POPIA Disclosure
Last updated: 22 October 2026
This disclosure summarises how Shelfie processes personal information in line with the Protection of Personal Information Act, 2013 ("POPIA"). It supplements, and should be read with, our Privacy Policy, which describes in full what we collect, who we share it with, and your rights.
1. Roles under POPIA
- For Shelfie account and billing information, Shelfie is the responsible party.
- For the customer and transaction data a business captures inside Shelfie, the business is the responsible party and Shelfie is its operator, processing that data only on the business's documented instructions, under the operator terms in section 5 of our Terms of Service.
2. Lawful basis for processing
We process personal information on the following bases recognised by POPIA:
- Performance of a contract — to provide the Service to businesses and to enable businesses to serve their own customers.
- Compliance with a legal obligation — e.g. retaining financial records for tax and accounting purposes.
- Legitimate interests — securing the platform, preventing fraud and abuse, and maintaining audit logs, balanced against data subjects' rights.
- Consent — where consent is the appropriate basis (for example, certain direct communications), it is obtained and can be withdrawn.
3. Cross-border processing
Shelfie's personal information is processed outside South Africa. The application, database, uploaded files and backups are hosted in Germany by Hetzner Online GmbH, and error reports go to Sentry's EU data region in Germany. Emails are sent through Resend (USA). WhatsApp messages pass through Meta Platforms (Ireland and USA).
We rely on section 72 of POPIA. In Germany the EU General Data Protection Regulation gives protection at least as strong as POPIA (section 72(1)(a)). Resend and Meta are bound by data processing terms with us that require an adequate level of protection (section 72(1)(a)), and those transfers are needed to send the emails and WhatsApp messages the service exists to send (section 72(1)(c) and (d)).
Backups are encrypted before they leave our server; the decryption key is kept offline.
4. Sub-processors
Hetzner Online GmbH (Germany) for hosting and backups, Sentry (EU, Germany) for error monitoring, Resend (USA) for email, Meta Platforms (Ireland and USA) for WhatsApp messaging, Paystack for Shelfie's subscription billing and iKhokha for card payments to a shop's own account. The list, with purposes and data involved, is kept in our Privacy Policy.
5. Retention schedule
| Category | Retention |
|---|---|
| Account & staff records | Life of the account; deleted or anonymised within 30 days of the owner's deletion request. |
| Customer, order, invoice & job records | While the account is active. After a deletion request, invoices and quotes are kept at least 5 years for tax and accounting compliance, with the people on them anonymised; the rest is deleted within 30 days. |
| Unpaid online orders | The shopper's name and WhatsApp number are removed 30 days after an unpaid order is cancelled. |
| Online quote approvals | IP address and browser kept with the quote as a financial record; removed with the customer's personal details. |
| WhatsApp messages | Not stored; a message identifier is kept for 30 days. A message that can't be sent is deleted after 30 days. |
| People who message a shop's WhatsApp | Number and last-message times: 90 days after their last message, or 12 months after their last message for the shop's customers. |
| WhatsApp contact numbers | While the WhatsApp number is connected; deleted when it disconnects or with the account. |
| Sign-ins | Deleted after 30 days unused. |
| Security audit log | 12 months. |
| Backups | 14 days, so deleted information is gone from them within 14 days after that. |
6. Security measures
We apply technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit (TLS). Backups are encrypted before they leave our server; the decryption key is kept offline.
- Payment keys and WhatsApp access tokens are encrypted in the database.
- Hashed and salted passwords; no plaintext credential storage. Sign-ins expire after 30 days unused.
- Strict multi-tenant isolation so each business only sees its own data, enforced by access policies.
- Role-based access control for staff within a business.
- Rate limiting and abuse controls on sign-in and on public, token-gated endpoints.
- No storage of full card numbers — card and EFT handling is delegated to PCI-DSS-compliant payment providers.
- Audit logging of security-relevant events (sign-ins, password resets, team, payment and WhatsApp connection changes), kept 12 months, and error monitoring.
- Personal information is deleted on the schedule above, automatically each night.
7. Data-subject participation
Data subjects may request access to, correction or deletion of their personal information, and may object to processing, as set out in our Privacy Policy. Requests relating to data captured by a business that uses Shelfie should be directed to that business; it can correct a customer's details, or remove them while keeping its invoices, in Shelfie itself, and we will assist as its operator. To delete a Shelfie account, see Data Deletion.
8. Information Officer & the Regulator
Responsible party: GETTINDRIKKIEWITHIT (PTY) LTD, 61 Van Eeden Street, Waterbron, Bloemfontein 9301, South Africa
Information Officer: Drikus van der Walt, Director
Email: info@shelfie.co.za
You have the right to lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.