What this policy covers. This policy is about information collected through this website - when you browse it, enquire, or book a demonstration. If you are already a merchant, the information we process to run your collections is governed by your merchant agreement, not by this policy. If a business collects from you through Click2Pay, that business is responsible for your information - contact it first; if you cannot, write to us and we will pass your request on.
1. Who we are
This policy is issued jointly by the two companies behind the Click2Pay product:
| Company | Registration number | What it does |
|---|---|---|
| Flexifusions (Pty) Ltd | 2008/014266/07 | Third-Party Payment Provider - DebiCheck, EFT credit and EFT debit collections. Sponsored by Absa Bank Limited. |
| Debi Bridge (Pty) Ltd | 2022/722151/07 | Third-Party Payment Provider - credit and debit card. Sponsored by Absa Bank Limited. |
Physical address of both companies: 51 Ingersol Road, Lynnwood Glen, Pretoria, Gauteng, 0081.
For information collected through this website, the two companies are joint responsible parties, and in this policy “we”, “us” and “our” mean both of them. Where it matters to a right you want to exercise, our Information Officer will tell you which company holds the record.
Contact for anything in this policy: enquiries@click2pay.co.za
2. What we collect
2.1 If you visit this website
This site runs no analytics and its public pages set no cookies, so the only record of your visit is what our hosting provider's server writes down automatically, as every web server does:
- Your IP address, which indicates your approximate location
- The type of device and browser you are using, your operating system, and your language setting
- The pages you ask for and when, and the page that referred you, which can include search terms in the rare case a search engine passes them
Nothing measures how long you spend on a page, how far you scroll, or what you do while you are there. Section 8 explains that these logs stay with our hosting provider and that we keep no separate copy. Cookies are dealt with in section 7.
2.2 If you enquire or request a demonstration
- Your name and business email address
- Your business name, the collection methods you use, and anything you choose to tell us in your message about what you want to collect
- If you book a demonstration, the details you enter on the booking page and the time you choose
- A record of our correspondence with you
Your name and email address are needed to answer you. Everything else is optional, and leaving it out does not stop us replying.
When you send the enquiry form, a scrambled form of your IP address is kept for one hour to stop the form being abused, and is then deleted automatically.
Please do not send us bank account details, identity documents, card numbers or your own customers' personal information through this website. If you do, we will delete it and ask you to send it through the proper channel.
This website is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to enquiries@click2pay.co.za and we will delete it.
We do not ask for, and please do not send us, special personal information as POPIA s26 defines it - religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, or criminal behaviour.
3. Why we may process it
POPIA requires a lawful justification for every purpose. For this website, ours are:
| Purpose | Justification under POPIA s11 |
|---|---|
| Answering your enquiry, or arranging and preparing for a demonstration | Steps taken at your request before a contract, or your consent - s11(1)(a) and (b) |
| Keeping the site working, secure and free of abuse | Our legitimate interests - s11(1)(f) |
| Marketing our own similar services to existing customers | s69(3) - see section 4 |
| Meeting a legal or regulatory obligation, or dealing with a legal claim | Compliance with an obligation in law - s11(1)(c) |
We do not sell personal information, and we do not buy it. We do not make any decision about you based solely on automated processing, including profiling, that would produce a legal or similarly significant effect - POPIA s71 - every enquiry is read and answered by a person.
4. Direct marketing
We will send you electronic marketing about our own similar services only if you are an existing customer, you gave us the details in the course of a sale, and you have not opted out - the exception in POPIA s69(3). Every message carries a free unsubscribe route.
If you are not an existing customer, we do not use the details you give us through this website to market to you.
Opting out of marketing does not stop service, security and legally required notices. Those are not marketing and we cannot suppress them.
5. Who we share it with
Information collected through this website is shared only with:
- Hosting, infrastructure and email providers, under written contracts imposing the security obligations POPIA s19 requires
- Calendly, LLC, the scheduling service that books demonstrations on our behalf, as our operator, where you choose to book through it
- Our professional advisers - auditors, attorneys, insurers - under professional confidentiality
- Regulators, law enforcement and the courts, where we are compelled by law, or where we reasonably believe disclosure is necessary to report or prevent unlawful activity
- A purchaser or successor, if the business or part of it is sold, merged or restructured
6. Sending information outside South Africa
This website is hosted in South Africa, with xneelo. Browsing the site and using the enquiry form does not send your information outside the Republic.
