Privacy Policy
1. Who we are
Indawo AI is a hospitality booking and front-office platform for South African B&Bs, guesthouses, lodges and hotels. It is operated by Envy Fincorp (Pty) Ltd t/a Indawo AI, registration number 2021/756475/07, 102 Churchill Street, Wendywood, Johannesburg (“Indawo AI”, “we”, “us”).
Information Officer: Mr D Mhlaba. Email: accounts@indawoai.co.za.
We process personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
2. Our two roles
(a) Responsible party. We decide how and why personal information is used for people who visit our website, chat to Ask Indi, contact us by email, WhatsApp or social media, sign up for or use an Indawo AI account (property owners, managers and staff users), and our suppliers.
(b) Operator for properties. When a property uses Indawo AI to manage its bookings, we process its guests’ information on behalf of that property, as its operator under POPIA sections 20 and 21 and a written operator agreement. The property is the responsible party and its own privacy notice applies. If you are a guest and want to access, correct or delete your booking information, please contact the property. If you contact us instead, we will pass your request to the property promptly.
3. What personal information we process
Property owners, managers and staff users (account data)
- Business and billing details, and the details of the person who signs up for the business (name, role, email, cell number and, where needed to verify authority, ID or passport number).
- User names, email addresses, cell numbers and roles of staff who use the app.
- Sign-in and security records: one-time codes (stored only in hashed form), login times, IP address, device type and audit records of changes made in the app.
- Support requests and our correspondence with you; proof of business address; bank details if you pay by debit order.
Guests of properties (processed as operator)
- Booking details (names, dates, rooms, number of guests, amounts and payment status), contact details, special requests, messages with the property, online check-in details and reviews, as the property decides to collect them.
Website, WhatsApp and social media enquiries
- Website and Ask Indi: the questions you type and, if you use the enquiry form, your name, property name, email or phone number and the consent you gave.
- WhatsApp: when you message us on WhatsApp, we receive your messages through Meta’s WhatsApp Business Platform (WhatsApp Cloud API). This includes your WhatsApp phone number, your WhatsApp profile name, the content of your messages and any media or files you send, the date and time, and delivery and read status of messages.
- Social media: if you message or comment on our social media pages (for example Facebook or Instagram, operated by Meta), we receive your profile name, your message and any details you choose to share.
- Email: your name, email address and what you write to us.
Website visitors
- Technical data in our web server logs: IP address, browser type, pages requested and the time of the request.
We do not knowingly collect personal information from children through our website or messaging channels.
4. Why we use it (purposes)
- To answer your enquiries, including WhatsApp, email and social media messages, arrange demos and prepare quotes.
- To open, run and support Indawo AI accounts, verify that the person signing up is authorised, and bill for our services.
- To provide the booking and front-office service to properties, including processing guest booking data on their instructions.
- To keep our systems and your account secure, prevent fraud and abuse, and fix faults.
- To send service messages about your account (these are not marketing).
- To send marketing only where POPIA allows it (see section 5); every marketing message has a free way to opt out.
- To meet our legal obligations, for example tax and accounting records.
We do not sell personal information. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (POPIA section 71).
5. Lawful basis
We process personal information only on a basis allowed by POPIA section 11:
- Contract (s11(1)(b)): to take steps you ask for before a contract (for example a quote or demo), and to provide the service under our agreement with a property.
- Legal obligation (s11(1)(c)): for example tax and accounting records.
- Legitimate interest (s11(1)(f)): to answer enquiries you send us, keep our services secure and improve our help content. You may object to this processing (see section 10).
- Consent (s11(1)(a)): for example the Ask Indi enquiry form and electronic marketing to people who are not our clients (POPIA s69). You can withdraw consent at any time; this does not affect processing that already took place.
- Operator processing: for guest data, we act on the property’s instructions under a written operator agreement (s20 and s21); the property is responsible for having a lawful basis.
7. Transfers outside South Africa
Our main servers are in South Africa. Some service providers, including Meta (for WhatsApp and social media messaging) and some booking channels, process information in other countries, such as the United States and the European Union. We transfer personal information outside South Africa only where POPIA section 72 allows it, for example where the recipient is bound by laws, binding corporate rules or an agreement that give adequate protection, or where the transfer is needed to deliver a service you asked for (such as sending and receiving your WhatsApp messages).
8. How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for, or as the law requires (POPIA section 14). In general:
- Enquiries (website, Ask Indi, email, WhatsApp, social media): up to 12 months after our last contact, unless you become a client.
- Account data: for the life of the account; billing and tax records for 5 years after that, as tax law requires; ID numbers, bank details and proof of address are deleted 90 days after the account ends and all amounts are settled.
- Guest data processed for a property: for as long as the property’s agreement with us lasts and as the property instructs; it is deleted from our live systems after the agreement ends, and from backups afterwards, in line with the operator agreement.
- Web server logs: 30 days.
We may keep information longer where we must by law or where there is a legal dispute.
9. Security
We use reasonable technical and organisational measures to protect personal information (POPIA section 19), including encrypted connections (HTTPS), encryption of sensitive fields such as ID and bank details, role-based access, strong authentication for administrators, audit logs, backups and staff confidentiality undertakings. No system is completely secure. If we believe your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as POPIA section 22 requires.
10. Your rights
Under POPIA you have the right to:
- Access: ask whether we hold personal information about you and request a copy (POPIA s23; our PAIA Manual explains how).
- Correction: ask us to correct information that is inaccurate, out of date or incomplete (s24).
- Deletion: ask us to delete information we are no longer allowed to keep (s24). See section 11.
- Objection: object to processing based on legitimate interest, and object to direct marketing at any time (s11(3)).
- Withdraw consent where we rely on consent.
- Complain to the Information Regulator (see section 12).
To use any of these rights, email accounts@indawoai.co.za. We may ask you to confirm your identity before we act on a request, so that we do not disclose or delete someone else’s information.
11. How to ask us to delete your data
You can ask us to delete the personal information we hold about you, including your WhatsApp messages and contact details:
- Email accounts@indawoai.co.za with the subject “Data deletion”.
- Tell us your name and the email address and/or WhatsApp phone number you used to contact us, and what you would like deleted.
- We may ask you to confirm your identity. We will then delete the information, or explain if the law requires us to keep any of it (for example tax records), and confirm to you in writing. We aim to complete requests within 30 days.
If you are a guest of a property that uses Indawo AI, the property controls your booking information. Please contact the property directly; if you email us, we will forward your request to the property.
You can also stop receiving WhatsApp messages from us at any time by replying “STOP” or by blocking our number in WhatsApp.
12. Complaints and the Information Regulator
Please contact our Information Officer first at accounts@indawoai.co.za so that we can try to help. You also have the right to lodge a complaint with the Information Regulator (South Africa):
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Phone: 010 023 5200 · Toll free: 0800 017 160
- General enquiries: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- Website: inforegulator.org.za
14. Changes to this policy
We may update this policy from time to time. We will publish the updated version on this page with a new effective date. If a change materially affects our clients, we will also tell account owners by email.
15. Contact us
Envy Fincorp (Pty) Ltd t/a Indawo AI, reg. 2021/756475/07
102 Churchill Street, Wendywood, Johannesburg
Information Officer: Mr D Mhlaba
Email: accounts@indawoai.co.za