Veriflow Privacy Notice (website)
1. Who we are
1.1 This website is operated by Veriflow (Pty) Ltd, registration number 2023/584644/07, a private company incorporated in the Republic of South Africa, of 51 Ingersol Road, Lynnwood Glen, Pretoria, 0081, South Africa. For everything described in this notice, Veriflow is the responsible party within the meaning of section 1 of the Protection of Personal Information Act 4 of 2013 (POPIA).
1.2 You can reach us about anything in this notice at support@veriflow.co.za or +27 83 209 0827.
1.3 Information Officer. Our Information Officer is the head of Veriflow as section 1 of the Promotion of Access to Information Act 2 of 2000 (PAIA) defines it, read with POPIA, and is named in the Veriflow PAIA Manual. On this page the officer is reached by role, at support@veriflow.co.za, marked for the attention of the Information Officer. No personal mailbox is published here.
2. What this notice covers, and what it does not
2.1 One role, stated up front. This notice covers the personal information Veriflow collects and processes as responsible party through this website: the information you send us through it. It covers nothing else.
2.2 Verifications a client instructs are not covered by this notice. Where a business asks Veriflow to verify someone, that business decides who is verified and why. It is the responsible party for that verification, and the notification owed to the person being verified under section 18 of POPIA is that business’s to give. Veriflow is its operator. The role split is stated in the same words wherever Veriflow states it:
Veriflow acts in two distinct capacities under the Protection of Personal Information Act 4 of 2013. For every verification a client initiates, the client is the responsible party and Veriflow is its operator. For its own defined processing — account administration and client vetting, billing records, platform security and audit logs, its own legal compliance, and the screening database used for AML and PEP screening — Veriflow is the responsible party in its own right.
2.3 If a business asked you to verify your identity through Veriflow, start with that business: it can tell you why the verification was asked for and what happens next. We have written a page for you rather than for our business customers, at what this is, what happens to your information, and your rights under POPIA.
2.4 The screening database is dealt with separately and is not covered by this notice. Questions about it can be sent to our Information Officer at support@veriflow.co.za.
2.5 Client accounts are not covered by this notice. There is no sign-up, no account creation, no payment and no online contracting of any kind on www.veriflow.co.za. Information about a client’s account reaches Veriflow when the account is opened, not through these pages, and this notice does not describe it.
2.6 The client platform is not covered by this notice. The Veriflow client platform at veriflowportal.co.za is a separate domain, reached by logging in. This notice does not describe it and does not purport to say anything about what it collects. The Veriflow Website Terms of Use deal with the boundary between this website and that platform, at their clause 2.2.
3. Our regulatory status
3.1 Veriflow states its status in the same words wherever it does so. In the two statements below, “Client” means a business that uses Veriflow’s verification services, “Services” means those services, and “Result” means the result of a verification. The first concerns credit information:
Veriflow is not registered as a credit bureau under section 43 of the National Credit Act 34 of 2005 and does not conduct business as one. Veriflow does not receive reports of, investigate, compile, maintain, score or issue consumer credit information as defined in section 70(1) of that Act, and reports no information to any registered credit bureau or to the National Credit Register. Where a Result originates from a registered credit bureau, that bureau is and remains the author and issuer of that information and the party to whom the Client's certification of prescribed purpose is given.
3.2 The second concerns regulatory status and advice:
Veriflow holds no registration, licence, accreditation, authorisation, certification or approval from any regulator or standards body in respect of the Services, and does not hold itself out as holding any. Nothing in the Services, and no Result, constitutes legal or compliance advice or a determination that the Client has met any obligation under FICA, the NCA, POPIA or any other law.
4. What we collect, and why
4.1 There is exactly one place on this website where we collect personal information about you: the enquiry form at our contact page. It asks for your name, your work email address, your company, your phone number, a topic, and your message, and it carries a tick confirming that we may use those details to reply to you. The phone number is optional; everything else is needed for the form to be sent.
