BizAP (Pty) Ltd ("BizAP", "we", "us", or "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share information when you use our platform, website, and related services (collectively, the "Service"). It also describes your rights under applicable law, including the Protection of Personal Information Act 4 of 2013 (POPIA).
By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.
1. Who We Are
BizAP (Pty) Ltd is the Responsible Party in terms of POPIA for personal information processed through our platform. Our registered address and contact details are set out in Section 12 below.
2. Information We Collect
2.1 Information you provide directly
- Account registration details (name, email address, phone number, business name)
- Billing and payment information (processed securely via Ozow or PayFast — we do not store card details)
- WhatsApp Business number and Meta API credentials you connect to the Service
- Customer data you import or that flows through your WhatsApp conversations
- Support requests and communications you send us
2.2 Information collected automatically
- Log data (IP address, browser type, pages visited, timestamps)
- Device information (operating system, screen resolution)
- Usage data (features used, conversation volumes, response times)
- Cookies and similar tracking technologies (see Section 7)
2.3 Customer data processed on your behalf
When you use BizAP to manage WhatsApp conversations, your customers' personal information (names, phone numbers, messages, order details) is processed through our platform. In this context, you are the Responsible Party and BizAP acts as an Operator. You are responsible for ensuring you have a lawful basis to process your customers' data and that your use of BizAP complies with POPIA.
3. How We Use Your Information
- To provide, operate, and maintain the Service
- To process transactions and send billing communications
- To authenticate users and maintain account security
- To respond to support requests and communicate about your account
- To send product updates, security alerts, and administrative messages
- To analyse usage patterns and improve platform performance
- To comply with legal obligations under POPIA and other applicable law
- To detect and prevent fraud or abuse of the Service
4. Legal Basis for Processing
We process your personal information on the following lawful grounds:
- Contractual necessity — to provide the Service under our agreement with you
- Legitimate interests — to improve the Service, ensure security, and prevent fraud
- Legal obligation — to comply with POPIA, tax law, and other applicable regulations
- Consent — where you have given explicit consent (e.g. marketing communications)
5. How We Share Your Information
We do not sell your personal information. We may share information in the following limited circumstances:
- Service providers — trusted sub-processors (cloud hosting, payment processors, analytics) who process data on our behalf under data processing agreements
- Meta Platforms — as required to operate the WhatsApp Business API integration
- Legal requirements — if required to do so by law, court order, or government authority
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations
6. Data Retention
We retain your account data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations. Conversation and customer data is retained for the period specified in your plan settings. You may request earlier deletion as described in Section 9.
Billing records are retained for a minimum of 5 years as required by South African tax legislation.
7. Cookies
Our website uses cookies and similar technologies to maintain sessions, remember preferences, and analyse usage. You can control cookie settings through your browser. Disabling certain cookies may affect the functionality of the Service.
8. Data Transfers
Your data is primarily stored on servers located in the European Union (Frankfurt region via Supabase). When data is transferred outside South Africa, we ensure appropriate safeguards are in place as required by POPIA Section 72, including standard contractual clauses or adequacy determinations.
9. Your Rights
Under POPIA and applicable law, you have the right to:
- Request access to the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Request deletion of your personal information (subject to legal retention obligations)
- Object to processing based on legitimate interests
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the Information Regulator of South Africa
To exercise any of these rights, contact us at privacy@bizap.co.za. We will respond within 30 days.
10. Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or destruction. These measures include encryption in transit and at rest, access controls, and regular security assessments. For more detail, see our Security page.
11. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us immediately.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, please contact our Information Officer:
- Email: privacy@bizap.co.za
- Post: BizAP (Pty) Ltd, Information Officer, South Africa
You may also lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or via a prominent notice on the platform at least 30 days before taking effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.