Data Processing Terms

The short version

• Your customers' and staff's information is yours. We use it only to run Klyvelo for you, never for ourselves, and we never sell it.
• We keep it secure and confidential, and only the people and providers who need it can reach it.
• If something goes wrong, we tell you straight away and help you tell the Information Regulator and the people affected.
• We list every provider that helps us, and where it is. We tell you before we add one.
• When you leave, you can take everything with you, and then we delete it.

1. About these terms

• These Data Processing Terms are between your business (the shop that holds the Klyvelo account) and Klyvelo (Pty) Ltd, registration number 2026/842870/07. They are the written contract between a responsible party and an operator that sections 20 and 21 of the Protection of Personal Information Act, 2013 (POPIA) require.
• They form part of our Terms of Service. You accept both, and our Privacy Policy, by ticking the box when you create an account; we keep a record of which version you accepted and when. They apply on every plan, including Free. If these terms and the Terms of Service differ about personal information you hold in Klyvelo, these terms apply.
• They apply for as long as we hold any of that information for you, including after your account closes, until it is deleted.

2. Words we use

• "Shop personal information": personal information about your customers, members, staff and any other person that you or your staff put into Klyvelo, or that Klyvelo collects for you (for example when a customer signs up on their phone with your QR code).
• "Process", "responsible party", "operator", "data subject", "special personal information" and "consent" have the meanings POPIA gives them.
• "Sub-processor": a provider we use that processes shop personal information for us.
• "Security compromise": reasonable grounds to believe that shop personal information has been accessed or acquired by an unauthorised person (section 22).

3. Who is responsible for what

• Your shop is the responsible party for shop personal information. You decide what is collected, why, and for how long.
• Klyvelo is your operator. We process shop personal information for you, under your authority, and not for our own purposes.
• Where Klyvelo is a responsible party itself. For your account, billing and support details, and for our own security logs, Klyvelo is the responsible party, under our Privacy Policy. The same applies to one list: the mobile numbers that replied STOP to Klyvelo's WhatsApp number. We keep that list ourselves and honour it for every shop that sends through our number, so that one STOP works everywhere (section 10).

4. What we process, and why

5. Your shop's part

Because you are the responsible party, you agree to:

• have a lawful reason under section 11 of POPIA for each piece of information you keep, and keep no more than you need;
• tell your customers what you collect and why (section 18). The point of sale shows a privacy notice at the counter and on the sign-up page; if you write your own, it must still say that Klyvelo looks after the information for you;
• send offers and other direct marketing only to people who said yes to them, and honour every request to stop (section 69). Ask for consent the way the Regulations allow (Form 4, or a way that is just as clear), free of charge, and never treat silence or a pre-ticked box as a yes;
• get a parent's or guardian's consent before recording a child's information (section 35), and not enrol anyone under the legal age for any age-restricted goods you sell;
• answer your customers' and staff's requests to see, correct or delete their information, and their objections;
• register your own Information Officer with the Information Regulator, and report security compromises affecting your customers as section 22 requires;
• keep your staff's PINs and logins safe, and remove people who leave;
• give us only instructions that are lawful.

6. Only on your instructions

• We process shop personal information only with your knowledge or authorisation (section 20(a)), to provide the service. Your instructions are these terms, the settings you and your staff choose in Klyvelo, and what you ask of us in writing.
• We do not sell it, rent it out, use it to market to anyone, or use it to build profiles for ourselves or others. We do not use it, or any photo, to train artificial intelligence models, and we will not without your explicit consent.
• If the law requires us to process it in another way (for example a court order), we tell you first, unless the law forbids it.
• If we believe an instruction breaks POPIA, we tell you and may decline to follow it.

7. Confidentiality

We treat shop personal information as confidential and do not disclose it unless the law requires it or our duties as your operator need it (section 20(b)). Only Klyvelo staff who need it for their work can reach it, they are bound to keep it confidential, and they reach it only as described in section 11.

8. Security

We keep appropriate, reasonable technical and organisational measures in place to protect shop personal information against loss, damage, unauthorised destruction and unlawful access or processing, as section 19 requires and section 21(1) asks us to agree. We identify foreseeable risks, put safeguards in place, check that they work, and update them as risks change. The annex describes the main ones. We may improve them, but we will not make them weaker in a way that matters.

9. Security compromises

• If we have reasonable grounds to believe that shop personal information has been accessed or acquired by an unauthorised person, we tell you immediately, as section 21(2) requires, and in any event within 72 hours of becoming aware of it. We tell the owner and admins by e-mail and, where we can, by phone.
• We tell you what we know: what happened, when, what information and how many people are affected, what we have done and plan to do, and what you and the people affected can do.
• We help you notify the Information Regulator, through its eServices portal, and the people affected, as you must under section 22, and we give you the information you need for it. We do not notify your customers ourselves unless you ask us to, or the law or the Regulator requires it.
• We keep a record of every security compromise, what was affected and what we did.

