, is a cross-border transfer under POPIA section 72. We do so under arrangements that require the recipient to protect the information.

4. Cookies

Essential cookies keep the site working and remember your cookie choice. Optional analytics cookies run only if you accept them. You can change that choice on the cookie settings page.

5. Retention and security

Account and support records are kept for as long as needed to provide the service and meet legal duties. Workspace content is kept for the subscription. After it ends, the Client has 30 days to export. After that we may delete it, unless the law requires a longer hold.

We take appropriate measures to protect personal information. No service can promise that a system is never breached. If you find a security issue, email support@stratahse.com with the subject “security report”. We will acknowledge receipt within 48 hours.

6. Your rights

Under POPIA, and under the GDPR where it applies, you may ask whether we hold personal information about you, and request access, correction, deletion or restriction where the law allows. If the information sits in a Client workspace, start with that organisation.

You may complain to the Information Regulator of South Africa. Where European Union law applies, you may also complain to the relevant supervisory authority.

7. Changes

We will update the date at the top when this policy changes. Continued use after a change means you have had notice of the new wording.