Privacy Notice

1. Introduction

Digital Solution Foundry (Pty) Ltd, registration number 2017/144872/07, operates the E·BIZI platform (the “Platform”) on behalf of Clients who use the Platform. For Personal Information that Clients upload to, manage through, or otherwise process using the Platform, the Client is the Responsible Party and Digital Solution Foundry acts as the Operator, processing such Personal Information only on the Client’s documented instructions and under the applicable Data Processing Agreement. This Privacy Notice explains our role as Operator, our limited direct processing activities, and how Personal Information is safeguarded in connection with the Platform and our website, www.ebizi.co.za

This Privacy Notice should be read together with E·BIZI Pay’s applicable Terms of Service and Data Processing Agreement concluded with the Client.

This notice uses terms defined in POPIA, including “Personal Information”, “Processing”, “Responsible Party”, “Operator”, and “Special Personal Information”. Unless expressly stated otherwise, where Personal Information is processed through the Platform for a Client’s business purposes, the Client is the Responsible Party and Digital Solution Foundry acts as the Operator. The Client’s own privacy notice governs its relationship with its data subjects.

2. Who We Are

Digital Solution Foundry (Pty) Ltd is the Operator of the Platform. The Client who subscribes to and uses the Platform determines the purposes and means of processing Personal Information uploaded to or processed through the Platform and is therefore the Responsible Party for that Client Data. We may act as a Responsible Party only for limited Personal Information that we collect directly for our own business purposes, such as website enquiries, account administration, billing, platform security, and marketing where applicable. Our contact details, and those of our Information Officer, are set out in clause 17 below.

3. Scope of This Notice

This notice applies to Personal Information collected:

• from visitors to our website;
• from Users and Clients who register for and use the Platform; and
• through the Pay and Books, including Personal Information that Clients upload relating to their own employees, payroll and business records.

For Personal Information uploaded by Clients or processed through the Platform for the Client’s business purposes, Digital Solution Foundry acts as Operator and processes that information on behalf of the Client, who remains the Responsible Party. We process such Client Data only in accordance with the Client’s instructions, the applicable agreement, and POPIA. The Client’s own privacy notice governs its relationship with its employees and other data subjects.

4. Guiding Principles

Our commitment to protecting privacy is guided by the following principles:

• Processing limitation: we process Client Data only for the purposes for which it was provided and in accordance with the Client’s documented instructions.
• Accuracy: we provide Platform functionality that helps Clients keep their information up to date.
• Data minimization: where information is no longer required for the relevant service or legal obligation, we support deletion, return, or de-identification in accordance with the Client’s instructions and applicable law.
• Openness: we aim to clearly explain our role as Operator and to assist Clients in meeting their own transparency obligations.
• Consent and lawful basis: the Client is responsible for obtaining consent or establishing another lawful basis where required; we do not undertake further processing of Client Data except as instructed or legally required.
• Confidentiality: we apply security and confidentiality safeguards so Clients can use the Platform with confidence.

5. Personal Information We Collect

5.1 Account and billing information

When you register for the Platform, we collect information such as your name, business or company name, registration number, VAT number, physical and email address, telephone number, and billing and payment information.

5.2 Payroll and employee information (processed on behalf of Clients)

Where a Client uses E·BIZI Pay, the Client may add team members and upload or manage payroll-related Personal Information, including names, identity numbers, salary or wage information, banking details, tax reference numbers, leave information, payroll cycle information, PAYE, UIF and SDL calculations, EMP201 information prepared for SARS eFiling, payslips, and IRP5 information at year end. Employees may access their own portal using an identity number to retrieve payslips or submit leave requests. The Client is the Responsible Party for this payroll and employee information, and Digital Solution Foundry processes it strictly as Operator on the Client’s documented instructions.

5.3 Bookkeeping and financial information

Where a Client uses bookkeeping features within E·BIZI Pay, the Client may upload financial records, invoices, supplier and customer details, and banking information. The Client is the Responsible Party for this information, and Digital Solution Foundry processes it as Operator to provide the relevant functionality and related support services in accordance with the Client’s instructions.

5.4 Technical and usage information

We automatically collect information such as IP address, browser type, device information, log data, and cookies when you access our website or Platform. See our Cookie Policy at clause 13 below.

6. How We Collect Personal Information

Clients collect Personal Information from their employees and other data subjects and provide that information to Digital Solution Foundry so that we can provide E·BIZI Pay. It is therefore presumed that the Client is authorized to provide such information to us and has met any applicable notice, consent, or lawful-basis requirements. We also collect limited technical information automatically, including IP address, browser type, device information, domain names, access times, and referring website addresses, to operate, secure, maintain, and improve the Platform.

7. Use of Personal Information

We use Personal Information to provide, operate, maintain, secure, and support E·BIZI Pay. In respect of Client Data, we process the information only as Operator for the Client’s benefit and on the Client’s instructions, including to help the Client manage small-business payroll, calculate PAYE, UIF and SDL per employee per payroll cycle, prepare EMP201 information for SARS eFiling, make payslips and year-end IRP5 information available, support employee portal access, process leave requests, and provide bookkeeping, document workflow, compliance, and related business services. We do not sell Personal Information or use Client Data for unrelated commercial purposes.

