← Back to Map

Privacy Policy

AEDNEARME NPC

concerning

POPIA COMPLIANCE

AEDNEARME NPC - PRIVACY POLICY

This Privacy Policy explains how AEDNearMe NPC ("AEDNearMe")processes personal information and AED location data in South Africa in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"). The short answer is that AEDNearMe processes submitter details and AED location data to publish a public-interest AED map, relying on consent from submitters and the legitimate interests ground under section 11 of POPIA, while applying minimality, security safeguards, and robust opt‑out, correction and deletion rights, all in line with POPIA’s eight conditions for lawful processing.

Who we are and how to contact us

AEDNearMe is a public‑interest initiative operated by a group of medical students based at Tygerberg Campus that maps publicly accessible Automated External Defibrillators (AEDs) to help bystanders locate AEDs during a sudden cardiac arrest.

For all POPIA and access-to-information matters, the responsible party and point of contact is the Information Officer identified below -

  • Information Officer: Benrico Krog
  • Email: [email protected]
  • Postal and Physical address: 18 Gabbro Crescent, Boskloof Eco Estate, Somerset West, 7130

AEDNearMe will designate and register its Information Officer with the Information Regulator through the eServices Portal before commencing duties, as contemplated by POPIA.

You may also contact the Information Regulator (South Africa.

What information we collect via the AED registration form

AEDNearMe collects information voluntarily submitted through the online registration form at https://aednearme.co.za/register by AED owners, businesses, or members of the public who wish to register an AED’s location

The categories of personal information we may collect include the submitter’s name, role or relationship to the AED, contact details such as email address and telephone number, and the name of a business or organisation if applicable.

The AED entry may include AED location data such as the street address, building name, floor or area description, typical accessibility hours, and any instructions necessary for members of the public to find and use the AED safely, which may constitute personal information if linked to an identifiable person or small business contact.

Where the registration concerns AEDs located on private premises or belonging to private owners or businesses, AEDNearMe treats the combination of AED location and owner contact details as personal information, and applies POPIA’s processing limitation, purpose specification, minimality, openness, and security safeguards conditions in full.

Lawful bases for processing

AEDNearMe processes personal information only where one of the lawful grounds in section 11 of POPIA applies.

First, where a submitter provides details and ticks a clear consent statement on the registration form to allow publication of the AED location on the public map and for AEDNearMe to contact them about the listing, we rely on consent under section 11(1)(a), recognising that consent must be voluntary, specific and informed, is revocable at any time, and that we bear the burden of proving it.

Second, independent of consent, we may rely on the legitimate interests ground in section 11(1)(f) to process and publish minimal AED location data that is necessary to run a public‑interest safety map, provided a documented balancing shows the processing is necessary and does not override the rights of affected persons, and subject to the right to object in section 11(3).

Third, where further processing is required to ensure public‑facing accuracy and safety notices, AEDNearMe assesses compatibility under section 15, recognising that further processing may be compatible where necessary to mitigate a serious or imminent threat to public health or safety.

POPIA does not create a hierarchy between these grounds, and consent is not preferred over other available grounds; AEDNearMe will choose and document the most appropriate basis per purpose and will honour objections where processing relies on legitimate interests.

Purpose of processing and how we use the information

AEDNearMe uses submitter details to validate, create, update, and administer the AED entry, to contact the submitter for verification or maintenance of the listing, and to action data subject rights requests, including takedown or correction.

AEDNearMe publishes the AED’s general location and essential access instructions on the public map so that any bystander can locate and use an AED in an emergency, applying the minimality and purpose‑specification conditions in sections 13 and 10 of POPIA.

Where necessary to preserve safety and privacy, AEDNearMe will not publish names of private owners or direct contact details on the public map without explicit consent, and will avoid disclosing cabinet codes, alarm deactivation instructions, or any information that could facilitate theft or misuse.

AEDNearMe maintains internal records of submissions and updates to ensure information quality and auditability under section 16, and to enable swift correction or removal on request.

Special considerations for AEDs on private premises or owned by private persons or businesses

AEDNearMe recognises that mapping AEDs located in private buildings or linked to private owners engages heightened privacy expectations even if the primary data point is an object location.

To address this sensitivity, AEDNearMe collects only the minimum information needed to allow safe public access, verifies that the AED may be accessed by the public during stated hours or conditions, and is prepared to publish at an appropriately generalised granularity where precise disclosure would create undue risk.

AEDNearMe ensures the collection notice under section 18 explains that the AED location will be made publicly available on the map and that contact details will be used internally for validation and update purposes, with withdrawal and objection routes highlighted.

