Privacy Policy
Last updated: September 30, 2026
1. Introduction and who we are
Upstream Technology respects your privacy and processes personal information lawfully, fairly and transparently. This Privacy and Cookie Policy explains what personal information we collect through upstream-technology.com (the “Website”), why we collect it, how we use and protect it, who we share it with, and the rights you have.
The Website is operated by Upstream Technology South Africa (Pty) Ltd, a mining technology solutions company within the De Beers Group (“Upstream Technology”, “we”, “us” or “our”). For the purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), we are the responsible party. Where the EU or UK General Data Protection Regulation (“GDPR”) applies, we are the controller.
| Detail | Information |
|---|---|
| Registered name | Upstream Technology South Africa (Pty) Ltd |
| Head office | DBM Gardens, Golf Park 2, Raapenberg Road, Pinelands, Cape Town, 7405, South Africa |
| Johannesburg facility | West Campus, Cnr Crownwood & Booysens Reserve Roads, Theta, Johannesburg, 2013, South Africa |
| up***********@**********up.com | |
| Telephone | +27 21 658 3229 |
| Website | https://upstream-technology.com |
1.1 Scope
This policy applies to personal information collected through the Website, including its contact and enquiry forms, and to information collected automatically when you browse it. It applies to visitors, prospective and existing clients, suppliers and anyone who contacts us through the Website.
It does not apply to third-party websites we link to, such as the De Beers Group website, which have their own privacy policies. Personal information of our employees, and information processed under a signed client contract, is governed by separate notices and agreements.
1.2 Acceptance
By using the Website or submitting a form, you acknowledge that you have read this policy. Where we rely on your consent (for example, for analytics cookies), we ask for it separately and you may withdraw it at any time.
2. Legal framework and definitions
We process personal information in line with POPIA and its regulations, the Electronic Communications and Transactions Act 25 of 2002 and the Consumer Protection Act 68 of 2008, where applicable. Where you are located in the European Economic Area or the United Kingdom, we also apply the principles of the GDPR and UK GDPR to that processing.
| Term | Meaning in this policy |
|---|---|
| Personal information | Any information relating to an identifiable, living natural person and, under POPIA, an identifiable existing juristic person (for example, a company). |
| Processing | Any operation on personal information, including collecting, recording, storing, using, sharing, updating or destroying it. |
| Data subject | The person (or company) to whom the personal information relates. You, when you use the Website. |
| Responsible party / controller | The party that decides why and how personal information is processed. Upstream Technology. |
| Operator / processor | A party that processes personal information on our behalf under contract, such as our hosting or analytics providers. |
| Cookie | A small text file stored on your device by a website, used to remember information about your visit. Similar technologies include local storage, pixels and scripts. |
| Special personal information | Information about religion, race, health, biometrics, political persuasion, sex life, trade union membership or criminal behaviour. We do not request or knowingly collect it through the Website. |
3. Personal information we collect
We collect only what we need to respond to you, run the Website securely and understand how it is used. We collect it in three ways: information you give us, information collected automatically, and information from third parties.
3.1 Information you give us (contact and enquiry forms)
Our forms are built with Forminator Pro. When you submit a form, we collect:
| Field | Required | Purpose |
|---|---|---|
| First name and last name (full name) | First name required | To identify and address you |
| Company | Required | To understand which organisation the enquiry relates to |
| Email address | Required | To reply to your enquiry |
| Phone number | Optional | To call you back where that is quicker or you prefer it |
| Reason for contact | Required | To route your enquiry to the right team |
| Message | Optional | To understand your request |
We also record the date and time of submission and, for security and spam prevention, may record your IP address and browser details with the entry. Forms use hidden anti-spam fields (a “honeypot”) that are not visible to people and should be left blank.
Please do not include special personal information or confidential third-party information in the message field.
3.2 Information collected automatically
When you visit the Website, our server, plugins and analytics tools automatically collect technical information, including:
- IP address (Google Analytics does not log or store full IP addresses for users in the EU, and we do not use it to identify you)
- Browser type and version, device type, operating system and screen resolution
- Pages viewed, time on page, links clicked, files downloaded (such as brochures and PDFs) and the page that referred you
- Approximate location (country or city) derived from your IP address
- Date and time of access, and server and security logs, including failed login attempts and suspicious requests
See section 6 (Cookie Policy) for the cookies and similar technologies used.
3.3 Comments
The Website does not currently offer public comments. If comments are enabled in future, we will collect the data shown in the comment form, your IP address and browser user agent string to help with spam detection. An anonymised string created from your email address (a “hash”) may be sent to the Gravatar service to check whether you use it. After approval, your profile picture and comment become visible to the public.
3.4 Media
We do not accept uploads from visitors. Website administrators who upload images should avoid images with embedded location data (EXIF GPS), because visitors can download and extract that data.
3.5 Information from third parties
We may receive aggregated, non-identifying reports from Google Analytics and Google Search Console (through Site Kit), and security threat data from WPMU DEV Defender. We do not buy personal information or combine it with data from data brokers.
4. How we use your information and our lawful basis
We use personal information only for the specific, explicitly defined purposes below, and we do not process it in a way that is incompatible with those purposes (POPIA sections 13 and 15).
| Purpose | Information used | Lawful basis (POPIA s11 / GDPR Art. 6) |
|---|---|---|
| Responding to enquiries and requests for information, quotes or technical support | Form data | Steps at your request before entering a contract; our legitimate interest in responding to business enquiries |
| Managing an existing client or supplier relationship | Form data, correspondence | Performance of a contract |
| Routing your enquiry to the correct division or De Beers Group company | Form data | Legitimate interest |
| Understanding how the Website is used and improving content and performance | Analytics and cookie data | Consent (analytics cookies) |
| Keeping the Website and our systems secure, preventing spam, fraud and abuse | IP address, logs, security data | Legitimate interest; legal obligation |
| Backing up the Website so it can be restored after an incident | All Website data, including form entries | Legitimate interest |
| Sending you information about our products and services | Name, company, email | Consent, or existing client relationship (POPIA s69) |
| Complying with law, regulators, court orders and enforcing our rights | Any relevant information | Legal obligation; legitimate interest |
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. We do not sell your personal information.
5. Third-party services and WordPress plugins
The Website runs on WordPress and uses the plugins and services below. Some run entirely on our server; others send data to the provider, which then acts as our operator (processor) or, in Google’s case for certain purposes, an independent controller.
| Service / plugin | Provider | What it does | Personal information involved | Data leaves our server? |
|---|---|---|---|---|
| WordPress core | WordPress.org (open source) | Content management system | Admin login data; comment data if enabled | No |
| Elementor | Elementor Ltd (Israel) | Page builder and site design | Browsing data via local storage; loads Google Fonts | Fonts are requested from Google servers |
| Crocoblock JetEngine and JetSmartFilters | Crocoblock (Ukraine) | Custom content listings and filtering | Filter selections in the URL or session | No |
| Rank Math SEO | Rank Math (MyThemeShop) | Search engine optimisation, sitemaps, redirects, 404 monitoring | Requested URLs and, if 404 logging is enabled, IP and user agent | No |
| Site Kit by Google | Google LLC | Connects the Website to Google Analytics and Search Console | Analytics identifiers | Yes, to Google |
| Google Analytics 4 | Google LLC / Google Ireland Ltd | Visitor statistics | Cookie IDs, truncated IP, device and usage data | Yes, to Google (USA and elsewhere) |
| Google Maps (embedded on Contact page) | Google LLC | Shows our office locations | IP address, browser data; Google may set cookies | Yes, to Google |
| Google Fonts | Google LLC | Typography | IP address and browser data when fonts load | Yes, to Google |
| WPMU DEV Dashboard | Incsub LLC (USA) | Manages and updates WPMU DEV plugins | Site and admin account data | Yes, to WPMU DEV |
| Forminator Pro | Incsub LLC (WPMU DEV) | Contact and enquiry forms | Form fields, submission time, IP | Stored in our WordPress database; email notifications sent to our team |
| Defender Pro | Incsub LLC (WPMU DEV) | Security: firewall, malware scanning, login protection, IP lockouts, audit logging | IP address, user agent, login attempts, requested URLs | Audit logs and threat data may be stored with WPMU DEV |
| Hummingbird Pro | Incsub LLC (WPMU DEV) | Performance, caching and CDN | IP address when assets are served from the WPMU DEV CDN | Yes, if CDN is enabled |
| Smush Pro | Incsub LLC (WPMU DEV) | Image compression and optimisation, image CDN | Images uploaded by admins; visitor IP when images are served by CDN | Yes, images processed and served by WPMU DEV |
| Snapshot Pro | Incsub LLC (WPMU DEV) | Website backups | Full copy of the site, including form entries and user data | Yes, encrypted backups stored in WPMU DEV cloud storage |
| Branda Pro | Incsub LLC (WPMU DEV) | Admin branding, login screen and cookie notice | Consent preference | No |
WPMU DEV’s privacy policy is available at wpmudev.com/privacy-policy. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites. Elementor, Crocoblock and Rank Math publish their own privacy policies on their websites.
