POPIA notice

• Client staff who use the platform: names, work email addresses, roles, permissions and a record of the actions each person takes.
• The client's customers, as they appear on orders: contact names, email addresses, phone numbers, WhatsApp numbers and messages, delivery addresses and account numbers.
• The client's suppliers, as they appear on delivery notes and proofs of delivery: contact names, driver names and signatures where printed.
• Website visitors and prospects: contact details, enquiry content and website usage information.

Personal information in orders and delivery notes is processed only to capture, read, match, review and post those documents into the client's ERP, to keep the audit trail the client needs, and to support the client's use of the platform. It is not used for any other purpose, and it is not sold. Website and prospect information is processed to reply to enquiries and run our business, as our privacy policy explains.

Orders and delivery notes keep their source documents for as long as the client holds the order, so the audit trail stays complete. Retention for client data is set in the client agreement. When the agreement ends, or on the client's instruction, client data is deleted or returned, subject to any retention the law requires.

• Each client runs in an isolated tenant, with sensitive fields such as customer names, account numbers, addresses and terms encrypted under that tenant's own keys.
• Uploaded documents are encrypted at rest.
• Access is controlled per user and per action, and every edit, approval, sync and deletion is recorded with the user and the time.
• Document content is treated by the AI as data, never as instructions.

If a security compromise affects personal information, Weeva notifies the affected client, and where Weeva is the responsible party, the Information Regulator and the people affected, as sections 21 and 22 of POPIA require.

Weeva uses sub-processors for hosting, AI models and messaging, some of which operate outside South Africa. Transfers follow section 72 of POPIA. The current list of sub-processors and the hosting region are set out in our security overview, which we share on request.

Anyone whose personal information Weeva processes may ask for access to it, ask for it to be corrected or deleted, object to its processing, and complain to the Information Regulator. If your information reached Weeva through one of our clients, for example because your name is on an order, direct your request to that client as the responsible party; Weeva will help them respond. For information where Weeva is the responsible party, contact our Information Officer.

Information Officer: Jordan Haskel. Email: [email protected]. Address: 4th Floor, The Piazza, 20 Whiteley Rd, Melrose North, Johannesburg, 2196, South Africa.

Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. POPIA complaints: [email protected].