4.2 Why we collect it. To read your enquiry and to answer it, including arranging a quick demo if you ask for one. That is the whole purpose. We do not use what you send us for anything else, we do not sell it, and we do not add you to a marketing list without asking you separately.
4.3 Whether you have to give it, and what happens if you do not. Sending the form is entirely voluntary. Nothing on this website is withheld from you if you do not. The consequence of not giving us these details is simply that we cannot reply to you. You can phone us instead, on +27 83 209 0827.
4.4 Our lawful ground. Answering someone who has deliberately written to us rests on the legitimate interests ground in section 11(1)(f) of POPIA and, where you are enquiring for yourself (for example as a sole trader) about a possible contract, on section 11(1)(b). The tick on the form is not the lawful ground, and we do not present it as one: it is your permission to be contacted back on the details you typed, and your acknowledgement that you have read this notice. It is not consent to direct marketing, which clause 6.2 deals with.
4.5 What actually happens when you press send. The form posts to Veriflow’s own server, not to a third-party form service. Your enquiry is emailed to Veriflow and normally a copy is emailed back to you as an acknowledgement, so that you have a record of what you sent. There is no database, no account, no login session and no profile built from your enquiry. Your Internet Protocol address and your browser details are not recorded with it.
4.6 Protection against abuse. To stop the form being misused to send floods of email, it keeps short-lived counters of how often messages arrive from each Internet Protocol address and for each email address. Each counter is filed under a coded (hashed) value, not under the address itself, and holds only the times at which messages arrived. The addresses themselves are not stored, and old counts are cleared automatically. The form also uses a hidden field and a timing test to keep automated spam out; neither records anything about you.
6. Direct marketing
6.1 This website does not market to you. Veriflow runs no mailing list, no newsletter and no marketing automation from these pages. When you enquire, our follow-up answers your enquiry, which can include arranging a quick demo if you ask for one. No marketing is sent to you automatically, and we do not add you to marketing without asking you separately.
6.2 The tick on the enquiry form is not consent to marketing. Clause 4.4 says what it is and what it is not. Consent to direct marketing by electronic communication under section 69 of POPIA is a different thing. It would be asked for separately, in its own unticked box, and it is not asked for anywhere on this website.
6.3 What you do receive is not marketing. Our reply to your enquiry, and the acknowledgement the form emails back to you so that you have a record of what you sent, are the answer to your enquiry and nothing more. Neither goes to anyone who has not written to us first.
6.4 If that position changes. If Veriflow begins to market by electronic communication, this notice is updated first and consent is asked for afterwards, in that order (clause 14.4).
7. Who sees your information
7.1 Your enquiry is read by the Veriflow team. It is not sold, it is not shared with any Veriflow client, and it is not given to anyone outside Veriflow, save as set out in clause 7.2 and clause 7.3.
7.2 Veriflow uses ordinary business services to run this website and its email, and the people who provide them process what you send only on Veriflow’s instruction and for no purpose of their own. They are Veriflow’s operators, as POPIA uses that term. None of them is named on this page.
7.3 We will disclose an enquiry where the law requires us to, or where it is necessary for the establishment, exercise or defence of a right in law.
8. Sending information outside South Africa
8.1 This website makes no cross-border transfer of your information. It loads nothing from another company’s servers, so your browser contacts no third party because you visited it. The enquiry form posts to Veriflow’s own server and is delivered by email. It does not pass through a third-party form service, a scheduling service or an analytics service, because this website uses none of those, and there is no advertising tag and no tag manager on any page.
8.2 Where this website and its email are hosted. This website, and the mail service that delivers what you send through the enquiry form, are hosted in South Africa.
8.3 If that changes, section 72 of POPIA governs it. Section 72 permits a transfer of personal information outside the Republic only where one of the conditions it sets out is met. If Veriflow adopts a service that sends information abroad, this section is rewritten to name the recipient, the country and the condition relied on, and it is rewritten before that service goes live rather than after.
9. How long we keep it
9.1 Section 14 of POPIA is the rule we work to: personal information may not be kept for longer than is necessary to achieve the purpose it was collected for, unless a law requires or authorises a longer period. An enquiry is collected to answer an enquiry, so once that correspondence is over the information has served its purpose.