8. Special Personal Information

To the extent Special Personal Information, such as identity numbers, payroll information, tax information, employee portal access information, leave information, or financial information, is processed through E·BIZI Pay, the Client is responsible for determining the lawful basis for that processing and for complying with POPIA requirements applicable to the Responsible Party. Digital Solution Foundry processes such information as Operator, applies the safeguards described in clause 11 below, and assists the Client as reasonably required under the applicable Data Processing Agreement.

9. Sharing and Disclosure of Personal Information

We do not sell Personal Information. We may share Personal Information with:

• sub-operators and service providers who assist us in operating the Platform, including cloud hosting, payment gateway, and communications (SMS/email) providers, under written agreements requiring them to maintain equivalent levels of protection;
• SARS, the Department of Employment and Labour, the Unemployment Insurance Fund, and other regulatory or statutory bodies, where the Client instructs us to support payroll compliance, EMP201 preparation, UIF or SDL administration, or where disclosure is required by law;
• professional advisors, including our auditors and legal advisors, on a need-to-know basis;
• a prospective purchaser or acquirer in the event of a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections; and
• any person where required by law, regulation, or an order of a competent court, the Information Regulator, or other lawful authority.

10. Cross-Border Transfers

Where we, or our sub-operators, store or process Personal Information on servers located outside the Republic of South Africa (including cloud infrastructure providers), we ensure that such transfers comply with section 72 of POPIA that is, the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or the data subject has consented to the transfer.

11. Security Safeguards

Digital Solution Foundry stores information provided through E·BIZI Pay, but the Client retains control of Client Data as the Responsible Party. We secure Personal Information against unauthorized access, use, disclosure, alteration, or loss using appropriate technical and organizational safeguards, including:

• encryption of Personal Information in transit and at rest;
• role-based access controls and multi-factor authentication for administrative access;
• regular security testing, monitoring, and vulnerability management;
• logging and audit trails for access to Client Data; and
• contractual security obligations imposed on all sub-operators.

12. Data Retention

We retain Personal Information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law (for example, the Income Tax Act 58 of 1962 and the Labour Relations Act 66 of 1995 impose minimum record-keeping periods for payroll records). Following termination of a Client’s subscription, Client Data will be retained for thirty (30) days to permit export, after which it will be securely deleted or de-identified, save where continued retention is required by law.

13. Use of Cookies

We use cookies and similar technologies to make E·BIZI Pay easier to use, support secure login sessions, remember preferences, understand usage patterns, and improve performance. We may also use analytics tools that collect aggregated or non-identifying usage information. Most web browsers allow you to accept, decline, or manage cookies through browser settings; however, disabling certain cookies may affect Platform functionality.

14. Data Subject Rights

Subject to POPIA, you have the right to:

• be notified that Personal Information about you is being collected (section 18);
• establish whether we hold Personal Information about you and to request access to it (section 23);
• request the correction, destruction, or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully (section 24);
• object to the processing of your Personal Information on reasonable grounds (section 11(3));
• object to processing for purposes of direct marketing (section 69);
• withdraw consent where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal; and
• lodge a complaint with the Information Regulator (details in clause 18 below).

Where a request relates to Personal Information processed through the Platform on behalf of a Client, the relevant Client is the Responsible Party and should respond to the request. If we receive such a request directly, we will refer it to the relevant Client and provide reasonable assistance to the Client in responding to it.

To exercise rights in respect of Client Data, please contact the relevant Client as Responsible Party. For Personal Information that Digital Solution Foundry processes for its own limited business purposes, or for questions about our role as Operator, please contact our Information Officer using the details in clause 17. We will respond within a reasonable time and, where applicable, assist the Client in accordance with POPIA and the applicable agreement.

15. Children’s Information

The Platform is intended for use by juristic persons and adults acting in a business capacity. We do not knowingly collect Personal Information relating to children, save where processed by a Client as part of its own employee records in accordance with section 35 of POPIA (for example, dependants’ information for benefit administration), which is processed on the Client’s instructions as Operator.

16. Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. The updated notice will be published on our website with a revised effective date, and, where changes are material, we will notify Users via email or in-app notification.

17. Information Officer and Contact Details

Our Information Officer is registered with the Information Regulator in accordance with section 55 of POPIA. You may contact our Information Officer with any queries, requests, or complaints regarding this notice or our processing of your Personal Information at:

Digital Solution Foundry (Pty) Ltd

Attention: The Information Officer

Reg No 2017/144872/07

Parktown, Johannesburg, South Africa

Email: info@ebizi.co.za

18. Complaints to the Information Regulator

If you believe that we have not adequately addressed your concerns, or have processed your Personal Information unlawfully, you have the right to lodge a complaint with the Information Regulator of South Africa:

Information Regulator (South Africa)

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Email: complaints.IR@justice.gov.za | Website: www.justice.gov.za/inforeg