Privacy Policy
In summary
- Each business controls its own customers’ information. We process it on the business’s behalf.
- We collect only what is needed to run the service and to respond to enquiries.
- PhesheOps data is stored, encrypted, in Ireland. Meta (WhatsApp) and Google (email) may process some information in other countries.
- We do not sell personal information or use it for advertising.
- You can ask to see, correct or delete your information, or object to its use, free of charge.
This summary is for convenience only. The full policy below applies.
This policy explains what personal information PhesheOps (Pty) Ltd ("PhesheOps", "we" or "us") handles, why, and what rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA). It applies to businesses that use PhesheOps, to the customers of those businesses who contact them through channels such as WhatsApp, and to people who contact PhesheOps directly, for example to book an introductory meeting.
1. Who is responsible
Information about a business's customers: each business that uses PhesheOps is the responsible party for its own customers' personal information. PhesheOps acts as an operator: we store and process that information on the business's behalf to provide the service.
Information you give PhesheOps directly: when you contact us, book an introductory meeting or sign up as a business, PhesheOps (Pty) Ltd is the responsible party for that information.
PhesheOps (Pty) Ltd, registration number 2026/558198/07, 5 Roman Place, Merrifield Park, Amalinda, East London, 5247, South Africa. Information Officer: Zintle Thandile Mgwelo, hello@phesheops.co.za.
2. What we handle and why
- Enquiries to PhesheOps (your name, business name, email address, phone number and what you tell us about your business), to reply to you and arrange an introductory meeting.
- Business account details (business name, contact details, settings), to set up and run the account.
- Staff sign-in details, so authorised staff can use the platform.
- Customer details (names and contact details), to manage bookings, orders and customer communication.
- Orders, appointments, invoices and payments, to run the business's day-to-day operations.
- WhatsApp messages sent to a business's connected number, as explained in section 3.
- Activity records, for audit, support and security.
Giving us your information is voluntary. If you do not give us the details we need, we may not be able to reply to your enquiry or provide the service. No law requires you to give this information to us.
We do not send marketing messages without your consent, and we do not sell personal information or use it for advertising.
3. WhatsApp messaging
We are introducing WhatsApp messaging and are completing Meta's approval process for it. When it is available, a business will be able to connect its own WhatsApp Business number to PhesheOps through Meta's WhatsApp Business Platform. This section explains how messages will be handled.
- Automated menu. When a customer messages the business, an automated menu inside WhatsApp helps them, for example to make an enquiry, ask for a quote, book an appointment or place an order.
- What the business sees in PhesheOps. Only conversations that lead to something the business must act on, such as an enquiry, a quote request, a booking or an order, appear in PhesheOps. The business sees the customer's phone number, WhatsApp name and that conversation, so it can reply.
- Other messages. We count how many messages each business sends and receives, to manage costs, but we do not show other conversations in PhesheOps.
- How long chat messages are kept. Chat messages are kept for 24 hours by default. A business can choose a longer period, for example when it is closed over a weekend or holiday. Enquiry chats that a business dismisses are kept for 90 days and then deleted. Enquiries, quotes, bookings and orders that a business keeps become part of its records under section 7.
- Business numbers. We keep a record of the WhatsApp numbers each business has connected.
- Product catalogue import. If a business chooses to, it can import the product catalogue from its WhatsApp Business account into PhesheOps, including product names, descriptions, prices and images. The business reviews and edits the items before they are saved. This is business information, not customers' personal information.
The business is the responsible party for its customers' WhatsApp messages. Meta also processes these messages under its own terms and privacy policy.
4. Where information is stored and sent
PhesheOps runs on Supabase, hosted on Amazon Web Services in Ireland. Information is therefore stored outside South Africa, in a country covered by the European Union's data protection law (GDPR). Information is encrypted while it is sent and while it is stored, and access is limited to authorised users and support staff with a legitimate need.
Some of the services in section 6 may also process information outside South Africa. In particular, WhatsApp messages are handled by Meta, and email is handled by Google, and both may process information in other countries, including the United States. These providers process information under their own data protection terms. We only send information outside South Africa where POPIA allows it, for example where it is needed to provide the service you have asked for.
5. Who can see it
- The business's own staff, according to their role.
- The PhesheOps administrator, only to provide support and resolve technical issues.
- No other business can see a business's data.
6. Services we use
To provide PhesheOps we use Supabase (hosting and database), Meta's WhatsApp Business Platform (to receive and send WhatsApp messages), Google Workspace (email), and the payment providers a business chooses to connect.
7. How long we keep it
Information is kept while the business uses PhesheOps. When a business stops using the service, it can export its data. After the export period, its identifiable data is deleted. Only an anonymised summary of how the service was used may be kept.
If you contact us but do not become a client, we keep your enquiry only for as long as we need it to respond to you, and then delete it.
8. Keeping information safe
We take reasonable technical and organisational steps to protect personal information. If we have reasonable grounds to believe that personal information has been accessed or acquired by someone without authority, we will notify the affected business as soon as possible so it can meet its own duties. Where PhesheOps is the responsible party, we will notify the Information Regulator and the people affected, as POPIA requires.
9. Your rights
You may ask to see the personal information held about you, to have it corrected or deleted, or to object to how it is used. Objecting, and asking for correction or deletion, is free of charge. If you are a customer of a business, you can ask that business, or write to us and we will pass your request to the right business.
To make a request, email hello@phesheops.co.za with the phone number or email address the information is linked to. We will respond within 30 days.
If you believe your rights have been violated, you may lodge a complaint with the Information Regulator of South Africa: inforegulator.org.za.
10. Changes to this policy
We may update this policy and will change the date above when we do.
11. Contact
General enquiries and data requests: hello@phesheops.co.za
Support: support@phesheops.co.za
Telephone: 063 401 6765