Where a private owner or occupier objects on reasonable grounds under section 11(3), AEDNearMe will promptly assess and, where justified, restrict, de‑identify, or remove the listing, while balancing the public interest in enabling time‑critical access to lifesaving equipment.

AEDNearMe also treats on‑premises signage and instructions as contextual safeguards, ensuring that map entries do not encourage trespass or unsafe access paths and that bystanders are directed to lawful points of entry or staffed areas.

Where we obtain information

AEDNearMe primarily collects AED details directly from the submitter through the registration form and follow‑up communications, consistent with section 12 of POPIA.

If necessary to verify an entry or to add AEDs that are clearly intended for public access based on publicly available information, AED Near Me may collect from other sources in accordance with section 12’s exceptions and provided that doing so would not prejudice the legitimate interests of the data subject.

Openness and notices

AEDNearMe maintains documentation of processing activities and provides clear notices at or before the point of collection that describe the identity and address of the responsible party, the purposes of collection, whether provision is voluntary, the consequences of not providing information, and intended disclosures including publication on the public map, in accordance with sections 17 and 18.

AEDNearMe's Privacy Policy and PAIA Manual are available on the website and on request, and identify how to exercise data subject participation rights and submit access requests.

Data subject rights and how to exercise them

Under sections 23 to 25 of POPIA, you have the right to request confirmation that we hold personal information about you, access a description or copy of that information, and request correction, deletion, or destruction of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained.

Where our lawful basis is legitimate interests, you may object at any time on reasonable grounds relating to your particular situation using the prescribed manner, and we will no longer process the information unless legislation permits continued processing.

Where the basis is consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal or on other section 11 grounds.

Requests and objections can be made by email to the Information Officer using the contact details in section 1; we will respond within a reasonable time and in an understandable form, and may require proof of identity as permitted under POPIA and PAIA.

You also have the right to lodge a complaint with the Information Regulator at the contact details provided in section 1 if you are dissatisfied with our response.

Sharing and publication

Publishing an AED’s location and access instructions on our public map is a deliberate onward disclosure that makes those data available to the general public to serve a public safety purpose.

We seek consent for this disclosure via the registration form and rely on legitimate interests to maintain the map where appropriate, while avoiding publication of personal contact details without explicit consent and applying data minimality.

We also use reputable service providers and operators, such as website hosts, security and email providers, and mapping platforms, under written agreements that require confidentiality and appropriate security measures as required by sections 20 and 21 of POPIA.

We do not transfer personal information outside of South Africa. Where operators or content delivery networks transfer personal information outside South Africa, we will ensure that the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection, or else rely on another permitted transfer mechanism under section 72, such as explicit consent for the transfer where appropriate.

Security safeguards

AEDNearMe secures the integrity and confidentiality of personal information by identifying reasonably foreseeable internal and external risks and implementing appropriate technical and organisational safeguards, including access controls, encryption in transit, and restricted admin privileges, verifying and updating safeguards regularly in line with sections 19 to 21.

Where an operator processes personal information on our behalf, we mandate confidentiality, security measures equivalent to those in section 19, and immediate notice of any security compromise.

If we have reasonable grounds to believe a security compromise has occurred that affects personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, describing consequences, remedial measures, and recommended steps as required by section 22.

Data retention and deletion

AEDNearMe retains personal information only for as long as necessary to achieve the purposes stated above and to maintain the accuracy and safety of the AED map, in accordance with section 14.

When the purpose has been fulfilled or the information is no longer required, or on valid objection or withdrawal of consent where no other lawful basis applies, AEDNearMe will delete or de‑identify personal information in a manner that prevents reconstruction, subject to lawful retention requirements or needs for proof.

Children’s information and special personal information

AEDNearMe does not intentionally collect children’s personal information, nor does it require special personal information as defined in sections 26 to 33 to publish AED locations; if any such information is inadvertently submitted, we will promptly assess and delete or secure it according to POPIA’s heightened protections.

Cookies and analytics

To operate the website and understand usage patterns, AEDNearMe may use low‑intrusion analytics and essential cookies; where such tools process personal information, they are operated under data minimality and opt‑out routes consistent with POPIA’s openness and processing limitation conditions.

How to contact the Information Regulator

If you wish to complain or need guidance, contact the Information Regulator (South Africa), which details are as follows -

Changes to this Privacy Policy

AEDNearMe may update this Privacy Policy from time to time to reflect changes in law or our processing; material changes will be posted on our website and dated.