← Indawo AI home · Envy Fincorp (Pty) Ltd t/a Indawo AI, reg. 2021/756475/07
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA) · Version 1.0 · Date: 21 October 2026
This manual tells you what records Envy Fincorp (Pty) Ltd t/a Indawo AI (“Indawo”, “we”) holds, how to ask for access to them under PAIA, and how we process personal information under POPIA. Indawo is a private body under PAIA.
The manual is available free of charge:
If you ask for a printed copy, we may charge a reasonable fee for printing (PAIA Regulations, Annexure B: R2 per A4 page).
| Name | Envy Fincorp (Pty) Ltd, trading as Indawo AI |
| Registration number | 2021/756475/07 |
| Type of body | Private company (private body under PAIA) |
| Address (and address for legal notices) | 102 Churchill Street, Wendywood, 2090 |
| Postal address | to be published |
| Phone | to be published |
| privacy@indawoai.co.za | |
| Website | indawoai.co.za |
| Business | Software-as-a-service booking, guest communication and operations platform for South African accommodation businesses |
| Head of the private body | Director: Mr D Mhlaba |
| Information Officer | Mr D Mhlaba |
| Deputy Information Officer | to be published |
| Email for requests | privacy@indawoai.co.za |
| Address | 102 Churchill Street, Wendywood, 2090 |
| Information Regulator registration number | to be published |
The Information Regulator has published a Guide on how to use PAIA and POPIA (PAIA section 10). It explains your rights, how to make a request, fees and how to complain. You can get it:
You may also inspect a copy of the Guide at our office during normal business hours.
We have not published a notice under section 52(2). The following are available on our website without a PAIA request: our Subscription Agreement, Operator Agreement, Privacy Notice, Acceptable Use Policy, Launch Offer Terms, this manual, and product and pricing information.
We keep records as required by, among others:
Some of these records may be available to the public or to specific people under those laws (for example company records at CIPC). This list is not complete.
A record listed here is not necessarily available: access is subject to the grounds of refusal in PAIA (section 9).
| Subject | Categories of records |
|---|---|
| Company and statutory | Memorandum of Incorporation; CIPC registration documents; registers of directors and shareholders; minutes and resolutions; statutory returns |
| Finance and tax | Annual financial statements; accounting records; bank statements; invoices; tax returns and SARS correspondence |
| Clients | Subscription and order forms; operator agreements; client account, billing and contact records; authorised signatory and proof-of-address records; support tickets; correspondence; collections records |
| Client property data (held as operator) | Booking, guest, message, review and check-in records processed for client properties. These belong to the client property as responsible party. Requests for them should be sent to the property; we will forward requests we receive. |
| Sales and marketing | Enquiries, demo requests, Ask Indi lead form records, business prospect records, consent and opt-out records, marketing material |
| Product and technology | Software source code, system design and security documents, audit and server logs, backup records |
| Suppliers and operators | Supplier and operator contracts, invoices and correspondence |
| Staff | Employment and contractor contracts, payroll and tax records, leave records, training and confidentiality undertakings, disciplinary records |
| Legal and compliance | Contracts, legal opinions, litigation records, POPIA and PAIA records (requests, incident register, processing records), Information Regulator correspondence |
| Intellectual property | Trade mark, domain and licence records |
We process personal information to: run our website, Ask Indi help chat and sign-up; answer enquiries and arrange demos; send one single consent request to business prospects and marketing only with consent or to existing clients (POPIA s69); open, run, bill and support client accounts; verify authority and business addresses and prevent fraud; keep our systems secure; meet our legal, tax and accounting duties; employ and pay staff and contractors; buy from suppliers; and, as operator, provide the Indawo AI services to client properties on their instructions.
| Data subjects | Categories of personal information |
|---|---|
| Website and Ask Indi users | Typed questions (contact details stripped from logged unanswered questions); server log data (IP address, browser, pages, time) |
| Enquirers, demo requesters and Ask Indi lead form users | Name, property or business name, role, email, phone, questions, conversation notes, consent records |
| Business prospects | Business name, published role email and phone, website, region, public notes, source and date |
| People signing up or signing in | Email, one-time code (hashed), send and delivery data, attempts, IP address, device type |
| Clients and their users | Business and billing details; authorised signatory details including ID/passport number; user names, emails, cell numbers, roles; login and audit records; support tickets; bank details; proof of business address |
| Marketing contacts | Name, email, phone, preferences, opt-in and opt-out records |
| Guests, bookers and other people whose information we process for client properties (as operator) | Names, contact details, nationality, booking details, payment status, check-in details the property collects (for example ID/passport number), messages, reviews, loyalty status, debtor balances |
| Suppliers and service providers | Contact persons, contact details, bank details, invoices, contracts |
| Staff and contractors | Names, ID numbers, contact details, bank and tax details, employment records |
| Juristic persons (clients, prospects, suppliers) | Company names, registration numbers, addresses, contact details, financial and billing information |
We do not process special personal information by default. Dietary or accessibility notes that client properties enter for guests may reveal health information; properties are asked to keep these to what is necessary.
We do not sell personal information.
Our main servers are in South Africa. Some providers process information elsewhere: Channex.io (European Union and United Kingdom, only for properties that use live OTA sync); Meta/WhatsApp (USA, EU and other countries, only when WhatsApp is used); YouTube/Google (USA and others, only if a website visitor plays a demo video); and our email delivery provider (South Africa). We transfer information only where POPIA section 72 allows, for example where the recipient is bound by laws or agreements giving adequate protection, or the transfer is needed to perform a contract with or in the interest of the data subject.
We use appropriate, reasonable technical and organisational measures, including: hosting in South Africa with a firewall and automatic security updates; HTTPS/TLS encryption; encryption at rest, with field-level encryption for ID/passport numbers and bank details; role-based access and least privilege; two-factor authentication for administrators and staff; audit logs; encrypted daily backups stored in South Africa and tested restores; written operator contracts; staff confidentiality undertakings and POPIA training; and a security compromise response procedure, including notice to the Information Regulator and affected people under POPIA section 22.
To ask for your own personal information, to correct or delete it, or to object to its processing, you may also simply email privacy@indawoai.co.za (POPIA sections 23 to 25 and 11(3); POPIA Forms 1 and 2). Confirming whether we hold your information is free.
We will decide within 30 days and tell you in writing. We may extend this once by up to 30 days, with reasons (PAIA section 57). If we do not answer within the time, the request is regarded as refused.
Fees are set in Annexure B of the PAIA Regulations, 2021 (private bodies):
| Item | Fee |
|---|---|
| Request fee (not payable if you ask for your own personal information) | R140.00 |
| Photocopy or printed copy, per A4 page | R2.00 |
| Copy on flash drive (you provide) | R40.00 |
| Copy on compact disc (you provide / we provide) | R40.00 / R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Search and preparation, per hour or part, after the first hour | R145.00 (maximum R435.00) |
| Deposit if search and preparation take more than 6 hours | Up to one third of the access fee |
| Postage, email or electronic transfer | Actual cost, if any |
We will tell you the fees in writing before we do the work. Fees may change when the Regulations change.
We may or must refuse access in the cases set out in PAIA Chapter 4 of Part 3, including to protect: the privacy of other people (s63); commercial information of third parties (s64) and of Indawo (s68); confidential information of third parties (s65); the safety of people and property (s66); records privileged from production in legal proceedings (s67); and research information (s69). We will give reasons for any refusal. We must grant access if the public-interest override in section 70 applies.
There is no internal appeal for private bodies. If you are not satisfied with our decision, you may, within 180 days:
Complaints about how we process your personal information may be sent to the Information Regulator at POPIAComplaints@inforegulator.org.za or on the eServices portal.
We review this manual at least once a year and update it when our details or processing change.
Issued by the head of the private body: Mr D Mhlaba, Director · Date: 21 October 2026
