Who is responsible
ZaEng (Pty) Ltd, trading as Sakhani, registration number [registration number], is the responsible party for the personal information described in this notice under the Protection of Personal Information Act, 2013 (POPIA). For the personal information your company records about its own staff, subcontractors and the other parties to its contracts, your company is the responsible party and Sakhani is its operator.
What we collect
- Account information: the names, email addresses, phone numbers and roles of the people your company invites, your company's name and registration number, and a hash of each password.
- Your company's records: the site diaries, photographs, instructions, events, contracts, notices, reports and claim packs you upload or create. These may contain the names and contact details of your staff, the Employer's agents and other parties to the contract.
- Billing information: invoices, payment status and the PayFast payment reference. We never receive or store card numbers; PayFast handles those.
- Usage information: log-in times, the actions each user takes (kept as an audit trail for your company), the device and browser used, and the server logs needed to run and secure the service.
- Messages you send us through the contact form or in-app support.
Why we use it
To provide the service your company subscribes to; to calculate periods and draft the documents you ask for; to send the reminders your company has chosen; to invoice and collect payment; to answer support requests; to keep the service secure and investigate misuse; and to meet our legal obligations, including under tax and company law. The lawful bases under POPIA are the performance of our contract with your company, our legitimate interest in running and securing the service, and compliance with the law. We do not sell personal information and we do not use your records for marketing.
Who we share it with
- Your company's own users, according to the roles your administrators set.
- Our AI provider (Anthropic), which reads the documents you upload and drafts text when you ask for it, under terms that forbid it from training on your data.
- PayFast (Pty) Ltd, for card payments.
- Our email and messaging providers, for the reminders and the notices you send.
- Our support staff, when you ask for help; every action they take in your account is logged.
- A court, regulator or law enforcement body, where the law requires it.
Where it is kept
Your data is stored on a server in Johannesburg, South Africa. Backups are taken nightly, encrypted and kept in South Africa. Our AI provider processes document text outside South Africa for the duration of each request; by using the AI features you consent to that transfer, which is made under contractual terms that protect the information to a standard substantially similar to POPIA.
How long we keep it
- Your company's records: for as long as the account is active, and for thirty days after it ends so that you can export them. Within the application a signed and locked diary page or a sent notice cannot be edited or deleted by a user, because it is evidence; it is deleted with the account.
- Billing records: for the period company and tax law requires, usually five years, in archive form.
- Usage and server logs: ninety days, unless needed to investigate an incident.
- Contact-form and support messages: two years.
Security
Connections are encrypted; passwords are stored as salted hashes; payment gateway secrets are encrypted at rest; access by our staff is limited, logged and reviewed. No system is perfectly secure. We will tell you and the Information Regulator of any security compromise, as POPIA requires.
Your rights under POPIA
You may ask what personal information we hold about you and receive a copy; ask us to correct or delete it; object to processing based on our legitimate interests; withdraw consent you have given; and complain to the Information Regulator of South Africa (inforegulator.org.za). Where the information forms part of your company's records, we will refer your request to your company's administrator, as the responsible party, and help them answer it. Write to the Information Officer below; we answer within thirty days.
Cookies and analytics
The application sets only the cookies needed to keep you logged in and to protect forms. The public site may use Google Analytics or a Meta pixel when switched on; where it does, we say so here and ask for consent where the law requires it.
Information Officer
[Name of information officer], ZaEng (Pty) Ltd trading as Sakhani. Email: [information-officer@sakhani.co.za]. Postal address: [postal address].
Children
The service is for businesses and is not aimed at anyone under eighteen.
Changes to this notice
We update this notice when our processing changes. The version date at the top shows the current version; material changes are notified to your company's master user by email.
ZaEng (Pty) Ltd t/a Sakhani, registration [Registration number]. Write to hello@example.co.za. Read the terms of service as well.