Meeronix Expense — Privacy Policy

Version: 1.0 · Effective date: [EFFECTIVE DATE]

DRAFT. This policy was drafted as a starting point under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It is not legal advice. Every item in [SQUARE BRACKETS] must be completed, and a South African attorney should review it before publication.

This Privacy Policy explains how [LEGAL ENTITY NAME] (registration number [REGISTRATION NUMBER]), of [PHYSICAL ADDRESS] ("Meeronix", "we", "us") processes personal information when you use the Meeronix Expense website, web app and mobile app (the "Service").

1. Two roles: responsible party and operator

• Account and billing information. For the details we need to run our own business — the names, email addresses and phone numbers of people who register or sign in, login and security records, billing and payment records, support messages and demo requests — Meeronix is the responsible party.
• Customer Data. Companies that subscribe (our "Customers") capture their own business records in the Service: transactions, receipts, supplier and customer details, bank statements, payroll and employee records (including ID numbers, tax numbers, bank details and salaries). For that information the Customer is the responsible party and Meeronix is its operator (sections 20 and 21 of POPIA). We process it only on the Customer's instructions under our Terms and Conditions. Employees, suppliers and other people whose information a Customer captures should contact that Customer first.

2. What we collect

We do not knowingly collect information from children. The Service is for businesses. We do not use advertising or tracking cookies — see our Cookie Policy.

3. Why we use it (purpose and lawful basis)

4. Who we share it with

We do not sell personal information. We share it only with:

• Hosting: [HOSTING PROVIDER NAME], data centre in [CITY], South Africa.
• Email delivery: [EMAIL PROVIDER NAME] (sends invites and password-reset emails).
• Payments: PayFast (Pty) Ltd — see [PAYFAST PRIVACY POLICY URL].
• Offsite backups (if used): [BACKUP STORAGE PROVIDER AND REGION].
• Error monitoring (if used): [e.g. Sentry — REGION], configured not to send passwords, cookies or request bodies.
• Professional advisers, auditors, and authorities where the law requires it (for example SARS or a court order).

All operators are bound by written agreements requiring confidentiality and security measures (POPIA s21).

5. Cross-border transfers

We host the Service and store Customer Data in South Africa. Where a provider in section 4 processes information outside South Africa, we transfer it only as permitted by section 72 of POPIA (for example, to a country with adequate protection or under a binding agreement). [LIST ANY PROVIDER OUTSIDE SA AND ITS COUNTRY]

6. How long we keep it

• Account information: while your account is active. When you delete your login it is anonymised after a 30-day grace period (see section 9).
• Customer Data: for the duration of the subscription. When a company is deleted, its data is permanently deleted after a 30-day grace period. Backups that contain it are overwritten within [35] days.
• Billing records: 5 years after the end of the tax year, as required by the Tax Administration Act.
• Security logs (sign-in attempts, IP addresses): [12 MONTHS].

Customers are responsible for keeping their own financial records for the periods the law requires them to (generally 5 years) — please download an export before deleting a company.

7. Security

We use encryption in transit (HTTPS/TLS), hashed passwords, mandatory two-factor authentication for every user, step-up re-authentication for sensitive actions, role-based access, database row-level security to separate companies, an append-only audit log, rate limiting and account lockout, and nightly encrypted backups. No system is perfectly secure. If we have reasonable grounds to believe personal information has been accessed by an unauthorised person we will notify the Information Regulator and affected people (or the Customer, where we are its operator) as required by section 22 of POPIA.

8. Your rights

You may ask us to:

• confirm whether we hold your personal information and give you a copy (access — see our PAIA manual at [PAIA MANUAL URL]);
• correct or update it;
• delete it, or restrict or object to its processing;
• withdraw consent you gave (for example to marketing);
• not be subject to decisions based solely on automated processing.

Where the information is Customer Data (section 1), we will pass your request to the Customer and help it respond. You also have the right to complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 · enquiries@inforegulator.org.za · complaints.IR@inforegulator.org.za · https://inforegulator.org.za [VERIFY CURRENT CONTACT DETAILS].

9. Deleting your account or company

• In the app or website: Settings → Privacy & account → Delete account or company, or go to /account/delete. You confirm with your 2FA code.
• Your login: anonymised after 30 days (name, email, password, 2FA and sessions removed). Records you captured for your company stay with the company.
• A company (owners only): all of its data is permanently deleted after 30 days. You can download a full export and cancel at any time before then.
• Can't sign in? Email [PRIVACY CONTACT EMAIL] from your account's email address. We will verify your identity and respond within [30] days.

10. Information Officer and contact

Information Officer: [INFORMATION OFFICER NAME] · [INFORMATION OFFICER EMAIL] · [TELEPHONE NUMBER] Registered with the Information Regulator on [REGISTRATION DATE / REFERENCE]. Postal / physical address: [PHYSICAL ADDRESS].

11. Changes

We will post changes on this page and update the version and effective date. For material changes we will notify account owners by email before they take effect.