Privacy Policy for BizFlo users

Welcome to BizFlo's privacy notice. BizFlo respects your privacy and is committed to protecting your personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

This notice explains how we collect, use, share and safeguard personal information when you visit bizflo.co.za (the "Site"), use the BizFlo web application (the "App", together with the Site the "Platform"), and when we provide our order, customer and receipt management software to service businesses (the "Services").

This notice applies to:

• Businesses: any sneaker cleaning, car wash or laundry business, and its owners, managers or staff, that registers a workspace to use the Services.
• Users: anyone who signs in to a workspace, including owners, managers and staff members invited by a business.
• Your customers: the people whose orders, contact details and photographs a business records in BizFlo. We process that information on the business's instructions.
• Visitors: anyone browsing the Site.

We may update this notice from time to time by publishing a new version on the Site and, where a change is material, by emailing workspace owners.

Purpose of this notice

This notice gives you information about how your personal information is processed when you use the Services, including information you provide through the Site, the App or while using your workspace. The Platform is built for businesses, not for children, and we do not knowingly collect information about children.

Responsible party and operator

For information about your account, your use of the Platform and our business relationship, BizFlo is the responsible party (the controller) and decides how that information is processed.

For the customer, order, payment and photograph records a business loads into its workspace, that business is the responsible party and BizFlo acts as its operator (processor): we process that information only on the business's documented instructions, only to run the Services, and we keep it confidential.

Information Officer

Our Information Officer oversees our POPIA compliance, including requests to access or correct personal information. You can reach the Information Officer at privacy@bizflo.co.za.

Complaints

You may complain at any time to the Information Regulator (South Africa), the regulator for data protection: The Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; complaints.IR@justice.gov.za; inforegulator.org.za. We would appreciate the chance to resolve your concern first, so please contact us before approaching the Regulator.

Changes and accuracy

This version was last updated on 12 November 2026. It is important that the personal information we hold about you is accurate and current, so please keep us informed if your details change while you use the Services.

Personal information means any information about an identifiable individual. We collect, use, store and transfer the following kinds of personal information:

Information you give us

• Identity and contact information: your name, surname and title, email address and mobile number.
• Business information: your business name, service categories, province, city, branch names and addresses, and business contact details.
• Account information: your password (stored in hashed form), your role in the workspace, and the permissions an owner gives you.
• Content you add: services and prices, orders, item descriptions, notes, receipt details, and your company logo or profile photo.
• Photographs: where a business has photo capture switched on, before-and-after photographs of the items being cleaned.

Information about your customers

When a business records an order it may capture a customer's name, phone number, email address, collection or delivery address, order history, spend, notes, marketing consent, and photographs of the items. This information belongs to the business; we hold and process it on that business's instructions.

Payment information

Paid plans are billed through PayFast, a South African payment gateway. We receive confirmation that a payment succeeded or failed, the amount and plan paid for, and a reference number. We do not receive or store full card numbers, which are entered on PayFast's secure pages.

Information we collect automatically

• Technical information: IP address, device, browser and operating system.
• Usage information: the pages and features used, actions taken such as creating an order, and timestamps.
• Diagnostic information: error and security logs needed to keep the Platform working and protected.

Children

The Platform is for businesses and is not intended for anyone under 18, and we do not knowingly collect information about children. If you believe a child's information has been given to us, contact us and we will delete it.

• Directly from you when you register, complete onboarding, invite staff, create orders, upload a logo or contact support.
• Automatically as you use the Platform, through logs and usage records.
• From the business that invited you to a workspace, which gives us your email address and role.
• From our providers, such as payment confirmation from PayFast or delivery results from our email provider.

POPIA allows us to process personal information only where a lawful ground applies. We rely on the following grounds:

• Performance of our agreement with you: creating and securing your workspace, recording orders, generating receipts, sending the customer emails you trigger, billing you, and supporting you.
• Legitimate interests: keeping the Platform secure, preventing fraud and abuse, fixing errors, understanding which features are used and improving the Services. We balance these interests against your rights.
• Consent: optional marketing about specials and product news, and any customer marketing consent a business records. You may withdraw consent at any time.
• Legal obligation: tax, accounting and record-keeping duties, and responding to valid requests from public authorities.
• Protecting a legitimate interest of the person concerned: for example, letting a business tell its customer that an order is ready.

We only send marketing email to you if you opted in to receive it, and every marketing email includes a way to unsubscribe. Service emails (receipts, order-ready notices, password resets and invitations) form part of the Services and are sent regardless of your marketing preferences.

When a business uses BizFlo to email its own customers, that business is responsible for having a lawful basis for the message and, for promotional messages, the customer's consent as required by section 69 of POPIA. Receipts and order-ready notices are service messages.

BizFlo does not automatically send WhatsApp or SMS messages. If a business chooses to message customers on those channels, that business is responsible for doing so lawfully.

If an email to a customer is blocked because the address bounced or the person unsubscribed, we stop sending to that address and show the result in the workspace.

We use strictly necessary cookies and browser storage to keep you signed in, remember your workspace and protect forms against abuse. We do not use advertising or cross-site tracking cookies for our own purposes.

You can clear cookies in your browser settings, but you will be signed out and may have to sign in again.

We never sell personal information. We share it only in these situations:

• With providers (operators) who process it on our behalf under written terms: cloud hosting and database services, our payment gateway PayFast, our email delivery providers, and error monitoring and support tooling.
• With the business whose workspace you use: if you are a staff member, the workspace owner can see your name, email address, role, permissions and activity in the workspace.
• With professional advisers such as lawyers or accountants, where necessary and bound by confidentiality.
• With a court, regulator or public authority where the law requires it, or to establish or defend a legal claim.
• With a buyer or investor in the event of a merger, sale or restructuring, under the same protections described in this notice.

Cross-border transfers

Some of our providers store information outside South Africa. Where that happens, we transfer personal information in the manner section 72 of POPIA allows: to recipients bound by laws, binding rules or contractual terms that provide an adequate level of protection, including standard data protection terms with our providers.

We take reasonable technical and organisational measures as required by section 19 of POPIA. These include encrypted connections, access controls, hashed passwords, role-based permissions inside each workspace, backups and monitoring. Staff access is limited to what is needed to support you.

If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 of POPIA requires.

• Workspace and account records: while your workspace is active, then up to 30 days after it is closed so you can export your records or ask us to restore it.
• Order, receipt and payment records: at least five years where tax and accounting laws require it.
• Support conversations and system logs: up to 12 months.
• Marketing preferences and unsubscribe records: kept until you opt back in or ask us to delete them, so that we can honour your choice.

After the retention period we delete or de-identify the information.

Subject to POPIA, you may:

• Ask what personal information we hold about you and request a copy of it.
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
• Object to processing based on our legitimate interests.
• Withdraw a consent you gave us, such as marketing consent.
• Ask us to stop sending you marketing email.
• Complain to the Information Regulator.

Email privacy@bizflo.co.za and we will respond within 30 days. We may ask you to verify your identity and, for access requests, to complete the prescribed request form. Where your request concerns customer records held inside a business's workspace, we will refer it to that business, because it is the responsible party for that information.

The Platform may link to websites we do not control, for example the PayFast checkout. We are not responsible for how those websites handle personal information, so please read their privacy notices before sharing information with them.

For any question about this notice or your personal information, email privacy@bizflo.co.za. For help using the Platform, email support@bizflo.co.za.

Our postal address and full company details are available on request from the Information Officer.