Privacy Notice

Flowa (Pty) Ltd (“Flowa”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Notice explains how we collect, use, store, share, and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”) and other applicable South African legislation.

By using the Flowa platform (“Service”), you acknowledge that you have read and understood this Privacy Notice. If you do not agree with the practices described here, please do not use the Service.

1. Who Is the Responsible Party?

For the purposes of POPIA, Flowa (Pty) Ltd is the responsible party in respect of personal information collected through the Service. Our contact details are set out in section 10 below.

2. Personal Information We Collect

We collect personal information in the following categories:

2.1 Account and Identity Information

• Full name and surname
• Email address
• Business name and registration details
• Phone number
• Password (stored as a cryptographic hash — never in plain text)

2.2 Billing and Payment Information

• Billing address
• VAT registration number (where applicable)
• Payment method details (processed directly by our payment provider; Flowa does not store full card numbers)

2.3 Usage and Technical Information

• IP address and approximate geographic location
• Device type, browser type, and operating system
• Pages visited, features used, and interaction timestamps
• API request logs and error logs

2.4 Customer Messaging Data

When you use Flowa to communicate with your own customers via WhatsApp or SMS, we process the content of those messages solely on your behalf (“operator processing” under POPIA). You, as the Flowa account holder, remain the responsible party for that personal information. You are responsible for ensuring that your messaging activities comply with POPIA and all applicable regulations, including obtaining the necessary consents from your customers.

2.5 Information You Voluntarily Provide

• Support requests and correspondence
• Survey responses and feedback

3. How We Use Your Personal Information

We process your personal information for the following purposes:

• Service delivery: To create and manage your account, process payments, and provide the features and functionality of the platform.
• Customer support: To respond to your queries, troubleshoot issues, and improve our support experience.
• Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions, abuse, and other security incidents.
• Legal and regulatory compliance: To comply with applicable South African law, including tax obligations, POPIA requirements, and lawful requests from public authorities.
• Product improvement: To analyse how the Service is used in aggregate (anonymised or pseudonymised where possible) in order to improve features and performance.
• Marketing communications: To send you product updates, newsletters, and promotional offers. You may opt out of marketing emails at any time by clicking “unsubscribe” in any marketing email or by contacting us directly.

4. Legal Basis for Processing

Under POPIA, we rely on the following grounds for processing your personal information:

• Contractual necessity: Processing required to perform our contract with you (e.g., account creation, service delivery, billing).
• Legitimate interests: Processing necessary for our legitimate business interests, such as security, fraud prevention, and product improvement, where those interests are not overridden by your rights and interests.
• Legal obligation: Processing required to comply with applicable South African law.
• Consent: Where we rely on your consent (e.g., for marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

• Service providers (operators): We engage third-party companies to assist in delivering the Service, including cloud infrastructure providers (Supabase / AWS), payment processors (PayFast), SMS gateway providers, and email delivery services. These parties process personal information only on our instructions and are bound by appropriate data processing agreements.
• WhatsApp / Meta: Messages sent via WhatsApp are transmitted through Meta's infrastructure. Meta's privacy policy applies to such transmissions.
• Legal requirements: We may disclose personal information where required to do so by law, court order, or the request of a competent regulatory authority.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal information may be transferred as part of that transaction. We will notify affected users of any such change in responsible party.

6. Cross-Border Transfers

Some of our service providers are located outside South Africa. Where we transfer personal information to a foreign country, we take reasonable steps to ensure that the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to the conditions for the lawful processing of personal information in terms of POPIA.

7. Retention of Personal Information

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. The table below sets out our standard retention periods:

After the applicable retention period, we will securely delete or anonymise your personal information.

8. Security

Flowa implements appropriate technical and organisational measures to protect your personal information against accidental loss, destruction, alteration, unauthorised disclosure, or access. These measures include encryption of data in transit (TLS) and at rest, access controls, regular security assessments, and staff training.

No transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you become aware of any security vulnerability relating to the Service, please report it immediately to info@flowa.co.za.

9. Your Rights Under POPIA

Subject to applicable law, you have the following rights in respect of your personal information:

• Right of access: You may request a description of the personal information we hold about you and details of how it is used.
• Right to correction: You may request that we correct inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information.
• Right to deletion: You may request that we delete personal information we hold about you, subject to any legal obligations we have to retain it.
• Right to object: You may object to the processing of your personal information on grounds relating to your particular situation, or where processing is for direct marketing purposes.
• Right to lodge a complaint: You have the right to lodge a complaint with the Information Regulator of South Africa if you believe that we have processed your personal information in violation of POPIA.

To exercise any of the above rights, please contact our Information Officer at info@flowa.co.za. We will respond to your request within 30 days. In some cases, we may need to verify your identity before processing your request.

Information Regulator of South Africa
Website: www.justice.gov.za/inforeg
Email: inforeg@justice.gov.za

10. Cookies and Tracking Technologies

The Service uses cookies and similar tracking technologies to maintain session state, remember your preferences, and analyse usage patterns. Essential cookies are required for the Service to function and cannot be disabled. Analytics cookies help us understand how users interact with the platform; you may opt out of these via your browser settings or by contacting us.

11. Children's Privacy

The Service is intended for use by businesses and individuals who are at least 18 years of age. We do not knowingly collect personal information from persons under the age of 18. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

12. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. We will notify you of material changes by email or by posting a prominent notice within the platform at least 14 days before the changes take effect. The date at the top of this notice reflects when it was last revised.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Notice or our handling of your personal information, please contact our Information Officer: