Privacy Policy
Matjhabeng Local Municipality — ICT Department services.
On this page
1. Introduction
Matjhabeng Local Municipality ("the Municipality", "we", "us", "our") is committed to protecting the privacy and confidentiality of all personal information entrusted to us through the MLM ICT Service Desk portal and related ICT services.
This Privacy Policy explains how we collect, use, store, share, and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and other applicable South African legislation.
2. Responsible Party / Information Officer
Under POPIA, the Matjhabeng Local Municipality is the responsible party for the personal information processed through this portal.
| Responsible Party | Matjhabeng Local Municipality |
|---|---|
| Physical Address | 391 Stateway & Ryk Street, Welkom, Free State, 9459 |
| Information Officer | Municipal Manager (as appointed under POPIA) |
| Deputy Information Officer | Manager: ICT Department |
| privacy@matjhabeng.co.za | |
| Telephone | (057) 391-3911 |
| Regulator |
Information Regulator (South Africa) inforegulator.org.za |
3. Information We Collect
We only collect personal information that is necessary to provide ICT support services. Depending on how you interact with the portal, we may collect:
Identity & Contact Data
- Full name and surname
- Employee / staff number or municipal ID
- Department and job title
- Business email address and contact number
- Physical office location and building
Service Request Data
- Ticket titles, descriptions, and screenshots you upload
- Category and priority selections
- Comments, replies, and attachments added to tickets
- Timestamps of submissions and status changes
- Assigned technician notes and resolution details
Technical & Usage Data
- IP address and device/browser type
- Login timestamps and session identifiers
- Pages viewed within the portal
- Action logs for security and audit purposes
- Error logs and diagnostic traces (may include API calls)
4. Why We Collect Your Information
We process your personal information for the following specific purposes:
Service Delivery
To log, assign, track, and resolve your ICT support tickets (hardware, software, network, telephony, and access requests).
Communication
To notify you of ticket updates, technician assignments, resolutions, or follow-up requests.
Service Improvement
To analyse trends, identify recurring issues, and improve ICT service quality across the Municipality.
Security & Audit
To maintain system integrity, prevent misuse, and comply with municipal audit and forensic requirements.
5. Legal Basis for Processing
Under POPIA, personal information may only be processed if a lawful basis exists. For the MLM ICT Service Desk, processing is justified on the following grounds:
- Contractual / Employment obligation: To deliver ICT services to municipal employees and authorised users.
- Public law / Legal obligation: To comply with municipal record-keeping and audit requirements.
- Legitimate interest: To secure our systems, prevent fraud, and improve service delivery.
- Consent: Where you have explicitly agreed, such as for optional feedback or communications.
6. Sharing & Disclosure
We do not sell your personal information. We only disclose it to the following parties, and only when necessary:
- Internal ICT staff and technicians — to resolve your ticket.
- Other municipal departments — when your request affects services outside ICT (e.g., HR, Facilities).
- Approved service providers — third-party vendors bound by confidentiality and POPIA operator agreements.
- Law enforcement or regulators — where required by law, court order, or the Information Regulator.
- AI service providers — when you use the AI-powered ICT Assistant, your message content is sent to Google Gemini (Google LLC) for processing. Do not enter confidential, personal, or sensitive information (e.g., ID numbers, passwords, financial details) into the AI chat.
7. Data Retention
We retain personal information only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:
| Data Type | Retention Period |
|---|---|
| Support tickets & resolutions | 5 years (municipal audit requirement) |
| User account records | Duration of employment + 3 years |
| Login / access logs | 12 months rolling |
| AI chat transcripts | Session only (not stored on our servers) |
Once the retention period expires, records are securely destroyed (digitally shredded or anonymised).
8. Security Measures
We implement appropriate technical and organisational safeguards to protect your personal information from unauthorised access, loss, or alteration. These include:
- Encrypted HTTPS connections for all portal traffic
- Role-based access control (Requester, Technician, Admin, Manager, SuperAdmin)
- Password hashing and identity verification via Microsoft ASP.NET Core Identity
- Session timeouts and reauthentication for sensitive operations
- Audit logs capturing ticket status changes and privileged actions
- Regular backups and recovery procedures
- Restricted physical access to ICT server infrastructure
9. Your Rights Under POPIA
As a data subject, you have the following rights, which you may exercise by contacting the Information Officer:
Right to Access
Request a copy of the personal information we hold about you.
Right to Correction
Request correction or update of inaccurate information.
Right to Deletion
Request deletion where no legal obligation requires retention.
Right to Object
Object to processing based on legitimate interest.
Right to Complain
Lodge a complaint with the Information Regulator.
Right to Withdraw Consent
Withdraw consent where processing is based on it.
10. Cookies & System Logs
The MLM ICT Service Desk uses strictly necessary cookies and session tokens to:
- Maintain your authenticated session after login
- Protect against cross-site request forgery (CSRF)
- Remember display preferences within a session
We do not use third-party advertising or tracking cookies. Server-side logs may record IP addresses, device information, and timestamps for security auditing.
11. Minors & Authorised Users
The MLM ICT Service Desk is intended for use by municipal employees, contractors, and authorised stakeholders. It is not intended for use by minors under the age of 18 without verifiable parental or guardian consent.
12. Changes to This Policy
The Municipality reserves the right to update this Privacy Policy from time to time to reflect changes in legislation, technology, or our services. The "Last updated" date will always reflect the most recent revision. Continued use of the portal after changes are posted constitutes acceptance of the revised policy.
13. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact the ICT HelpDesk: