1. Introduction
Buffr Checkpoint is a digital visitor and access-management platform built in Namibia. This Privacy Policy explains how we collect, use, store and protect personal information about everyone whose details the platform holds: visitors, the people visitors come to see, staff who sign in to run it, people who are invited, and contacts an organisation keeps.
This policy is grounded in Namibia's data-protection direction, the Electronic Transactions Act 4 of 2019, and the principles of privacy by design and data minimisation which govern the Buffr Checkpoint architecture.
2. Controller and processor
For the records an organisation keeps about its visitors, hosts, invitees, contacts and staff, the client organisation (the bank, government office, healthcare facility or other body deploying Buffr Checkpoint) is the data controller. Buffr Checkpoint acts as the data processor for the client, processing the data only on the client's instructions and under the applicable data-protection framework.
For the account details we hold to run the service and to bill the organisation, such as the sign-in email address of an administrator and the invoice contact, Buffr Checkpoint decides why the data is used and so acts as controller of those details.
3. Data we collect
Buffr Checkpoint collects the minimum data needed for each purpose. The exact fields depend on the visitor type, the site configuration and the risk tier. About a visitor they typically include:
- Visitor name and contact reference (mobile number, stored encrypted) and, if given, an email address
- Host or department
- Purpose category (not free text by default)
- Check-in and check-out timestamps
- Capture channel (kiosk, NFC, QR, SMS, assisted)
- Verification outcome and reference (not the full credential payload)
- Device and site identifiers
- Consent or acknowledgement record where required
About a host, the platform holds a name, a contact reference and a department, stored encrypted. About a staff member who signs in, it holds an email address, sign-in and two-step records, and the role the organisation gave. About a person who is invited, it holds the reference the inviter typed, stored encrypted. About a contact record an organisation keeps, it holds a name, email address and mobile number, stored encrypted. Every message we send is queued with its recipient address and subject until it is cleared.
During an emergency the platform also records, for each person on the list, whether a coordinator marked them safe, in need of help or not found, with the time and the coordinator.
National ID numbers, photos, health information and biometric data are disabled by default and need documented compliance approval before activation.
4. How we use data
Data is used to manage visitor access, notify hosts, keep audit trails, meet retention and compliance obligations, run and secure the service, and bill the organisation. We do not use visitor data for marketing, profiling or any purpose unrelated to visitor management.
If an emergency is declared at a site, the platform sends the site's assembly point instructions by email to the visitors on site who gave an address, to the hosts at the site and to the staff accounts of the organisation. This message is a safety message and is not switched off by a notification preference. Security and verification emails, and the receipt of a visit when an address was given, are also always sent.
5. Data retention and deletion
Retention is automatic. Unless an organisation sets a different period, visit records are removed 365 days after check-out. A record under a legal hold is kept until the hold ends. The addresses, mobile numbers and text of queued emails and text messages are cleared 30 days after delivery. You do not have to configure any of this.
A privacy request names a person by email address or mobile number and covers the person in every role the platform holds them in: as a visitor, as a host, as a staff user, as an invitee, as a contact record, and as the recipient of messages. The client's Compliance or Audit Officer verifies the requester's identity and authority before the request is carried out. Checkpoint starts the one-month deadline for each request and shows what is due and what is late.
An export gives the person their data in a readable form, with one section for each role. An erasure clears the personal details in each role: visits are disposed of, a host profile keeps its row so past visits still point somewhere but loses its name and contact, invitations lose their reference, and contact records are replaced. Records the organisation is required to keep, such as billing records and the audit trail, are retained and restricted, and the closing notice says so. A legal hold stops an erasure and changes nothing. Every action is logged as an auditable event.
6. Data security
Buffr Checkpoint implements encryption in transit (TLS) and at rest (database, object store, device cache, backups). Role-based access control runs at the data and API layer, with tenant and site scoping on every query. New passwords are checked against lists of known breaches without sending the password: only five characters of a one-way digest leave our server.
Audit events are written for every sensitive read, export, correction and deletion, forming an append-only, hash-linked chain which supports evidence packs for regulators and auditors.
7. Subprocessors
These providers process data for us. Only those marked as handling visitor data receive it.
- Neon: Database and encrypted document storage. Frankfurt, Germany. Receives visitor data.
- Railway: Application server (API). Amsterdam, Netherlands. Receives visitor data.
- Vercel: Website, admin and ops console hosting, and the relay submitting service email to the mailbox. Global edge network. Receives visitor data.
- Namecheap Private Email: Sending service email. Not confirmed. Receives visitor data.
- BulkSMS Namibia: Text messages, only for organisations which switch them on. Not confirmed. Receives visitor data.
- Adumo Online: Card payment page for subscription invoices, no visitor data. Not confirmed. Does not receive visitor data.
- Sentry: Error reports, scrubbed of personal data. Not confirmed. Does not receive visitor data.
- Cloudflare: Bot check (Turnstile) on sign-up, sign-in, password reset and the contact form, no visitor data. Global edge network. Does not receive visitor data.
- PostHog: Product analytics after consent, codes and counts only. United States. Does not receive visitor data.
- Have I Been Pwned: Breached-password check, five digest characters only. Global edge network. Does not receive visitor data.
Visitor data is stored and processed in Germany and the Netherlands, outside Namibia. Email, text messages and some supporting services run elsewhere, and the list below gives each provider's location where we have confirmed it. Where the draft Namibian Data Protection Bill applies, we document the safeguards for the transfer and keep this list current. We do not claim the data is hosted in Namibia.
A current list is kept in the client contract and updated before a new provider is used.
8. Cookies
The Buffr Checkpoint website uses essential cookies for session management and theme preferences. Product analytics (PostHog, United States) loads only after you accept the cookie banner. Crash reporting (Sentry) sends error diagnostics with names, email addresses, phone numbers, identity numbers and page query strings removed, and records no screen sessions. The admin application uses a session cookie strictly necessary for authentication, and admin analytics cookies also need explicit consent.
9. Your rights
Everyone whose details are held, whether as a visitor, a host, a staff member, an invitee or a contact, has the right to ask for access to, correction of, or deletion of their personal data. Direct the request to the client organisation (the data controller), which carries it out through the privacy request workflow Checkpoint provides. For account and billing details we hold as controller, write to us at the address below.
10. Contact
For privacy-related enquiries, please contact us at team@buffranalytics.com or through our contact page.
