Effective 23 August 2026
Privacy notice
This notice explains what Innofix collects, why we process it, who receives it and how you can exercise your rights under POPIA.
Privacy and PAIA contact
Siphesihle Masuku, Head of the Private Body
privacy@innofix.co.za - +27 62 859 3188
409 Umsunduzi Street, Soweto, Gauteng, 1818, South Africa
1. Who is responsible for your information?
INNOFIX TECHNOLOGIES (PTY) LTD is the responsible party for POPIA Pal account, website, support and billing information. When a customer organisation uploads its own employee, client, breach or data-subject records, that organisation remains the responsible party and Innofix processes the records as its operator under our Data Processing Addendum.
2. What we collect
- Account information: name, email address, profile image and authentication identifiers.
- Organisation information: business name, membership, role and subscription plan.
- Billing information: Paystack customer, transaction and subscription references. Innofix does not receive complete card numbers.
- Workspace content: generated policies, DSAR records, consent evidence, incident records and training completions entered by authorised users.
- Communications: support messages, privacy requests and email delivery information.
- Technical information: IP address, browser or device details, security events and essential session-cookie information.
3. Sources, purposes and lawful grounds
We obtain information directly from you, your organisation, authentication providers you choose, payment providers and technical service providers. We process it to create and secure accounts, deliver the contracted platform, support users, process subscriptions, prevent abuse, meet legal obligations and establish or defend legal claims. These activities rely on contract, legal obligation, protection of legitimate interests or consent, depending on the activity. We do not sell personal information.
Account and payment information is required to provide paid services. If it is not supplied, we may be unable to create an account, authenticate you or provide the requested service. Optional profile fields and Google sign-in are voluntary.
4. Recipients and operators
Access is limited to authorised Innofix personnel, the customer organisation controlling a workspace, professional advisers or public authorities where lawfully required, and the operators necessary to run the service. Our current operator register is published on the operators page.
- Supabase: Authentication, database, file storage and platform security.
- Vercel: Application hosting, content delivery, security and operational logs.
- Resend: Transactional and authentication email delivery.
- Paystack South Africa: Subscription checkout, payment processing and billing administration.
- Google: Optional Google account sign-in selected by the user.
5. Processing outside South Africa
Some cloud, email and identity providers process information outside South Africa. Innofix uses contractual data-protection commitments, provider security reviews and transfer safeguards intended to ensure a level of protection consistent with section 72 of POPIA. Locations and provider documents are listed in our operator register.
6. Retention
We keep identifiable information only for as long as it is needed for the stated purpose, a customer instruction, security, dispute resolution or a legal retention duty. Current periods are:
| Record | Retention rule |
|---|---|
| Account and profile records | For the account term, then up to 30 days after approved deletion unless law requires longer retention |
| Legal acceptance evidence | Five years after the relevant account or agreement ends |
| Billing and transaction records | At least five years, or longer where tax, accounting or dispute law requires it |
| Innofix privacy requests | Three years after final resolution |
| DSAR identity numbers | Masked 90 days after resolution; encrypted while verification is required |
| Resolved customer DSAR records | Three years after resolution, subject to the customer's lawful instructions |
| Cookie consent records | Three years from collection |
| Training completion records | Three years from completion |
| Breach and security records | Seven years from creation or longer while an investigation or claim remains open |
| Security and rate-limit records | Up to 48 hours unless required for an active security investigation |
7. Security
Measures include encrypted transport, managed encryption at rest, tenant-level database access controls, private file storage, server-only credentials, signed payment webhooks, least-privilege administration, audit records, rate controls and incident procedures. No internet service can promise absolute security; confirmed compromises are handled under section 22 of POPIA.
8. Your rights
Subject to POPIA, you may request confirmation and access, correction, deletion or restriction, object to processing, withdraw consent where consent is the basis, and complain about processing. Signed-in users can export their account information from the privacy centre. Anyone may use our privacy request form. We may need to verify identity and may retain information where another law requires it.
9. Complaints
Please contact Innofix first so we can investigate. You may also complain to the Information Regulator (South Africa), Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, or use the Regulator's complaint channels.
10. Children, special information and automated decisions
POPIA Pal is a business service and is not directed at children. Users must not upload children's or special personal information unless their organisation has a lawful basis and appropriate safeguards. Innofix does not make solely automated decisions producing legal or similarly significant effects about POPIA Pal users.
11. Changes
Material changes will be dated, published here and communicated to affected account holders where appropriate. Earlier acceptance evidence remains linked to the version accepted.