Privacy policy
Last updated: 04 November 2026
Template content: This page is a starting draft, not a
finished legal document. Have a South African attorney review and
tailor it — particularly the liability, refund, and data-protection
sections — before relying on it in production.
Before going live, appoint an Information Officer (required under South Africa's Protection of Personal Information Act, POPIA), register them with the Information Regulator, and update this page with their contact details.
This policy explains what personal information BookASlot collects, why, and how it's protected, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
What we collect
- Account information: name, email address, mobile number, password (stored as a one-way hash, never in plain text)
- Booking information: services booked, dates, times, notes you add for a supplier
- Supplier business information: business name, description, category, location, staff details
- Payment and banking information: for suppliers, bank account details (encrypted at rest) and PayFast merchant credentials, used solely to enable customer payments to reach the correct account
- Communications: messages sent through the contact form, and delivery status of WhatsApp/email notifications
- Technical information: IP address and basic device information, collected automatically for security purposes (e.g. fraud prevention, rate-limiting)
Why we collect it
- To create and manage your account
- To process and confirm bookings, and send related notifications (WhatsApp/email)
- To enable payments between customers and suppliers
- To generate invoices and maintain records required for tax and accounting purposes
- To investigate reports made under our Abuse Policy
- To improve the platform and keep it secure
Who we share it with
- Suppliers and customers, with each other — only what's needed to fulfil a booking (e.g. a supplier sees the customer's name and contact details for their own bookings; a customer sees a supplier's public profile)
- PayFast — payment information necessary to process a transaction, when a customer pays by card
- WhatsApp / Meta — your mobile number and message content, when we send a WhatsApp notification via the WhatsApp Business API
- Service providers who help operate the platform (e.g. hosting), under obligations to protect your data
- Law enforcement or regulators, where required by law
We do not sell personal information to third parties.
How we protect it
Passwords are hashed, never stored in plain text. Supplier bank account numbers are encrypted at rest. Access to sensitive data (such as full banking details) is restricted to the account owner and authorised platform administrators. We recommend all users choose a strong, unique password.
Your rights under POPIA
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your information, subject to our legal obligations (e.g. retaining financial records for the period required by law)
- Object to certain processing, and withdraw consent where processing is based on consent
- Lodge a complaint with the Information Regulator of South Africa if you believe your information has been mishandled
To exercise any of these rights, contact us at admin@bookaslot.co.za.
Data retention
We retain account and booking information for as long as your account is active, and for a reasonable period after (or as required by South African tax and financial recordkeeping law) to resolve disputes and meet legal obligations.
Cookies
BookASlot uses session cookies to keep you logged in and to protect against certain security issues (such as cross-site request forgery). We don't currently use third-party advertising or tracking cookies.
Changes to this policy
We may update this policy from time to time; the date at the top reflects the most recent revision.
