POPIA Information Notice

2. Whose information we process

1. 01Website visitors and people who enquire.
2. 02Authorised users at our business customers.
3. 03Our own suppliers and business contacts.
4. 04People who contact us for support.

3. What we process

GetShopSync does not require special personal information — health, biometric, religious or political. Please do not submit it.

4. Why we process it

• To run the website and answer enquiries.
• To create and administer accounts.
• To provide the product information management features themselves.
• To authenticate users and keep the service secure.
• To meter capture and subscription usage, and to invoice.
• To provide support.
• To improve reliability and prevent abuse.
• To comply with the law and enforce our agreements.
• To send relevant business communications, with an opt-out.

5. Giving us information is voluntary

You are not obliged to give us personal information. But without some of it — a work email address for authentication, for example — we cannot provide the service or respond to a demo request.

6. Who receives it

• Smart Station personnel who need it to do their work.
• Operators who host our identity, application, database, storage, AI, email and payment infrastructure.
• Professional advisers, under confidentiality.
• Regulators or law enforcement where the law requires it.
• A successor entity in a business transfer, subject to confidentiality and POPIA.

The current list of material operators is available from privacy@getshopsync.com on request.

7. Processing outside South Africa

Some operators hold infrastructure outside South Africa. Those transfers are made under section 72 of POPIA. Our Privacy Notice sets out the position, including that our full data-residency map is still being completed and that we will give the current position in writing on request.

8. Security safeguards

We apply measures appropriate to the risk: access control, authentication through a specialist identity provider, encryption in transit, separation between customers' data, validation of uploaded files, and limits on staff access.

You must also protect the credentials issued to your organisation.

9. Retention and destruction

We keep personal information only as long as we need it for the purposes above or as the law requires, and then destroy or de-identify it so that it cannot be reconstructed — subject to backup cycles and any legal hold. The retention table in our Privacy Notice sets out the periods.

10. Your rights, and how to use them

1. 01Email privacy@getshopsync.com.
2. 02Give us enough detail to verify who you are and to find the information.
3. 03Where POPIA permits, a prescribed fee may apply to an access request. We will tell you before doing the work.
4. 04We respond within the periods the law requires.

We may refuse a request on the grounds POPIA allows — for instance where complying would reveal another person's information or compromise the security of the service.

11. Direct marketing

We process contact details for electronic business marketing only as POPIA permits. You may opt out at any time, and we will not market to anyone who has opted out.

12. Automated processing

AI features generate draft product content for a person to review. They are not used to make automated decisions with legal consequences for individuals.

13. If you are our customer

You are normally the responsible party for personal information you put into your catalogue. That means:

• you need a lawful basis, and must give your own people whatever notice the law requires;
• you must not use the service to collect personal information unlawfully, including from third-party websites;
• you should configure user access on a least-privilege basis.

Smart Station acts as operator for that content, processing it only to provide the service on your instruction — except where we process data for our own purposes, such as billing and security.

14. Information Officer

Under POPIA the Information Officer of a private body is its head, and duties may be delegated to a deputy. Write to the Information Officer at privacy@getshopsync.com, marking your message for their attention.

15. The Information Regulator

If you are not satisfied with our response:

Information Regulator (South Africa)

• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Complaints: complaints.IR@justice.gov.za
• https://inforegulator.org.za