The one exception: if you choose to book a demonstration through our scheduling link, what you enter there is sent to Calendly, LLC, based in the United States, which processes it on our behalf as our operator. That transfer rests on your consent under POPIA s72(1)(b) - booking through the link is your choice. If you would rather not send your details there, email us instead and we will arrange the demonstration directly.
7. Cookies
The public pages of this website set no cookies: none for analytics, none for advertising, and none of their own. Nothing on them writes to your browser's storage either. The staff sign-in screen uses the strictly necessary cookies needed to sign in, and they are set only for staff who use it.
If we add analytics later, analytics cookies will not be set unless you agree, and we will ask before setting them. If we ever add a cookie the site genuinely needs in order to work, we will say so here first.
You can block or delete cookies in your browser at any time, and doing so will not stop this site working.
8. How long we keep it
We keep personal information only for as long as necessary for the purpose we collected it, or for as long as the law requires us to. We then delete or de-identify it. In practice:
- An enquiry that goes nowhere. Kept only while it could still be of use to you or to us - for example if you come back to us about it. Once it is clear that nothing will come of it, we delete it.
- An enquiry that becomes a customer relationship. Kept for as long as that relationship runs, and then for the period financial, tax and company law requires.
- A record that you opted out. If you opt out of marketing, or tell us not to ask you again, we keep enough of a record to honour that for as long as we market at all. Deleting it would be the surest way to contact you again by mistake.
- Website server logs. We do not extract, copy or keep these ourselves. They are generated and held by our hosting provider under its standard practice, and we retain no separate copy, so deleting them runs to its schedule and not ours.
What counts as necessary depends on what the record is, why we hold it, and whether it is still needed for an unresolved complaint, dispute or legal claim, or because the law requires us to keep it. Once none of those reasons applies, we do not keep it. If you want to know how long we are holding something of yours, ask us and we will tell you.
If you want to know what we hold about you, or want it deleted, section 10 tells you how to ask.
9. How we protect it
We take the appropriate, reasonable technical and organisational measures POPIA s19 requires.
We do not warrant that these measures are effective in every circumstance. No security is perfect and we do not claim otherwise.
If something goes wrong. Where we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the affected people as soon as reasonably possible after discovering it, with the content POPIA s22(5) requires.
10. Your rights
Subject to POPIA, and to any law that requires us to keep a record, you may:
- Ask what we hold about you and get a copy - POPIA s23, through the procedure in our PAIA manual, on Form 2
- Have it corrected or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained - POPIA s24
- Object to processing we carry out on the legitimate-interests basis, on reasonable grounds - POPIA s11(3), on Form 1
- Withdraw consent at any time where processing rests on it. Withdrawal does not undo processing already lawfully carried out.
- Opt out of direct marketing - free, by any route in the message
- Complain - see section 11
We respond within 30 days. Where PAIA permits an extension we will tell you before the 30 days expire, and why. Confirming whether we hold your information is free; a copy may carry the prescribed PAIA access fee (there is no request fee for your own records). Correction, deletion, objection and marketing opt-out are free.
Before we act we must be satisfied you are who you say you are, so we will ask for proof of identity - and for proof of authority if you are asking on someone else's behalf.
11. Complaints
Write to our Information Officer at enquiries@click2pay.co.za first - we would prefer to resolve the matter with you directly.
If you are not satisfied, you may complain to:
The Information Regulator (South Africa)
54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone 010 023 5200 · Toll-free 0800 017 160
POPIA complaints: POPIAComplaints@inforegulator.org.za or the eService Portal (opens in a new tab)
PAIA complaints: PAIAComplaints@inforegulator.org.za
inforegulator.org.za (opens in a new tab)
12. Changes to this policy
We may change this policy. The version and date below always tell you which version you are reading, and we keep the superseded versions.