Privacy Policy

1. Introduction

Flowmerce, a product of Ebenware (Pty) Ltd ("Ebenware", "we", "us", or "our"), operates flowmerce.co.za (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy and complying with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African data protection laws. By using the Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide when registering for or using our Service:

• Account information: name, email address, password
• Company information: business name, VAT number, physical address
• Contact details: phone number, billing address
• Payment information: handled securely by third-party payment processors

2.2 Business Data

When you use our Service, you upload and process business information:

• Marketplace reconciliation files and CSV data
• Order details, product information, and transaction records
• Invoice data and claim documentation
• Marketplace connection credentials (encrypted)

2.3 Automatically Collected Information

We automatically collect certain information when you access our Service:

• Log data: IP address, browser type, device information
• Usage data: pages visited, time spent, features used
• Cookies and tracking technologies (see Section 7)
• Performance and error logs for service improvement

3. How We Use Your Information

We use the collected information for the following lawful purposes:

• Service Provision: To operate, maintain, and provide Service features
• Account Management: To create and manage your user account
• Processing: To parse reconciliation files, identify claimable items, and generate invoices
• Communication: To send service updates, support responses, and important notices
• Improvement: To analyze usage patterns and improve Service functionality
• Security: To detect, prevent, and address security incidents and fraud
• Legal Compliance: To comply with applicable laws, regulations, and legal processes
• Marketing: To send promotional communications (with your consent, which you may withdraw)

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

4.1 Service Providers

We engage trusted third-party service providers to support our operations:

• Cloud hosting providers (AWS, Azure, or similar)
• Payment processors (compliant with PCI DSS)
• Email service providers
• Analytics and monitoring services

All service providers are contractually obligated to protect your data and use it only for specified purposes.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data in transit uses TLS/SSL encryption (HTTPS)
• Database Security: Encrypted storage for sensitive information
• Access Controls: Role-based access with multi-factor authentication
• Regular Audits: Security assessments and vulnerability testing
• Monitoring: 24/7 system monitoring for security incidents
• Data Isolation: Multi-tenant architecture with strict data segregation

However, no system is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to:

• Provide the Service and fulfill the purposes outlined in this policy
• Comply with legal, tax, and accounting obligations (typically 5-7 years in South Africa)
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law. Business data in reconciliation files and invoices may be retained longer for compliance purposes.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential Cookies: Required for authentication and core functionality
• Performance Cookies: Track usage patterns and service performance
• Functional Cookies: Remember your preferences and settings

You can control cookie preferences through your browser settings. Disabling essential cookies may affect Service functionality.

8. Your Rights Under POPIA

Under South African law, you have the following rights regarding your personal information:

• Right to Access: Request confirmation of what personal information we hold
• Right to Correction: Request correction of inaccurate or incomplete information
• Right to Deletion: Request deletion of your personal information (subject to legal obligations)
• Right to Object: Object to processing of your information for direct marketing
• Right to Restrict Processing: Request limitation of processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Withdraw Consent: Withdraw consent for processing at any time

To exercise any of these rights, contact us at privacy@flowmerce.co.za. We will respond within 30 days as required by POPIA.

9. Children's Privacy

Our Service is intended for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

10. International Data Transfers

Your information is primarily stored and processed in South Africa. If we transfer data internationally, we ensure appropriate safeguards are in place as required by POPIA, including standard contractual clauses and adequacy assessments.

11. Third-Party Links

Our Service may contain links to third-party websites or services (e.g., marketplace portals). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes via email or prominent notice on our Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. Complaints to the Information Regulator

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the South African Information Regulator: