Who we are
Spaza Books is run by Gundwa DX (Pty) Ltd, South Africa ("we", "us"). We follow the Protection of Personal Information Act (POPIA). Our Information Officer is Ashley January. Questions or requests: hello@gundwadx.co.za.
Two kinds of information
About you, the business owner who uses Spaza Books. For this we are the responsible party.
About your customers: the people who send you an enquiry through your lead page, and the clients on your invoices. For this you are the responsible party and we are your operator: we only process it to run Spaza Books for you, we keep it confidential and secure, and we tell you without delay if it is ever compromised.
What we collect about you
- Your account: name, email address, WhatsApp number and password (stored only as a one-way hash, never readable).
- Your business profile: trading name, logo, area, services and prices, VAT number and address, and your lead page.
- Your bank details for EFT payments from your customers. The account number is encrypted.
- Your invoices and credit notes, backed up from your device so you don't lose them with your phone.
- Payments to us: handled by Paystack. We never see your full card number; we keep the last 4 digits, the amounts and dates.
- Technical information: a name for each device you sign in on (e.g. "Samsung A14"), and IP addresses for security and to stop abuse (stored scrambled where we only need to count attempts).
Your expenses, trips and receipts stay on your device. They are not sent to us.
What we collect for you about your customers
- Enquiries from your lead page: name, WhatsApp number, what they need, area and preferred contact time. They tick a box agreeing that you may use these details to reply to their enquiry.
- Your invoice clients: the name, WhatsApp number, address and VAT number you type on an invoice.
You can delete an enquiry, and the customer's details with it, at any time.
Why we use it
- To provide Spaza Books: your account, lead page, enquiries, invoice numbering and backup.
- To send you service emails: verifying your email, password resets, new-enquiry alerts, trial and payment reminders, and notices the law requires (such as before a yearly plan ends). These are about your account, so they aren't marketing.
- To keep the service secure and prevent fraud (for example the email when your bank details change).
- To keep payment records for five years, as SARS requires.
We don't sell your information or your customers' information, and we don't use it for advertising.
Who else handles it
- xneelo hosts our servers and database in South Africa.
- Resend sends our emails, from servers in the European Union (Ireland).
- Paystack processes payments to us.
- Encrypted backup copies are kept with a cloud storage provider, possibly outside South Africa. They are encrypted before they leave our server, so the provider can't read them.
Where information goes outside South Africa, we use providers bound by data protection laws or agreements that give protection similar to POPIA.
How long we keep it
- Your account information, for as long as you have an account.
- When you delete your account, we delete your business profile, bank details, lead page, enquiries and invoices straight away. If you ever paid us, we keep your name, email and payment records for five years for SARS.
- Backups roll over: daily copies are kept for 30 days and monthly copies for 12 months, after which deleted information is gone from them too.
Your rights
You can ask to see the personal information we hold about you, have it corrected or deleted, or object to how we use it. Most of it you can view, change or delete yourself in Spaza Books (Admin, or "Delete my account"). For anything else, email us. Your customers can contact you, or us, about their information.
If you're unhappy with how we handle your information, you can complain to the Information Regulator: inforegulator.org.za.
Security
Everything travels over HTTPS. Passwords are hashed, bank account numbers are encrypted, access to the servers is restricted, and backups are encrypted. If a breach puts your information at risk, we'll tell you and the Information Regulator as POPIA requires.
On your device
Spaza Books saves your records and settings in your browser's storage on your device, so it works offline. We don't use advertising or tracking cookies.