Privacy Policy

This Privacy Policy explains how Ordify (PTY) Ltd trading as Ordify ("Ordify", "we", "us", or "our") collects, uses, stores, and protects personal information when you use the Ordify application, website, and related services (collectively, the "Services").

This policy is drafted on the basis that the personal information Ordify collects is limited to email addresses and phone numbers. If Ordify later collects additional personal information, this policy should be updated before publication.

For South African privacy law purposes, Ordify is the "responsible party" for personal information it processes for its own business purposes.

Ordify may also, in some circumstances, process personal information as an "operator" on behalf of a customer or organization that uses the Services. Where another organisation is the party responsible for the relevant personal information, that organisation remains primarily responsible for deciding why and how the information is processed and for handling certain data subject requests.

1. South African Privacy Framework

Ordify intends this Privacy Policy to align with the Protection of Personal Information Act, 2013 ("POPIA"), including the conditions for lawful processing of personal information.

Where POPIA applies, Ordify aims to process personal information in line with the principles of:

• accountability;
• processing limitation and minimality;
• purpose specification;
• further processing limitation;
• information quality;
• openness;
• security safeguards;
• data subject participation.

2. Scope

This Privacy Policy applies to personal information collected through the Services, including when:

• a customer account is created or managed;
• a user signs in and uses the platform;
• a user contacts Ordify for support or account-related matters; or
• Ordify uses limited technical tools required to secure and operate the Services.

Where Ordify acts only as an operator on behalf of a customer organisation, some privacy rights requests may need to be directed to that customer organisation as the party responsible.

3. Information We Collect

Ordify currently collects and stores the following categories of personal information:

• email addresses;
• phone numbers.

Ordify may also process limited non-personal technical information necessary to run the Services, such as browser, device, session, and security event data. Where that information identifies or can reasonably be linked to a person, we treat it as personal information.

Ordify does not intentionally seek to collect special personal information as described in POPIA, or personal information relating to children. If such information is submitted to Ordify unintentionally, please contact us so that we can assess and address it appropriately.

4. How We Collect Information

We collect information:

• directly from you;
• from your organisation, account administrator, or another authorised representative when account details are provided to Ordify on your behalf;
• when you use the Services;
• automatically through cookies or similar technologies that are required for authentication, security, preferences, and service reliability.

Where personal information is not collected directly from you, Ordify will take reasonably practicable steps to provide the notice required by applicable law, unless an exception under POPIA applies.

5. Why We Process Personal Information

Ordify processes personal information only where there is a lawful basis to do so under POPIA, including where:

• you or a competent person has consented to the processing;
• the processing is necessary to conclude or perform a contract;
• processing complies with an obligation imposed by law;
• the processing protects a legitimate interest of the data subject;
• the processing is necessary for pursuing the legitimate interests of Ordify or of a third party to whom the information is supplied.

6. How We Use Information

Ordify uses personal information only for legitimate business purposes connected to operating the Services, including:

• create and manage user accounts;
• allow users to sign in and securely access the Services;
• communicate with users about their accounts or service-related matters;
• provide customer support;
• maintain, secure, troubleshoot, and improve the Services;
• comply with legal obligations and enforce our contractual rights.

Ordify does not sell personal information. Ordify does not use email addresses or phone numbers for advertising, profiling, or unrelated marketing.

Ordify does not currently use personal information for unsolicited direct marketing by electronic communications. If that changes, Ordify will do so only in compliance with POPIA.

7. When Providing Information Is Voluntary or Mandatory

Providing email addresses and phone numbers may be necessary for account creation, authentication, support, and ordinary operation of the Services.

If the required information is not provided, Ordify may not be able to create an account, verify a user, provide access to the Services, or respond properly to account-related requests.

8. How We Share Information

Ordify does not sell, rent, or trade personal information.

Ordify may share personal information only:

• with service providers that help us host, secure, maintain, or support the Services;
• where required by law, court order, or lawful request from a regulator or authority;
• where necessary to establish, exercise, or defend legal claims;
• in connection with a merger, acquisition, financing, reorganization, or sale of all or part of the business, subject to appropriate confidentiality and lawful handling requirements.

Any service provider that processes personal information on Ordify's behalf must be authorized to do so only for the relevant business purpose and subject to appropriate confidentiality and security obligations.

Where Ordify uses a third party to process personal information on its behalf, Ordify will take reasonable steps to ensure that the operator implements appropriate security safeguards and only processes the information on Ordify's instructions, as required by POPIA.

9. Data Retention

Ordify keeps personal information only for as long as reasonably necessary to:

• provide the Services;
• maintain account records;
• comply with legal, regulatory, tax, accounting, or security requirements;
• resolve disputes and enforce agreements.

When personal information is no longer required, Ordify will delete it, anonymize it, or securely isolate it, unless continued retention is required by law.

Ordify intends not to retain records of personal information for longer than is necessary to achieve the purpose for which the information was collected or further processed, subject to lawful retention requirements or permitted retention under POPIA.

10. Information Quality

Ordify takes reasonable steps to help ensure that personal information it processes is complete, accurate, not misleading, and updated where necessary, having regard to the purpose for which the information is processed.

Users and customers should also inform Ordify if their contact details change or if any stored information is inaccurate.

11. Security

Ordify uses reasonable technical and organizational measures designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction.

These measures may include access controls, authentication protections, security monitoring, and other safeguards appropriate to the nature of the Services. No system is completely secure, and Ordify cannot guarantee absolute security.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorized person, Ordify will investigate and, where required by law, notify the Information Regulator and affected data subjects as soon as reasonably possible.

12. International Transfers

Ordify may use infrastructure, hosting, or service providers located outside South Africa.

Where POPIA applies to a cross-border transfer, Ordify will take reasonable steps to ensure that personal information is transferred outside South Africa only where permitted by POPIA, including where:

• the recipient is subject to a law, binding corporate rules, or binding agreement that provides an adequate level of protection;
• the data subject consents to the transfer;
• the transfer is necessary for performance of a contract or implementation of pre-contractual measures for the benefit of the data subject; or
• the transfer otherwise falls within a lawful ground recognised by POPIA.

13. Your Rights Under POPIA

Subject to POPIA and any applicable limitations, a data subject may have the right to:

• be notified that personal information is being collected;
• be notified where personal information has been accessed or acquired by an unauthorised person, where required by law;
• request confirmation of whether Ordify holds personal information about you;
• request access to your personal information;
• request correction, deletion, or destruction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, unlawfully obtained, or no longer authorised to be retained;
• object, on reasonable grounds relating to your particular situation, to certain processing;
• object at any time to processing for direct marketing by unsolicited electronic communications;
• lodge a complaint with the Information Regulator;
• institute civil proceedings where allowed by law.

To exercise any of these rights, contact Ordify's Information Officer using the details in Section 16.

Where applicable, requests may need to be made in the prescribed manner and with adequate proof of identity.

14. Children's Privacy

The Services are intended for business and professional use and are not directed to children. Ordify does not knowingly collect personal information from children.

15. Changes to This Policy

Ordify may update this Privacy Policy from time to time. If we make a material change, we will update the effective date above and, where appropriate, provide additional notice through the Services or by other reasonable means.

16. Contact Details

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact Ordify's Information Officer:

17. Information Regulator Contact Details

If you believe that Ordify has interfered with the protection of your personal information, you may also lodge a complaint with the Information Regulator (South Africa):