POPIA Compliance

Responsible party

IEOSUIA, 26 Rock Alder, Naturena, Johannesburg, 2095, South Africa.

1. What is POPIA?

The Protection of Personal Information Act (POPIA) is South Africa's data protection law that came into full effect on 1 July 2021. It regulates how organisations collect, store, process, and share personal information. POPIA gives data subjects (individuals) specific rights regarding their personal information and places obligations on responsible parties (organisations) to protect this information.

2. Key Definitions Under POPIA

3. The Eight Conditions for Lawful Processing

POPIA establishes eight conditions that we adhere to when processing your personal information:

4. Your Rights Under POPIA

As a data subject, you have the following rights:

• Right to Access: Request confirmation of what personal information we hold about you
• Right to Correction: Request correction of inaccurate or incomplete personal information
• Right to Deletion: Request deletion of your personal information in certain circumstances
• Right to Object: Object to the processing of your personal information for direct marketing
• Right to Withdraw Consent: Withdraw consent previously given for processing
• Right to Lodge a Complaint: Lodge a complaint with the Information Regulator
• Right to be Informed: Be informed of the collection and use of your personal information

5. How We Protect Your Information

We implement comprehensive security measures to protect your personal information:

• Encryption of data in transit and at rest using industry-standard protocols
• Secure authentication mechanisms including multi-factor authentication options
• Regular security assessments and vulnerability testing
• Access controls limiting who can view and process personal information
• Employee training on data protection and security practices
• Incident response procedures for potential data breaches
• Secure data centres with physical access controls

6. SMS and Direct Marketing Compliance

As an SMS messaging platform, we have specific obligations under POPIA regarding direct marketing:

• Consent Required: Direct marketing via SMS requires prior consent from recipients
• Opt-Out Mechanism: All marketing messages must include an easy opt-out option
• Opt-Out Honour: Opt-out requests must be processed promptly
• Record Keeping: Maintain records of consent and opt-out requests
• Existing Customers: You may contact existing customers about similar products/services

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. When personal information is no longer needed, we securely destroy or de-identify it. Specific retention periods include:

• Account information: Duration of account plus 5 years
• Transaction records: 7 years as required by tax legislation
• Message logs: 90 days for delivery reporting purposes
• Opt-out records: Indefinitely to ensure compliance

8. Cross-Border Data Transfers

In some cases, your personal information may be transferred to countries outside South Africa for processing (e.g., cloud hosting services). When this occurs, we ensure that:

• The recipient country has adequate data protection laws, or
• We have binding agreements with the recipient ensuring POPIA-level protection, or
• You have provided consent for the transfer

9. Information Officer

Our designated Information Officer is responsible for ensuring compliance with POPIA and handling requests related to personal information:

10. Lodging a Complaint

If you believe that we have not complied with POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

11. Related Policies

For more detailed information about how we handle your data, please also review:

• Privacy Policy - Detailed information about data collection and use
• Terms of Service - Terms and conditions of using our service
• Cookie Policy - Information about cookies and tracking technologies