POPIA notice

This notice is given under sections 18 and 55 of the Protection of Personal Information Act 4 of 2013 (POPIA) and the Promotion of Access to Information Act 2 of 2000 (PAIA). It sits with our privacy policy.

Responsible party

Two roles

Nowtek is the responsible party for information about Kwita account holders and users. For the personal information a business stores in Kwita about its own customers, suppliers and employees, that business is the responsible party and Nowtek is its operator under section 20 and 21. We process such information only as the business instructs and under a written operator agreement, which these terms and the privacy policy form.

Purposes of processing

• Providing the Kwita service: accounts, invoicing, expenses, banking, stock, payroll, projects, reports.
• Sending and receiving business messages on WhatsApp on the instruction of the user.
• Extracting data from receipts and voice notes the user sends.
• Billing, support, security and fraud prevention.
• Meeting tax and company law duties.

Categories of information

• Identity and contact: names, email, phone, address, business registration and VAT numbers.
• Financial: invoices, payments, bank statement lines, expenses, supplier bills.
• Employment (special care): ID numbers, tax numbers, pay, leave, medical aid membership counts, bank details for salary payment. These are needed for PAYE, UIF and SDL and are processed under section 27(1)(b) and (d).
• Communications: WhatsApp messages and attachments on the business number.
• Technical: sign in records, IP addresses, audit log.

Operators and recipients

• Google LLC (Firebase Authentication, Firestore, Cloud Storage): hosting and storage.
• Vercel Inc: application hosting.
• Meta Platforms (WhatsApp Business Platform): message delivery.
• Anthropic PBC: reading receipt images and documents (optional feature).
• OpenAI: transcribing voice notes (optional feature).
• Nowtek billing engine and its payment processor: subscription billing.

Transfers outside South Africa

The operators above store or process data outside South Africa, mainly in the United States and the European Union. Transfers rely on section 72(1)(a): each operator is bound by contractual terms and certifications that give protection substantially similar to POPIA.

Retention

• Financial and payroll records: 5 years after the end of the relevant tax year (Tax Administration Act section 29, Companies Act section 24, BCEA section 31 for payroll records which is 3 years, we apply 5).
• WhatsApp message content: 12 months.
• Account and user records: 90 days after account closure.
• Logs: 12 months.

Consent and WhatsApp

Businesses that send messages on Kwita confirm they have consent from the recipient or another lawful basis under section 11, and that the message relates to an existing business relationship. Every recipient can opt out by replying STOP. Nowtek keeps a record of opt outs and blocks further messages to that number from that business.

Security

Under section 19 we keep encryption in transit and at rest, access controls by role, hashed API keys, audit logs, and least privilege access for staff. If a security compromise affects personal information we will notify the Regulator and affected parties as section 22 requires, as soon as reasonably possible.

Your rights

• Access: ask what personal information we hold about you (section 23). A PAIA request form is available from the Information Officer.
• Correction and deletion: ask us to fix or delete information (section 24).
• Objection: object to processing on reasonable grounds (section 11(3)).
• Direct marketing: we only send marketing with opt in consent and every message has an opt out (section 69).
• Complaint: lodge a complaint with the Information Regulator.

Send requests to the Information Officer. We respond within 30 days. Data subjects of a business that uses Kwita should contact that business first; we will assist it to respond.

PAIA manual

Our PAIA manual is available from the Information Officer on request and will be published here.