POPIA Notice

Draft for review. POPIA compliance is non-negotiable for this business, so this page in particular must be reviewed by a legal professional, and every placeholder in [brackets] completed and every contact detail confirmed, before it is published. Remove this notice once the review is done.

Last updated: [date to be set on publication]

This notice explains how SymplTorque processes personal information in line with the Protection of Personal Information Act, 2013 (POPIA). It should be read together with our Privacy Policy. Words like "personal information", "processing", "responsible party", "operator" and "data subject" have the meanings given to them in POPIA.

Who is responsible

The responsible party is itndesign (Pty) Ltd t/a SymplTorque (registration number 2013/154587/07), 1st Floor, Block B, North Park, Black River Park, 2 Fir Street, Observatory, Cape Town, Western Cape, South Africa, 7925. Our Information Officer is still to be appointed; in the meantime you can contact us about POPIA at connect@sympltorque.co.za. [Appoint and register an Information Officer with the Information Regulator before publishing, and insert their details here.]

The two roles we play

SymplTorque processes personal information in two distinct roles:

As responsible party for the personal information of the workshops and people who hold or use a SymplTorque account: your name, contact details, business details, billing information and how you use the Service.
As operator for the personal information that a workshop loads into the Service about its own customers, such as vehicle owners. In that case the workshop is the responsible party and we process the information only on the workshop's instructions, to provide the Service. Workshops are responsible for having a lawful basis to collect that information and for meeting their own POPIA obligations towards their customers.

The personal information we process

Depending on the role above, this may include:

Names, contact details (email, phone, WhatsApp) and roles.
Business details and, for account holders, billing information.
For workshop customers loaded into the Service: names, contact details, vehicle details, service and job history, photographs, and signatures captured for authorisations.
Usage, device and log information needed to run and secure the Service.

Why we process it, and our lawful basis

We process personal information to provide, secure, support and improve the Service, to bill and keep lawful records, to communicate with you, and to comply with our legal obligations. We rely on one or more of the grounds for lawful processing in POPIA: your consent, the performance of a contract, compliance with a legal obligation, the protection of a legitimate interest, or a legitimate interest pursued by us or a third party. We process personal information in line with POPIA's conditions for lawful processing, including collecting it for a specific purpose, keeping it accurate, and not keeping it longer than necessary. [Confirm the mapping of purposes to lawful grounds with your reviewer.]

How we collect it

We collect account-holder information directly from you when you enquire, join our community, or use the Service. Information about a workshop's customers is provided to us by the workshop when it uses the Service. Some usage information is collected automatically.

Operators and sharing

We use operators to help us provide the Service, under written agreements that require them to protect personal information and process it only on our instructions. These include Amazon Web Services (AWS, Cape Town Region) for hosting, BulkSMS for SMS, and Yoco for payments. We share personal information only as described in our Privacy Policy, and we do not sell it.

Security safeguards

We take reasonable technical and organisational measures to secure personal information against loss, damage, and unauthorised access or processing, as required by POPIA. If a security compromise affecting personal information occurs, we will notify the Information Regulator and affected data subjects as POPIA requires.

How long we keep it

We keep personal information for as long as necessary for the purposes above, or for as long as the law requires. Tax records are kept for seven years, and we retain data on our systems for up to ten years under our data-retention policy. We aim not to keep personal information longer than necessary for the purpose it was collected. [Confirm the ten-year retention policy against POPIA's minimisation principle with your attorney.] Details are in our Privacy Policy.

Sending information outside South Africa

Your information is hosted in South Africa, in the Amazon Web Services Cape Town Region. If any personal information is processed outside South Africa by a service provider, we do so only where POPIA permits, such as where the recipient is subject to laws or agreements that provide an adequate level of protection. [Confirm whether any sub-processor processes personal information outside South Africa, and the transfer safeguard relied on.]

Your rights

As a data subject, POPIA gives you the right to:

Be told that we are collecting your personal information, and be told if it has been accessed by an unauthorised person.
Ask what personal information we hold about you, and to be given access to it.
Ask us to correct, update, or delete personal information that is inaccurate, out of date, excessive, or held without a lawful basis.
Object, on reasonable grounds, to the processing of your personal information.
Object at any time to the use of your personal information for direct marketing.
Not be subject to a decision that affects you significantly and is based solely on the automated processing of your information.
Complain to the Information Regulator, and to approach a court, if you believe your rights have been infringed.

How to exercise your rights

To exercise any of these rights, contact us at connect@sympltorque.co.za. We may need to verify your identity before we act on a request. If we hold information as an operator on behalf of a workshop, we will refer your request to that workshop as the responsible party. Access requests are handled in line with the Promotion of Access to Information Act (PAIA); our PAIA manual is available on request. [Confirm PAIA manual availability with your reviewer.]

Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you can complain to the Information Regulator (South Africa). [Confirm the current contact details below on inforegulator.org.za before publishing.]

Website: inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Telephone: 010 023 5200

Changes to this notice

We may update this notice from time to time. The current version will always be on this page, with the "last updated" date shown above.

Contact us

For any POPIA question, contact us at connect@sympltorque.co.za.