Effective 23 August 2026
Operator register
The service providers below process limited personal information to operate POPIA Pal. Innofix reviews their privacy and contractual safeguards and records material changes.
Supabase
- Purpose
- Authentication, database, file storage and platform security
- Data
- Account details, organisation records and customer workspace content
- Location
- Selected cloud region with possible international support processing
Vercel
- Purpose
- Application hosting, content delivery, security and operational logs
- Data
- IP address, request metadata and application traffic
- Location
- Global infrastructure, including processing outside South Africa
Resend
- Purpose
- Transactional and authentication email delivery
- Data
- Recipient email address, delivery metadata and email content
- Location
- United States and authorised international subprocessors
Paystack South Africa
- Purpose
- Subscription checkout, payment processing and billing administration
- Data
- Customer, transaction, subscription and payment information
- Location
- South Africa and Paystack's authorised international infrastructure
- Purpose
- Optional Google account sign-in selected by the user
- Data
- Google account identifier, name, email and profile image
- Location
- Google's global infrastructure
Change management
Innofix assesses necessity, access, security, location and contractual protection before introducing an operator. Material additions that change the processing described in the privacy notice will be communicated to affected customers. Customers may raise a reasonable data-protection objection through the published privacy contact.