POPIA Notice
Effective date: see the version banner at the top of this page.
This notice describes how Zilo Software (Pty) Ltd ("Zilo", "we", "us"), operator of ItsSuite (the "Service"), processes personal information about you in compliance with the Protection of Personal Information Act, 4 of 2013 ("POPIA").
It complements the Privacy Policy (which applies globally) by addressing POPIA-specific rights and obligations for South African data subjects.
1. Information officer
Our designated Information Officer under POPIA is the Director of Operations, contactable at legal@itssuite.com. The Information Officer is registered with the Information Regulator of South Africa.
2. The personal information we process
We process the following categories of personal information:
| Category | Examples | Lawful basis |
|---|---|---|
| Identity information | Name, surname, email address | Performance of contract |
| Contact information | Phone number, postal address | Performance of contract |
| Authentication data | Hashed password, TOTP secret, recovery codes | Legitimate interest (security) |
| Usage data | Timestamps of logins, feature use, audit-log entries | Legitimate interest (operations / security) |
| Communications data | WhatsApp message content + metadata exchanged via the Service, on your customer's behalf | Performance of contract; you are the responsible party for those communications |
| Billing data | Wallet ledger entries, invoices, last four digits of payment card | Performance of contract; legal obligation (tax) |
| Marketing data | Email opt-in choices for platform announcements | Consent |
We do not process special personal information (race, health, biometrics, religion, criminal behaviour) for the operation of the Service. If you choose to include such information inside a message, contact attribute, or knowledge-base document, you do so as the responsible party and warrant that you have the lawful basis to do so.
3. Purpose of processing
We process personal information to:
- Provide and operate the Service (deliver messages, run flows, host the inbox, render dashboards).
- Authenticate, authorise, and audit access to the Service.
- Bill correctly and account for usage above plan allowances.
- Detect, prevent, and investigate abuse or security incidents.
- Send transactional emails (verification, password reset, billing receipts) — required for service operation; no opt-out.
- Send platform announcements where you have opted in.
- Comply with applicable law, including responding to lawful requests from regulators and law-enforcement agencies.
4. Recipients of personal information
We share personal information only with the categories of recipient listed below, each of which is bound by a written processing agreement and operates under appropriate technical and organisational measures:
- Sub-processors — hosting, email delivery, AI inference, analytics, and payment processing. See the current list at /legal/subprocessors.
- Meta Platforms Ireland Ltd — to deliver WhatsApp messages on your behalf through the WhatsApp Business Platform.
- Service-of-process recipients — the South African Revenue Service, the Information Regulator, courts of competent jurisdiction — when compelled by law.
We do not sell personal information.
5. Cross-border transfers
The primary processing of personal information takes place in South Africa. Sub-processors may be located outside South Africa; where this is the case, the transfer is supported by:
- a written processing agreement requiring compliance with POPIA- equivalent protections, and
- where applicable, the data-importer's adherence to a recognised protection framework (e.g. the EU Standard Contractual Clauses for transfers to the European Union or the UK).
You may contact us at legal@itssuite.com for the list of jurisdictions where sub-processors store or process personal information.
6. Retention
We retain personal information for the following periods, unless applicable law requires a longer period:
| Data | Retention |
|---|---|
| Account profile + workspace memberships | While the account is active + 90 days after deletion (in soft-delete state for restoration) |
| Audit log | 30 days (Free) / 90 days (Starter) / 1 year (Growth) / 5 years (Scale) / negotiated (Enterprise) |
| Conversation messages | While the account is active; deleted on account deletion |
| Billing records | 5 years after creation (Income Tax Act §29(1)(b)) |
| Marketing opt-in records | Until withdrawn + 12 months for proof of compliance |
| Authentication logs | 90 days |
You may request earlier deletion at any time; see §8.
7. Security
We maintain the technical and organisational measures described in the Security One-pager, including encryption at rest (AES-GCM), TLS in transit, mandatory two-factor authentication for platform administrators, role-based access control, and a documented incident-response plan.
8. Your rights under POPIA
You have the right, on reasonable notice and without charge, to:
- Be told whether we hold personal information about you;
- Access that personal information in a usable form;
- Correct or delete personal information that is inaccurate, irrelevant, out of date, or unlawfully obtained;
- Object to processing on reasonable grounds, including direct marketing;
- Withdraw consent where consent is our lawful basis (this does not affect the lawfulness of processing carried out before withdrawal);
- Complain to the Information Regulator of South Africa (contact details below).
To exercise any of these rights, email legal@itssuite.com with "POPIA request" in the subject line. We will respond within 30 calendar days, unless the request is complex or numerous in which case we may extend by a further 30 days with notice to you.
9. Information Regulator
If you believe we have processed your personal information unlawfully, you may lodge a complaint with the Information Regulator of South Africa:
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 inforeg@justice.gov.za · +27 (10) 023 5200 https://inforegulator.org.za
10. Changes to this notice
We may update this notice from time to time. Material changes will be notified via the platform announcements system and on the legal page index. The version banner on this page records the effective date of the version you are reading.
Initial template — please review with legal counsel before relying on this for compliance purposes.