Privacy Notice
This notice explains how ZA TechLabs, trading as Mavecy handles personal information under the Protection of Personal Information Act, 2013 (POPIA), and how to use your rights.
1. Who handles your information
ZA TechLabs, trading as Mavecy is the responsible party for personal information used to run our own business, website, subscriptions and support. Our address is Cape Town, Western Cape, South Africa. Our Information Officer is the head of ZA TechLabs, as defined in PAIA. Contact the Information Officer at info@mavecy.com with "Privacy request" in the subject.
For personal information an organisation places in its own workspace, that organisation decides the purposes and means of processing, and Mavecy acts as its operator. We assist it under our Data Processing Agreement. If your employer, supplier or another business that uses Mavecy holds your records, contact that organisation, or ask us and we will pass your request on.
2. Information and sources
Depending on how you use Mavecy, we process account names, email addresses, phone numbers, organisation details, billing and payment references, support messages, device and connection information (such as IP address and browser), activity and security logs, and your preference choices. We receive this from you, your organisation's administrators, services you connect, our payment provider and your use of the service.
Customer workspaces may contain customer and supplier records, invoices, quotes, projects, receipts, bank details and employee or payroll records, which may include identity numbers, tax numbers, pay and leave information. Some uploads may contain special personal information. The customer must have the lawful basis and meet the extra conditions for that processing. Upload only what you need for an authorised purpose.
Payments. Subscription payments are made on PayFast's secure pages. Mavecy never receives or stores card numbers or card security codes. We keep the payment reference, amount, date, status and, for recurring payments, the subscription token PayFast gives us to manage the subscription.
3. Purposes and lawful grounds
We use information to create and secure accounts, provide the features you use, process subscriptions, give support, investigate errors and abuse, meet legal duties and handle disputes. Depending on the activity, the lawful ground is your consent, necessity to conclude or perform a contract, a legal obligation, or a legitimate interest that we have weighed against the rights of the people affected. Accepting the Terms is not treated as blanket consent to every use of personal information.
Required fields are marked when we collect them. Without the information needed to open an account, take payment or run a feature you asked for, we may not be able to provide it. Optional choices are shown separately. Marketing preferences are separate from essential account and service messages, and every marketing email has an unsubscribe link.
4. Recipients and international processing
We share information only with authorised staff and contracted providers as needed for the stated purpose: hosting and email, payments, and AI services when AI features are used. Connected integrations share information as described when you authorise them. We may disclose information where the law requires it or where it is needed for a lawful claim. A business transfer involving personal information would include confidentiality and privacy safeguards, and notice where required.
Our Subprocessors page lists the providers, purposes and locations. Hosting takes place in a data centre outside South Africa, AI processing takes place in the United States, and Google services (only if connected) may process information in the United States and other countries. For each transfer we rely on section 72 of POPIA, through provider agreements with data protection terms that give protection substantially similar to POPIA, or where the transfer is needed to perform the contract you asked for. We do not move information abroad on the assumption that a well known provider is enough.
5. Retention and security
| Records | How long |
|---|---|
| Live workspace records | While the subscription is active, then 30 days to export, then deleted or de-identified within 90 days of the subscription ending |
| Backups | Expire within 30 days after deletion from live systems |
| Subscription, payment and tax records | 5 years, as South African tax law requires |
| Support correspondence | 2 years after the last message |
| Security and access logs | 12 months |
| Demo requests from the website | 12 months, unless you become a customer |
We apply appropriate, reasonable technical and organisational safeguards, review foreseeable risks and control provider access. Security and Data Handling describes them. If a security compromise triggers notification duties, we act under section 22 of POPIA and our customer agreements.
6. Your rights and requests
Subject to applicable law, you may ask us to confirm whether we hold your personal information and to give you access to it, ask for correction or deletion, object to certain processing including direct marketing, withdraw consent for future processing based on consent, and not be subject to certain solely automated decisions. Withdrawing consent does not undo earlier lawful processing. Some records must be kept by law and some requests have legal limits.
Email info@mavecy.com. We may verify your identity and authority in a proportionate way. We respond within 30 days and explain any applicable procedure, lawful fee, restriction and the reasons for our decision. Ask us for a secure way to send identity documents or other sensitive records instead of attaching them to an ordinary email.
Automated decisions. Mavecy does not make solely automated decisions that have legal consequences or substantially affect people. AI features only prepare drafts and suggestions, and a person reviews and saves every result.
You may complain to the Information Regulator (South Africa) through its current complaints process at inforegulator.org.za. Our PAIA Manual explains how to request records. Cookies are described in the Cookie Notice.
7. Children
Mavecy is a business service for people aged 18 and over. We do not knowingly collect children's personal information for our own purposes. Customers who hold children's information in their workspace, for example in employee records, must meet the conditions POPIA sets for it.
8. Updates
The date at the top shows the latest revision. We tell affected people about material changes by email or in the app. A new purpose that needs extra notice, consent or another legal step is dealt with before that processing starts.