Legal
Privacy Notice
How Smart Station (Pty) Ltd handles personal information when you visit the GetShopSync website, contact us, or use the service. Read it with our Terms of Service and POPIA Information Notice.
Smart Station (Pty) Ltd · Last updated 30 July 2026
1. Who we are
Smart Station (Pty) Ltd provides GetShopSync, a business service for product information management. We are the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA") for the personal information described below where we decide why and how it is processed.
Where we process personal information only on a business customer's instruction — content inside their catalogue that happens to include a person's name, for instance — we act as an operator, and that customer remains the responsible party.
You can reach us about anything in this notice at privacy@getshopsync.com.
2. What this covers
- visitors to the GetShopSync website;
- people who submit a demo or contact form;
- authorised users of the GetShopSync application;
- people whose details appear in support correspondence.
It does not cover third-party sites we link to, which have their own notices.
3. What we collect
Website and enquiries
- Name, work email address, company, job title, and phone number if you give it.
- What you write in a form.
- Technical data: IP address, browser and device type, pages viewed, referring page, and timestamps.
- Your answer to the cookie banner, stored in your browser.
Accounts and use of the service
- Account profile: name, email address, and which account you belong to.
- An identifier from our identity provider. We do not store your password — there is no password of yours in our database.
- Your role and which catalogues you may access.
- Operational logs: feature use, API calls, errors, and security events.
- Billing data if you are a paying customer: plan, invoices and payment references. Card details are handled by our payment provider and are not stored in full by us.
- Support messages.
Content you put into the service
Product data, files, URLs, notes and configuration. This is business content. If it includes personal information, you control it as responsible party and we process it as operator to provide the service.
Capture features
When you use capture, we process the addresses and instructions you give, and the content retrieved from those pages is processed by us and by our AI provider to draft product fields.
The service is designed for product data. Do not put personal information into capture features unless you have a lawful basis for doing so.
4. Why we process it, and our lawful basis
| Purpose | Lawful basis under POPIA |
|---|---|
| Run the website and answer enquiries | Your consent, and our legitimate interest in responding to you |
| Provide and secure the service | Performance of our contract with you; legitimate interest in security |
| Bill and administer subscriptions | Performance of contract; legal obligation for tax records |
| Debug, prevent abuse, and plan capacity | Legitimate interest |
| Send business communications about the product | Consent where required, otherwise legitimate interest with an opt-out |
| Comply with the law and enforce our terms | Legal obligation; legitimate interest |
| Capture product content at your request | Performance of contract, on your instruction |
We do not process special personal information — health, biometrics, religious or political belief — as part of normal use. Please do not put it into the service.
5. Who we share it with
We use service providers who process personal information on our instruction, under written terms:
| What they do | Their role |
|---|---|
| Identity and authentication | Operator |
| Application hosting and managed database | Operator |
| Object storage for files and datasheets | Operator |
| AI processing for capture features | Operator |
| Payment and billing | Operator |
| Commerce platform you connect | A separate responsible party — your relationship with them |
We will name each current provider in writing on request to privacy@getshopsync.com. We publish the categories here rather than a list of names, because the list changes and a stale list is worse than none.
We may disclose information where the law requires it, or to protect rights, safety and security. We do not sell personal information.
6. Processing outside South Africa
Some of our providers operate outside the Republic of South Africa, including in the European Union and the United States.
Where we transfer personal information out of South Africa we do so under section 72 of POPIA — because the recipient is bound by a law or agreement giving an adequate level of protection, because you have consented, or because the transfer is necessary to perform our contract with you.
We are completing a full data-residency map covering every provider and the transfer basis for each. Until it is published, we will give you the current position in writing on request. We would rather say this plainly than claim a position we have not finished documenting.
7. Security
We apply technical and organisational measures appropriate to the service, including encryption in transit, access control, authentication through a specialist identity provider, separation between customers' data, logging, and validation of uploaded files.
No system is completely secure. You also need to protect your accounts, devices and API keys.
If personal information is compromised, we will notify the Information Regulator and affected people as POPIA requires.
8. Cookies
This website sets no analytics, advertising or tracking cookies. The only thing it stores in your browser is your answer to the cookie banner, so that we do not ask again — that is strictly necessary and cannot be switched off.
The signed-in application uses cookies that are strictly necessary to keep your session active.
If we ever add analytics, it will not load unless you allow it under Cookie preferences, and we honour a Global Privacy Control signal automatically. Our Cookie Policy has the detail.
9. How long we keep it
| What | How long |
|---|---|
| Enquiry and demo-request data | Up to 24 months, unless you become a customer |
| Account data | For the life of the account, plus a short wind-down period |
| Billing records | As long as tax and company law require |
| Security and operational logs | A limited operational period |
| Customer Content | As you direct, or until deletion after the account closes, subject to backup cycles and legal holds |
10. Your rights
Under POPIA you may:
- ask what personal information we hold about you and get a copy;
- ask us to correct information that is wrong or incomplete;
- ask us to delete or destroy information in certain circumstances;
- object to processing based on legitimate interest, and to direct marketing;
- withdraw consent where consent is the basis;
- complain to the Information Regulator.
To exercise any of these, email privacy@getshopsync.com with enough detail for us to identify you and find the information. We respond within the periods POPIA requires.
If you are an employee of one of our business customers and your request concerns their catalogue, please contact your own organisation first — they are the responsible party for that data, and we may redirect you to them.
11. Children
The website and the service are not directed at children under 18, and we do not knowingly collect their personal information.
12. Direct marketing
We may send business communications about GetShopSync to people who have enquired or who are customers, as POPIA and the Electronic Communications and Transactions Act allow. Every message carries an unsubscribe link, and you can opt out at any time by writing to us.
13. Automated decisions
We do not make decisions about individuals that have legal consequences by automated means alone. AI features in the product draft product content for your team to review. They are not used to profile people.
14. Changes
We may update this notice by publishing a new version with a revised date. Where a change is material we will highlight it.
15. Complaints
Please raise a concern with us first at privacy@getshopsync.com so we can try to resolve it. If you are not satisfied, you may complain to:
Information Regulator (South Africa)
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- P.O. Box 31533, Braamfontein, Johannesburg, 2017
- Complaints: complaints.IR@justice.gov.za
- https://inforegulator.org.za
Anything here you would like explained?
If a clause affects a decision you are making, ask us. We would rather answer it now than have you find out later.