This notice explains what personal information VendorLedger holds, why, where it is kept and the rights you have under the Protection of Personal Information Act (POPIA).
Who we are
VendorLedger is operated by [registered company name, registration number and address] (“we”). Our information officer is [name and email address].
For the information a company keeps in its VendorLedger workspace (its catalogue, suppliers, supplier contacts, requests for quotation, purchase orders and files), that company decides what is kept and why, and we process it on its behalf. For the accounts of people who sign in, we decide, and this notice applies to us directly.
What we hold
- Your account: your name, email address, the date you accepted the terms, your display preferences and, if you turn it on, your two-factor authentication setting. Your password is stored only in a form that can’t be read back.
- Sign-in sessions: the device and approximate location of each session, and when it was last used, so you can see and end your sessions.
- Workspace membership: which workspaces you belong to, your role, and a record of what you do in them (for example, who issued a purchase order and when).
- Supplier contacts: the names, roles, email addresses and phone numbers that a workspace records for its suppliers, and what a supplier enters when responding through a supplier link.
- Emails we send for a workspace: the recipients, subject and delivery status of each message.
- Files and addresses: documents and images uploaded to a workspace, and delivery addresses, including address searches.
- Technical information: server logs, including IP addresses, and the bot check on the sign-in and sign-up pages.
Why we use it
- To provide VendorLedger to your workspace and keep it working.
- To keep accounts and workspaces secure: sign-in, two-factor authentication, limits on repeated attempts and the activity record.
- To send the emails a workspace asks us to send, such as requests for quotation and purchase orders, and to tell members about their account and workspace.
- To answer support requests.
- To bill for paid plans, once they are offered.
We don’t sell personal information, use it for advertising, or send marketing on behalf of anyone else.
Cookies
VendorLedger uses only the cookies it needs to work: one that keeps you signed in and one that remembers your light or dark theme. There are no tracking or advertising cookies.
Where it is kept
VendorLedger’s database, files and servers are in London, in the United Kingdom, so personal information is transferred outside South Africa. We do this under agreements with our service providers that protect it to the standard POPIA requires. [confirm once the data processing agreements are signed]
Service providers
- Supabase: database, sign-in and file storage (London).
- Vercel: hosting of the application (London).
- Resend: delivery of the emails VendorLedger sends.
- Cloudflare Turnstile: the bot check on sign-in and sign-up.
- Google Maps Platform: address search. Google’s privacy policy applies to the searches.
- Paystack: card payments, once paid plans are offered.
- Sentry: error reporting, once it is in use.
How long we keep it
- Your account, for as long as you have one.
- A workspace’s information, for as long as its subscription is active. After it is cancelled, the workspace stays read-only for 90 days so it can be exported, and is then deleted.
- Backups, for [backup retention period].
Your rights
You can ask to see the personal information we hold about you, to have it corrected or deleted, or object to how it is used. For your account, write to our information officer. For information a workspace holds about you, such as a supplier contact, ask that company: we help it respond. If you are not satisfied, you can complain to the Information Regulator.
Security
Information is encrypted in transit, files are private and served only to signed-in members of their workspace, and each workspace’s information is kept separate from every other’s.
Changes
When this notice changes, the version above changes. [how members are told]