Privacy & Data Protection Policy

International privacy scope

Hackabby is South African founded and supports engagements in South Africa, the United Kingdom and the United States. Depending on the customer, data subjects, processing location and contract, relevant requirements may include POPIA, UK GDPR and the Data Protection Act 2018, UK international-transfer rules, and applicable US state or sector privacy/security obligations. These regimes do not apply identically to every engagement, so the applicable requirements are confirmed during contracting and scoping.

1. Purpose

Hackabby respects the privacy, confidentiality and security of personal information entrusted to us. We process information for legitimate business and authorised cybersecurity purposes and apply risk-based technical and organisational safeguards.

2. Scope

This policy applies to website enquiries, client engagements, penetration testing, ASM/BAS, security assessments, incident response, cyber investigations, digital forensics, training, billing and other authorised Hackabby services.

3. POPIA roles

Depending on the engagement, Hackabby may act as a Responsible Party or as an Operator processing information on a client's documented instructions.

4. Information we may process

Depending on the service, this may include business contact information, IP addresses, logs, system identifiers, vulnerability information, security alerts, forensic artefacts, files, emails, incident data and other information reasonably necessary for the authorised engagement.

5. Purpose limitation and minimality

Hackabby seeks to process only information reasonably necessary for the agreed purpose and to avoid unnecessary collection or disclosure.

6. Information security

Appropriate safeguards may include encryption, access control, multi-factor authentication, least privilege, secure storage and transmission, endpoint and network security, logging, segregation, backups, integrity verification and secure deletion.

7. Forensic information

Where information constitutes digital evidence, Hackabby may apply enhanced controls including evidence identifiers, access restrictions, chain of custody, integrity verification and secure evidence repositories.

8. Sharing and cross-border processing

Hackabby does not sell personal information. Information may be shared only where reasonably necessary with authorised personnel, approved service providers, professional advisers, regulators, courts or law-enforcement authorities, subject to appropriate legal and confidentiality requirements. Certain cybersecurity technologies and international engagements may involve cross-border processing. Hackabby addresses this through engagement-specific documentation, approved processing locations, security controls and applicable transfer mechanisms or contractual safeguards.

9. Retention

Retention depends on contractual, legal, forensic, litigation, security and regulatory requirements. Information should be securely deleted, destroyed, anonymised or returned when no longer reasonably required.

10. Data-subject rights

Subject to applicable law and limitations, individuals may have rights to access, correct, delete, restrict or object to certain processing, and in some jurisdictions may have additional portability, opt-out or complaint rights. Identity verification may be required.

11. Contact

Privacy and data-protection enquiries may be directed to Hackabby's Information Officer:

Jonathan Steyn
Information Officer | CEO | CISO
Hackabby (Pty) Ltd
Company Reg. No. 2026/591759/07
Email: jonathan.steyn@hackabby.com
Mobile: +27 74 998 4213
Website: www.hackabby.com