Privacy Policy
This Privacy Policy explains how personal information is collected and used in the Electronic Permit System (the “System”), which supports electronic equipment access-control permits at Grootvlei Power Station.
The System is an internal Eskom tool. It is not a public website and is available only to provisioned @eskom.co.za accounts. Use is limited to authorised personnel involved in applying for, reviewing, approving, printing or auditing access-control permits at this facility.
Who is responsible
Personal information in the System is processed for Eskom’s operational purposes at Grootvlei Power Station. Day-to-day administration of user accounts is performed by the System Administrator. Formal POPIA requests are referred to Eskom’s Information Officer where required.
Information we collect
Depending on your role, the System may process:
- Account identity: Eskom email address, name, department, designation, clock / unique number, work and cell telephone numbers
- Permit application details: identification / passport number where captured on the permit, emergency contact details, equipment and visit particulars
- Workflow artefacts: digital signatures, laptop / PC declaration details, BMC Helix reference numbers, and sticker photographs uploaded for verification
- Security and audit records: successful and failed sign-in attempts, session events, administrative actions, access to permit records (view / print / export), email notification logs, and leave / acting (delegation) records where applicable
We do not collect information for marketing. Self-registration is disabled — accounts are created only by an administrator.
How we use your information
Personal information is used only to:
- Authenticate users and protect the System against abuse
- Create, route, approve, return, print and archive access-control permits
- Notify the correct roles when action is required
- Maintain an accountable audit trail for National Key Point and internal control purposes
We do not sell personal information. Information is shared only with other authorised System users who need it for the permit workflow, and with service providers strictly necessary to host or protect the System (see below).
Bot protection (Cloudflare Turnstile)
To protect the sign-in page against automated abuse, the System may use Cloudflare Turnstile. When you sign in, Turnstile may collect technical information from your browser to distinguish genuine users from bots. Your use of Turnstile is subject to Cloudflare’s Privacy Policy and the Turnstile Privacy Addendum.
Data security
Access is restricted to authorised @eskom.co.za accounts provisioned by an administrator. Connections are encrypted over HTTPS. Passwords are stored using one-way hashing. Failed sign-in attempts are rate-limited. Privileged and access events are logged for investigation and accountability.
How long we keep your information
Permit records (including identification and contact details captured on the permit) are retained for as long as they form part of the site’s access-control record, and thereafter for the period required by Eskom’s records-retention rules for National Key Point access control. Retention of those records is governed by that schedule rather than by this System alone.
Supporting operational data is kept for shorter periods, including approximately:
- Sign-in attempt logs — 7 days
- Dismissed in-app notifications — 90 days
- Expired password-reset / activation tokens — 7 days
Your rights (POPIA)
Under the Protection of Personal Information Act, 2013 (POPIA), you may request access to personal information held about you, request that it be corrected, and object to unlawful processing. Requests should be directed to the System Administrator, who will refer them to the Information Officer where required.
Contact
For questions about this policy or your information in the Electronic Permit System at Grootvlei Power Station, contact the System Administrator for this deployment.
Back to sign in