Contents
1. Who we are
Citadel Suite (CitadelGate, CitadelFrame, CitadelLite and CitadelPen) is developed by Kemptechnology (PTY) Ltd, a South African company ("we", "us"). We are the responsible party for personal information collected through this website and our accounts. When a business uses CitadelGate to manage its devices, that business is the responsible party for its users' and devices' information and we process it on its behalf as an operator.
2. What we collect and why
| Information | When | Why |
|---|---|---|
| Name, email, and optionally company, phone, role, number of devices and your message | When you use a form on this site (contact, early access, waiting lists) | To reply to you and to send the product updates you asked for |
| IP address, date and time, page requested, browser type and referring page | Every visit, in our web server logs | Security, preventing abuse and fixing errors |
| Email address, display name, sign-in provider (Microsoft or Google), password hash and multi-factor authentication settings | When you have a Citadel or CitadelGate account | To sign you in securely and run your account |
| Device inventory and health data, tickets, comments, remote-session records and audit logs | When your organisation uses CitadelGate | To provide the IT management service your organisation signed up for |
| Transaction records (amount, date, plan) | When paid products launch | Billing, tax and legal records. Card details are handled by our payment provider and never stored by us |
CitadelLite Free Anti-Virus works on your computer and sends no scan results, files or usage data to us by default. If you choose to connect it to an IT provider's CitadelGate, its security status is shared with that provider.
AI features in CitadelGate. When a technician asks the CitadelGate AI operator to investigate an issue, the ticket text and the device information needed for the diagnosis (such as service states, disk space, event log entries and installed software) are sent to our AI provider, OpenAI, for analysis. File contents are not sent. The results are stored in your organisation's CitadelGate account.
We only process personal information for these purposes, with your consent where we ask for it, to perform a contract with you or your organisation, to meet legal obligations, or for our legitimate interest in keeping our services secure.
3. Cookies and tracking
The public pages of citadelframe.com set no cookies and use no analytics, advertising or tracking scripts. Signing in to an account or the CitadelGate portal uses essential cookies to keep you signed in and protect forms; these are removed when you sign out or they expire.
4. Who we share it with
We do not sell or rent personal information. We share it only with service providers who help us run Citadel, under confidentiality and security obligations:
- our hosting and email providers, to run the website, portal and email;
- Microsoft or Google, if you choose to sign in with them (only sign-in information is exchanged);
- OpenAI, for CitadelGate AI investigations as described above;
- our payment provider, once paid products launch;
- authorities, where the law requires it.
Some of these providers process information outside South Africa. Where that happens, we only use providers bound by laws, binding agreements or corporate rules that give protection substantially similar to POPIA, as section 72 of POPIA requires.
5. How long we keep it
- Form submissions: up to 12 months, then deleted automatically, unless they lead to an ongoing customer relationship.
- Web server logs: 14 days.
- Account information: while your account is active, then deleted on request or when the account is closed.
- CitadelGate customer data: as agreed with the customer organisation.
- Financial records: as long as tax law requires.
6. How we protect it
All traffic to our sites is encrypted with HTTPS. Access to customer data is restricted by role, CitadelGate staff access requires multi-factor authentication, client organisations are kept separate, and administrative actions are logged. We take regular backups and keep them access-restricted. No system is perfectly secure; if a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.
7. Your rights
Under POPIA you may ask us to confirm whether we hold personal information about you and request a copy; correct or delete it; object to its processing; and withdraw consent you have given. Send your request through our contact form starting your message with "Privacy", and our Information Officer will respond. We may need to verify your identity first.
If you are unhappy with how we handled your information, you may complain to the Information Regulator of South Africa at inforegulator.org.za.
8. Children
Our services are intended for adults and businesses. We do not knowingly collect personal information from children under 18 without the consent of a parent or guardian.
9. Changes and contact
We will update this policy when our services or the law change, and change the date at the top. Material changes affecting account holders will be communicated by email or on the site. Questions: use our contact form.