9.2 What that means in practice. This website has one collection point (the enquiry form), so the question here is a narrow one:
- An enquiry that goes nowhere. Kept only while it could still be of use to you or to us, for example if you come back to us about it. Once it is clear that nothing will come of it, we delete it.
- An enquiry that becomes a client relationship. Kept for as long as that relationship runs, and then for the periods the law requires of Veriflow’s own records, including under the Companies Act.
- Website server logs. We do not extract, copy or keep these ourselves. They are generated and held by our hosting provider under its standard practice, and we retain no separate copy. Deleting them is therefore its schedule, not ours.
9.3 What counts as necessary depends on what the record is, why we hold it, and whether it is still needed for an unresolved complaint, dispute or legal claim, or because the law requires us to keep it. Once none of those reasons applies, we do not keep it. If you want to know how long we are holding something of yours, ask us and we will tell you.
9.4 Enquiry correspondence sits in support@veriflow.co.za and is not forwarded or copied to any other mailbox. If you want to know what we hold about you, or want it deleted, section 11 tells you how to ask.
10. How we protect it
10.1 We take the appropriate, reasonable technical and organisational measures section 19 of the Protection of Personal Information Act 4 of 2013 requires: access control on a need to know basis, encryption of information in transit, logging and monitoring, formal change control, and periodic review of those measures against identified risks.
10.2 Where we have reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the affected people as soon as reasonably possible after discovering it, with the content section 22(5) of that Act requires.
11. Your rights under POPIA, and how to use them
11.1 In respect of the personal information this notice covers, you may:
- ask whether we hold personal information about you, and ask for a copy or a description of it (sections 23 to 25 of POPIA);
- ask us to correct or update it where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully (section 24 of POPIA);
- ask us to delete or destroy it where we are no longer entitled to keep it (also section 24 of POPIA);
- object to our processing it on reasonable grounds, where we rely on the legitimate interests ground (section 11(3) of POPIA). For an enquiry, telling us to stop is enough;
- withdraw a permission you gave us, at any time, without affecting anything lawfully done before you withdrew it.
11.2 How to exercise them. Email support@veriflow.co.za, marked for the attention of the Information Officer, and say what you want. Tell us the email address you wrote to us from, so that we can find the correspondence. Asking us whether we hold personal information about you, and being told yes or no, costs nothing. Where a fee is payable for a copy of a record, it is the fee prescribed under PAIA, and it is quoted to you in writing before any work is done, so that you can narrow the request or withdraw it instead.
11.3 A formal request for access to a record held by Veriflow is made under PAIA. The Veriflow PAIA Manual sets out that procedure, the forms, the fees and the limited grounds on which access may be refused, so this notice does not restate them.
12. Complaints to the Information Regulator
12.1 If you are unhappy with how we have handled your personal information or your request, please tell our Information Officer first, at support@veriflow.co.za. We would rather hear it from you than not.
12.2 You have the right, in any event, to complain to the Information Regulator (South Africa), which is established under section 39 of the Protection of Personal Information Act 4 of 2013, at https://inforegulator.org.za or through its eServices portal at https://eservices.inforegulator.org.za. You do not have to come to us first.
13. This notice is not a contract
13.1 This notice is not a contract and does not create contractual obligations. Where it is referenced in an agreement, the agreement governs.
14. Changes to this notice
14.1 We update this document whenever the position it describes changes, and it is reviewed annually in any event. The version number and the effective date at the head of this page tell you what you are reading.
14.2 An amendment is made by publishing a new version with a new version number and a new effective date. It is not made by a silent edit to this page, and it does not operate retrospectively.
14.3 Before any new version is published, the statements in section 5 are confirmed against this website as it is served, and not merely against its source files. Section 5 is a falsifiable public statement and it is treated as one.
14.4 A change that introduces anything requiring your consent will be made by publishing an updated notice first and then asking for consent, in that order. It will not be made by a silent edit to this page.