1. Who we are and how this policy applies
1Pass, operated by Astros Marketing (Pty) Ltd, provides password management and single sign-on services for small business teams. Our base is in Woodstock, Cape Town, and we support clients in Johannesburg, Pretoria, Durban, Gqeberha, Stellenbosch, Century City and nationwide through remote onboarding.
This policy applies when you use our enquiry form, request a service, participate in onboarding or training, or otherwise interact with our team. It explains how we handle personal information in a lawful and responsible manner.
2. What information we collect
We collect only the information needed to respond to enquiries, provide our services and manage client relationships. Depending on your interaction with us, this may include:
- Name, surname and contact details
- Company name, role and team information
- Enquiry details and service requirements
- Login, access and administrative information needed for setup and support
- Records of support requests, training sessions and service communications
We do not ask for more information than is reasonably required. If you choose not to provide certain details, we may not be able to complete a setup, migration or support request.
3. How we use personal information
We use personal information to deliver password management and single sign-on services, support your team and maintain accurate records. This includes setup work, permission mapping, user onboarding training, password migration, offboarding process design and quarterly access reviews.
- To assess enquiries and prepare proposals or service responses
- To configure and support your account and user access
- To carry out training, troubleshooting and ongoing support
- To meet legal, contractual and operational obligations
- To improve service delivery and internal processes
We do not use personal information for unrelated purposes without a lawful basis to do so.
4. Sharing information with authorised parties
We may share personal information with authorised personnel inside 1Pass and with trusted service providers who help us operate our services. These parties may include technical support, communication or secure storage providers that are bound by confidentiality and security requirements.
We may also disclose information where required by law, regulation, court order or a lawful request from a public authority. We do not sell personal information. Any sharing is limited to what is necessary for the purpose concerned.
5. Security measures and retention periods
We use reasonable technical and organisational safeguards to protect personal information against unauthorised access, loss, misuse or disclosure. These measures are designed to support secure handling of sensitive access information, including during remote onboarding and support work.
- Access controls for staff members on a need-to-know basis
- Secure handling of client records and setup information
- Confidentiality expectations for staff involved in support and training
- Review of access and retention practices from time to time
We keep personal information only for as long as needed for the purpose it was collected for, or for as long as law requires. Once it is no longer needed, we take reasonable steps to delete or de-identify it.
6. Your rights under POPIA
You have rights in relation to your personal information, subject to legal and contractual limits. These rights include the right to ask what information we hold, request correction or deletion where appropriate, and object to certain forms of processing.
- Request access to your personal information
- Ask for correction of inaccurate or incomplete information
- Request deletion where we are not required to retain it
- Object to processing in limited circumstances
- Withdraw consent where processing relies on consent
If you believe any information is no longer required, or if you think it has changed, please let us know so we can review the matter and respond in line with POPIA.
7. Contacting us and policy updates
Requests relating to personal information can be submitted through the enquiry form on our contact page. We may ask for enough information to verify your identity before acting on a request, especially where access credentials or account details are involved.
We may update this Privacy Policy from time to time to reflect operational, legal or security changes. The latest version will apply from the date it is published. We encourage clients and users to review it periodically, particularly where their team structure or access requirements have changed.