5.1 Embedded content from other websites
Pages on this Website may include embedded content, such as Google Maps and downloadable documents. Embedded content from other websites behaves as if you had visited that website directly. Those websites may collect data about you, use cookies, embed additional tracking and monitor your interaction with the embedded content, including if you are logged in to an account with them.
5.2 Google Analytics
We use Google Analytics 4, connected through Site Kit, to understand how visitors use the Website. Analytics runs only after you accept analytics cookies. We have:
- Enabled Google’s data-processing terms and, where applicable, Standard Contractual Clauses
- Disabled Google Signals and advertising features
- Set data retention to 14 months
You can opt out of Google Analytics on all websites by installing the Google Analytics Opt-out Browser Add-on.
6. Cookie Policy
We use strictly necessary cookies to run the Website and, only with your consent, analytics cookies to understand how it is used. We do not use advertising or retargeting cookies.
6.1 What cookies are
Cookies are small text files placed on your device when you visit a website. They let the site remember your actions and preferences for a period of time. First-party cookies are set by upstream-technology.com; third-party cookies are set by other domains, such as google.com. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them.
6.2 Categories we use
| Category | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary | Security, login, form submission, load balancing and remembering your cookie choice | No, the Website cannot work properly without them |
| Functional | Remembering preferences and enabling embedded content such as maps | Yes |
| Analytics | Measuring visits and usage through Google Analytics | Yes |
| Marketing | Not used | Not applicable |
6.3 Cookies and similar technologies on this Website
| Cookie / technology | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
| Cookie notice consent cookie | Branda Pro (upstream-technology.com) | Strictly necessary | Stores your cookie consent choice | Up to 12 months |
| wordpress_test_cookie | WordPress | Strictly necessary | Checks whether your browser accepts cookies (login page) | Session |
| wordpress_[hash], wordpress_logged_in_[hash] | WordPress | Strictly necessary | Authenticates logged-in administrators | Session, or 14 days if “Remember me” is ticked |
| wp-settings-[UID], wp-settings-time-[UID] | WordPress | Functional | Stores admin dashboard preferences | 1 year |
| comment_author_[hash], comment_author_email_[hash], comment_author_url_[hash] | WordPress | Functional | Remembers your details if you leave a comment (only if comments are enabled) | 1 year |
| Defender security cookies | Defender Pro | Strictly necessary | Login protection, two-factor authentication and lockout handling for administrators | Session to 30 days |
| Elementor local storage (e.g. elementor) | Elementor | Strictly necessary | Stores page-builder and popup display state in your browser | Persistent until cleared |
| _ga | Google Analytics | Analytics | Distinguishes unique visitors | 2 years |
| _ga_[container-id] | Google Analytics | Analytics | Maintains session state | 2 years |
| NID, AEC, SOCS and similar | Google (Maps, google.com) | Functional | Set by Google when the embedded map loads; used for preferences and security | Up to 13 months |
Cookie names and durations may change when providers update their software. We review this list periodically; the list shown in the cookie banner is the most current.
6.4 Managing cookies
- Cookie banner: when you first visit, you can accept or reject non-essential cookies. You can change your choice at any time using the cookie settings link in the Website footer.
- Browser settings: you can block or delete cookies in your browser. Guidance is available for Chrome, Safari, Firefox and Edge.
- Google Analytics opt-out: see section 5.2.
Blocking strictly necessary cookies may stop parts of the Website, such as forms, from working.
