1. Purpose and scope
1.1. This policy sets the rules for using this website, www.nircomtechnologies.com, and any system, environment or service that NIRCOM TECHNOLOGIES (PTY) LTD builds, hosts or operates for a client (together, "our Services"). It also explains how anyone can report abuse or a security issue, and how we deal with it.
1.2. It forms part of our Terms and Conditions. Our products have their own acceptable use policies; for DDNSRegister, see its Acceptable Use and Abuse Policy.
1.3. Clients are responsible for use of systems we operate for them by their own staff, contractors and users, and for setting acceptable use rules for those users that are at least as strict as this policy.
2. What you must not do
You must not use our Services, or allow them to be used, to:
Attack or compromise systems
- distribute malware, ransomware or spyware;
- carry out or support denial-of-service attacks;
- gain unauthorised access to any computer, network or data, or scan networks you do not own without permission;
- probe, overload or interfere with this website or our systems, other than through responsible disclosure under clause 4.
Deceive or defraud people
- run phishing pages or credential-harvesting sites;
- impersonate a person, brand, bank or government body, or pretend to be Nircom;
- commit or facilitate fraud, scams or identity theft.
Misuse AI systems
- use an AI system we built or operate to produce content that is unlawful, deceptive or harmful, or that impersonates a real person without their consent;
- try to extract confidential information, credentials or other users' data from an AI system, or to bypass the controls set for it;
- feed an AI system personal information or confidential information that you do not have the right to share.
Send spam or unlawful content
- send unsolicited bulk email or messages;
- host or distribute child sexual abuse material, content inciting violence or hatred, or other content unlawful in South Africa;
- infringe copyright, trade marks or other intellectual property.
Break the law
- break any law that applies to you or us, including the Cybercrimes Act, 2020 and POPIA.
We may act on any use that breaches the spirit of this list, even if it is not named here.
3. How to report abuse
3.1. Email abuse@nircom.tech. Anyone may report, whether or not they are a client.
3.2. To help us act quickly, include:
- the website, system or address involved;
- what is happening and when you saw it (with time zone);
- evidence such as URLs, email headers, log extracts or screenshots;
- your name and contact details, so we can follow up (you may report anonymously, but we may then be unable to update you).
3.3. For rights-based complaints (trade mark, copyright, defamation), also say what right you hold and why the content infringes it.
3.4. Please report in good faith. Knowingly false reports may make you liable for any harm caused by action we take on them.
4. Reporting a security vulnerability
4.1. If you believe you have found a security vulnerability in this website or in a system we operate, email security@nircom.tech with a description, the steps to reproduce it, and its likely impact.
4.2. Please give us a reasonable time to fix it before you disclose it publicly, do not access or change data that is not yours beyond what is needed to show the issue, and do not degrade the service for others. We will acknowledge your report within 2 business days and keep you updated.
4.3. We will not take legal action against good-faith research that follows this clause.
5. How we handle reports
5.1. Every report gets a reference and is triaged by severity.
| Severity | Examples | We acknowledge within | Typical action |
|---|---|---|---|
| Critical | Active phishing, malware distribution, a live compromise, child sexual abuse material | 4 hours, every day | Contain at once (for example, take the affected system offline), then notify the client |
| High | Spam, impersonation, attacks coming from a system we operate | 1 business day | Notify the client and contain if not resolved within 24 hours |
| Standard | Intellectual property or defamation complaints, other breaches of this policy | 2 business days | Notify the client, who has 5 business days to respond before we decide |
5.2. Our steps are:
- Log the report and confirm receipt to the reporter.
- Verify the evidence.
- Contact the affected client, unless doing so would put people at risk or prejudice an investigation.
- Decide on action: no action, a warning, a fix by the client, suspension of the affected service, or ending the Engagement under our Terms and Conditions.
- Tell the reporter the outcome, where appropriate, and close the report.
5.3. We do not monitor the content of client systems. We act on reports and on alerts from the monitoring a client has asked us to run.
5.4. We keep a record of each report, the evidence and what we did for 2 years.
6. If we act on a system we operate for you
6.1. We will tell you the report reference, what we did and why, unless the law or an investigation prevents us.
6.2. You may respond with your side of the matter, or evidence that the problem is fixed, and ask us to review our action. We aim to complete a review within 3 business days.
6.3. We restore the service once the problem is resolved, unless the breach is serious or repeated, in which case our Terms and Conditions on ending an Engagement apply.
7. Requests from law enforcement and courts
7.1. Send legal requests to legal@nircom.tech or to our physical address, 1175 Augrabies Falls Boulevard, Waterfall City, Midrand, 2090, South Africa.
7.2. We disclose information only in response to a valid legal process under South African law, such as a court order, a search warrant, a subpoena, or a lawful preservation or disclosure direction under the Cybercrimes Act, 2020. Requests from foreign authorities must come through South African legal channels, such as mutual legal assistance.
7.3. Where the information belongs to a client and we hold it as their operator, we will refer the request to the client unless the law prohibits it.
7.4. We check that each request is genuine, comes from an authorised official, and is no broader than necessary. We disclose only what the request lawfully requires, and, unless the law or the request prohibits it, we tell the affected person or client so they can seek legal advice.
7.5. In an emergency involving imminent risk to life or of serious harm, we may disclose limited information voluntarily to the police, and will record why.