10. Messages we send for you

• WhatsApp is switched off for now. Until it is on, your messages go by e-mail.
• Through Klyvelo's number. When WhatsApp is on, unless you set up your own WhatsApp number, your messages go from Klyvelo's WhatsApp Business number, using templates approved by Meta, and always name your shop. E-mails go from Klyvelo's mail server in South Africa, with your shop's name. E-mail is limited to 500 a month on Free and 5 000 on a paid plan (100 a day in a new business's first week).
• Consent is checked every time. Points and receipts go only to customers who said yes to them. Offers and "we miss you" messages go only to customers who said yes to offers. Each offer carries a way to stop (STOP on WhatsApp; in e-mail a one-click "Stop offers" link made for that member, which mail apps also show as their own Unsubscribe button, and our mail server refuses an offer without one). The stop link clears the member's marketing consent on your point of sale at once, with a dated note. Receipts and points updates carry no stop link; they say that the person asked for them.
• One STOP for all. When someone replies STOP to Klyvelo's number, we record it at once. From then on our number sends them no offers from any shop, and every shop that messaged them sees the consent withdrawn, with a note. Receipts they ask for still go. If they reply START, the block lifts, but you must record their consent again before you send offers.
• Timing and content are yours. You decide what an offer says and when it goes. Keep to the Consumer Protection Act's quiet times for direct marketing (no Sundays or public holidays; Saturdays only from 09:00 to 13:00; other days only from 08:00 to 20:00), and to Meta's WhatsApp Business policies. Automatic "we miss you" messages go at 10:00.
• Fair use of the number. We may block an offer that would break POPIA, Meta's policies or our Acceptable Use Policy, or would put Klyvelo's number at risk for other shops.

11. Support access

Klyvelo support staff can see your whole account, including your customers and sales, at any time and without asking first, so they can help you quickly. They change something only to fix your problem. Every look and change is logged with who, when and why, and shown on your Account page. A full ID number is opened only as section 4 describes. Our Terms of Service set out the full rules.

12. Sub-processors

You authorise us to use the sub-processors below. Each is bound by a written agreement that protects shop personal information at least as well as these terms (section 21), and we remain responsible to you for them.

Providers that never see shop personal information: Paystack and Yoco (your plan payments: they see the owner's e-mail address, the plan and the amount, never your customers), Expo (app updates), Google Fonts, and Google Analytics (on klyvelo.com only, with your consent, to count visits; never in the app, the counter or the console, and never your customers' data). They are listed in our Privacy Policy.

Providers you connect yourself are yours, not our sub-processors, and work under your own agreement with them. When you connect Xero or Sage Accounting, we send each trading day's sales to your accounting company as one invoice to "Klyvelo sales": never customers' names, numbers or e-mail addresses, and never single sales. When you connect the Yoco card-machine link (South Africa; not available yet), we read your Yoco orders, payouts, catalogue, staff, card machines and locations, and create orders and payment links for your sales; Yoco handles card payments under your own agreement with Yoco. The same applies to your own mail server or WhatsApp number.

Changes. We tell you by e-mail at least 30 days before we add or replace a sub-processor, and update this list. If you object on reasonable grounds and we cannot resolve it, you may cancel before the change and we refund any prepaid period left, pro rata. In an emergency (for example a provider failing) we may change sooner, and then tell you as soon as we can.

13. Information outside South Africa

Our database is in Ireland, and Meta, Cloudflare and Sentry work outside South Africa. We transfer shop personal information outside South Africa only as section 72 of POPIA allows: to recipients bound by a law, binding corporate rules or an agreement that gives protection substantially similar to POPIA's (Ireland and Germany are subject to the EU's General Data Protection Regulation, and every sub-processor is bound by a data processing agreement), or where the transfer is needed to perform the service you asked for. You agree that we may make these transfers to provide the service.

14. Helping you meet the law

• Customers' requests. The point of sale lets you find, show, correct, export and delete a customer's information, and record a withdrawn consent. If a customer or staff member asks us directly, we pass the request to you within one business day and do not answer it ourselves, unless the law requires otherwise or you ask us to.
• Impact assessments and the Regulator. We give you the information you reasonably need for your own personal information impact assessment, and help you answer the Information Regulator about your use of Klyvelo.
• Records. We keep a record of the processing we do for you, and of every support look and change, which you can see on your Account page.

15. When you leave

• You can export your data (sales, products, members and reports) as CSV files at any time, on any plan.
• When your account closes, you have 30 days to export. We then delete shop personal information from our database, and from our backups as they replace themselves: today within 14 days, and never later than 90 days. We then confirm the deletion in writing if you ask.
• We keep nothing of it afterwards, except where the law requires us to, and then only for as long as it requires and only for that reason.
• Data on your own devices stays there until you delete it or remove the app.

16. Checking that we comply

On reasonable notice, and no more than once a year unless there has been a security compromise, we answer your reasonable written questions about how we meet these terms, and give you a summary of our security measures and our sub-processors' commitments. If the Information Regulator asks you for information about our processing, we help you give it.

17. Liability and the rest

• The limits of liability in our Terms of Service (section 21: no indirect loss; a cap of the fees you paid us in the 12 months before the claim, counted once for the Terms of Service and these terms together; never for our gross negligence or fraud) apply to these terms too, as far as the law allows.
• We may update these terms when the law, the service or our sub-processors change. We tell you by e-mail at least 30 days before a change that matters to you; if you do not agree, you may cancel before it applies.
• These terms are governed by the law of South Africa.
• Questions about these terms go to our Information Officer, Jordan Richard Rudd, at our help address, or by post to our business address. Our business address will be published here.

Annex: our security measures