7. Sharing, transfers, retention and security
7.1 Who we share your data with
We share personal information only where necessary, and only with:
- De Beers Group companies, where your enquiry relates to their products, services or operations, or for shared IT, security and compliance functions
- Operators (service providers) listed in section 5, including our hosting provider, WPMU DEV and Google, under written agreements that require them to keep the information confidential and secure (POPIA section 21)
- Our web development and maintenance agency, which may access the Website and its database to maintain, update and secure it
- Professional advisers, such as auditors and legal counsel, under a duty of confidentiality
- Regulators, law enforcement or courts, where the law requires it or to protect our rights, property or safety
- A buyer or successor, if our business or part of it is sold or restructured, subject to this policy
7.2 Where your data is sent (cross-border transfers)
Some of our providers, including Google and WPMU DEV, store or process data outside South Africa, mainly in the United States and the European Union. We transfer personal information across borders only as permitted by POPIA section 72, for example where the recipient is bound by law, binding corporate rules or an agreement providing adequate protection (such as Standard Contractual Clauses), or where the transfer is needed to respond to your request.
7.3 How long we keep your data
We keep personal information only as long as needed for the purpose it was collected, or as required by law (POPIA section 14).
| Information | Retention period |
|---|---|
| Form submissions in the Website database | 24 months after submission, then deleted, unless the enquiry becomes a client relationship |
| Enquiries forwarded to our email and CRM | For the duration of the business relationship plus the period required by law (generally 5 years for commercial records) |
| Google Analytics data | 14 months |
| Security logs and IP lockouts (Defender) | Up to 12 months |
| Website backups (Snapshot) | Rolling backups, overwritten within 90 days |
| Comments (if enabled) and their metadata | Indefinitely, so follow-up comments can be approved automatically |
| Registered user accounts (administrators) | While the account is active; users can see, edit or delete their profile information at any time (except their username) |
When retention ends, we delete or de-identify the information securely.
7.4 How we protect your data
We take appropriate, reasonable technical and organisational measures to prevent loss, damage, unauthorised destruction and unlawful access (POPIA section 19), including:
- HTTPS (TLS) encryption across the Website
- Firewall, malware scanning, login protection, two-factor authentication and IP lockouts through Defender Pro
- Encrypted, off-site backups through Snapshot Pro
- Restricted administrator access on a need-to-know basis, with strong passwords and audit logging
- Regular updates to WordPress core, themes and plugins
No internet transmission is completely secure. If we become aware of a security compromise affecting your personal information, we will notify the Information Regulator and you as required by POPIA section 22.
8. Your rights
Under POPIA (and the GDPR where it applies) you have the right to:
- Be informed that your personal information is being collected
- Access the personal information we hold about you and request details of who has received it
- Correct or update inaccurate, incomplete or out-of-date information
- Delete or destroy information we are no longer authorised to keep
- Object to processing based on legitimate interest, and to direct marketing at any time
- Withdraw consent where we rely on it (for example, analytics cookies), without affecting earlier processing
- Data portability and restriction of processing (GDPR)
- Not be subject to decisions based solely on automated processing
- Lodge a complaint with the Information Regulator or your local supervisory authority
To exercise a right, contact our Information Officer using the details in section 11. We may ask you to verify your identity. Access requests are handled under our PAIA Manual using Form 2 of the POPIA Regulations; we respond within 30 days. You can also request an exported file of the personal data we hold about you, including data you provided through the Website, and request that we erase it. This does not include data we must keep for administrative, legal or security purposes.
9. Children’s information
The Website is intended for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us personal information, contact us and we will delete it.
10. Direct marketing
We send electronic marketing only to existing clients about similar products and services, or to people who have given consent (POPIA section 69). Submitting an enquiry form does not sign you up for marketing. Every marketing message includes a free way to unsubscribe.
11. Information Officer and complaints
Questions, requests or complaints about this policy or your personal information can be sent to:
- Attention: Information Officer
- Email: up***********@**********up.com
- Telephone: +27 21 658 3229
- Address: DBM Gardens, Golf Park 2, Raapenberg Road, Pinelands, Cape Town, 7405
If you are not satisfied with our response, you may complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Complaints email: PO*************@***************rg.za
- General enquiries: en*******@***************rg.za
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
12. Links to other websites
The Website links to third-party websites, including the De Beers Group website and downloadable documents hosted elsewhere. We are not responsible for their privacy practices and encourage you to read their privacy policies.
13. Changes to this policy
We may update this policy to reflect changes in law, our practices or the plugins and services we use. The updated version will be posted on this page with a new “Last updated” date. Where changes are significant, we will highlight them on the Website.
14. Contact us
Upstream Technology South Africa (Pty) Ltd
- Address: DBM Gardens, Golf Park 2, Raapenberg Road, Pinelands, Cape Town, 7405, South Africa
- Email: up***********@**********up.com
- Telephone: +27 21 658 3229