1. Introduction and Purpose
This POPIA Compliance Manual (“Manual”) has been prepared by Instabiz (Pty) Ltd, trading as InstaBiz, in accordance with the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA) and its associated regulations.
The purpose of this Manual is to:
- Describe how InstaBiz collects, processes, stores, and protects personal information
- Explain the rights of data subjects and how those rights may be exercised
- Identify the Information Officer responsible for POPIA compliance
- Describe the categories of personal information held and the purposes for which it is processed
- Identify third-party operators who process personal information on behalf of InstaBiz
- Set out the measures taken to ensure the security and integrity of personal information
This Manual must be read together with InstaBiz’s Privacy & Cookie Policy and Information Officer page, which provide additional detail on specific processing activities.
2. Responsible Party Details
The responsible party — the entity that determines the purpose and means of processing personal information — is:
| Registered Legal Name | Instabiz (Pty) Ltd |
| Trading Name | InstaBiz |
| Registration Number | 2021/365293/07 |
| Physical Address | Ashley Drive, Gillitts, Durban, KwaZulu-Natal, 3610 |
| Telephone | +27 65 966 4042 |
| Email Address | hello@instabiz.co.za |
| Website | https://new.instabiz.co.za |
3. Information Officer
In terms of Section 1 and Section 55 of POPIA, InstaBiz has designated the following person as its Information Officer. The Information Officer has been registered with the Information Regulator of South Africa as required by POPIA.
| Information Officer | Trevor Roberts |
| Email Address | info@instabiz.co.za |
| Telephone | +27 68 620 6618 |
The Information Officer is responsible for:
- Ensuring compliance with POPIA across all processing activities
- Responding to requests from data subjects within prescribed timeframes
- Liaising with the Information Regulator where required
- Maintaining and updating this Manual and related policies
- Implementing and overseeing internal data protection measures
4. Categories of Data Subjects
InstaBiz processes personal information relating to the following categories of data subjects:
| Website Visitors | Persons who access the InstaBiz website, including anonymous visitors whose technical data is collected automatically |
| Clients and Customers | Individuals and business representatives who purchase or enquire about products and services from InstaBiz |
| Registered Users | Persons who have created an account on the website or the community platform |
| Course Students and Learners | Persons who enrol in or access online learning programmes offered through the website |
| Newsletter Subscribers | Persons who have subscribed to receive marketing or informational communications from InstaBiz |
| Suppliers and Service Providers | Representatives of third-party organisations with whom InstaBiz has a business relationship |
| Community Members | Persons who participate in the online community platform hosted on the website |
5. Categories of Personal Information Processed
| Identity Information | First name, last name, company name, username |
| Contact Information | Email address, telephone number, physical address |
| Account Information | Username, encrypted password, account preferences, profile information |
| Transaction Information | Order history, invoice details, products and services purchased, payment confirmation references |
| Technical Data | IP address, browser type, operating system, device type, access times, referring URLs |
| Usage Data | Pages visited, time on site, links clicked, course progress and completion data |
| Communications | Enquiries, support requests, community posts, messages, and feedback submitted to InstaBiz |
| Call Records | Telephone number, call duration, and call direction (inbound/outbound) where VoIP telephony services are used |
| Marketing Preferences | Newsletter subscription status, communication preferences, consent records |
InstaBiz does not process special personal information as defined in Section 26 of POPIA (including information relating to religious beliefs, race, health, sexual orientation, criminal behaviour, or biometric data) in the ordinary course of its business.
6. Purposes of Processing
Personal information is processed by InstaBiz for the following purposes:
- Creating and managing user accounts and access to the website and community platform
- Processing and fulfilling orders, payments, and transactions for products and services
- Delivering websites, software, online learning, and compliance services to clients
- Communicating with clients and users regarding their accounts, orders, and service requests
- Sending marketing and promotional communications where consent has been obtained
- Administering the online community platform, forums, and course environment
- Analysing website usage to improve the Site and its services
- Detecting, preventing, and investigating fraud, security incidents, and policy violations
- Complying with legal and regulatory obligations under applicable South African law
- Managing supplier and service provider relationships
- Maintaining telephony call records for business administration purposes
7. Lawful Basis for Processing
All processing of personal information by InstaBiz is conducted on one or more of the following lawful grounds as provided for in POPIA:
- Consent (Section 11(1)(a)) — where the data subject has given express consent, including for direct marketing and non-essential cookies
- Contractual necessity (Section 11(1)(b)) — where processing is necessary to fulfil a contract with the data subject or to take steps at the data subject’s request prior to entering into a contract
- Legal obligation (Section 11(1)(c)) — where processing is necessary to comply with a legal obligation, including tax record retention under South African revenue law
- Legitimate interest (Section 11(1)(f)) — where processing is necessary for the legitimate interests of InstaBiz, including fraud prevention, network security, and service improvement, provided such interests are not overridden by the data subject’s rights
8. Third-Party Operators
InstaBiz makes use of the following third-party operators who process personal information on its behalf. All operators are required to process personal information only as instructed by InstaBiz and to maintain appropriate security measures.
8.1 Payment Processing — PayFast
| Provider | PayFast (Pty) Ltd |
| Country | Republic of South Africa |
| Purpose | Secure payment processing for online transactions. InstaBiz does not store financial information — all payment data is handled directly by PayFast. |
| Website | payfast.io |
8.2 Payment Processing — Paystack
| Provider | Paystack Payments Ltd |
| Country | Republic of South Africa / Nigeria |
| Purpose | Secure payment processing for online transactions. InstaBiz does not store financial information — all payment data is handled directly by Paystack. |
| Website | paystack.com |
8.3 Website Analytics — Google Analytics
| Provider | Google LLC |
| Country | United States of America |
| Purpose | Website usage analytics — tracking page views, user behaviour, and traffic sources to improve the Site. Personal information is anonymised where possible. IP anonymisation is enabled. |
| Data Protection Framework | Google LLC participates in the EU-US Data Privacy Framework and maintains Standard Contractual Clauses for cross-border transfers. |
| Website | policies.google.com/privacy |
8.4 Background Data — CDNs, etc.
| Provider | Various |
| Country | Republic of South Africa and International |
| Purpose | Our website makes use of plugins and tools not developed by us and these may share anonymous statistics for things like updates and so on. In the case of such plugins and tools we have no direct control of how or where that data is transmitted or stored. |
9. Cross-Border Transfers of Personal Information
In terms of Section 72 of POPIA, personal information may only be transferred to a third party in a foreign country if that country ensures an adequate level of protection for personal information, or if appropriate safeguards are in place.
InstaBiz transfers personal information outside the Republic of South Africa in the following instances:
| Destination | Country | Purpose | Safeguard |
| Unlimited Web Hosting Ltd | United Kingdom | Web, email and domain hosting | UK GDPR — adequate protection recognised |
| Google LLC | United States | Website analytics | EU-US Data Privacy Framework / Standard Contractual Clauses |
| Pusher Ltd (conditional) | United Kingdom | Real-time chat (if activated) | UK GDPR — adequate protection recognised. Not currently active. |
10. Data Retention
InstaBiz retains personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The following retention guidelines apply:
| Account and profile information | Duration of account plus 3 years after closure |
| Transaction and invoice records | 5 years — South African tax and accounting requirements |
| Client project records and communications | 5 years from project completion |
| Support and general communications | 3 years from date of last communication |
| Marketing consent records | Until consent is withdrawn |
| Website analytics data | 26 months |
| Call records (VoIP) | 12 months |
| Course and learning records | Duration of enrolment plus 3 years |
Upon expiry of the applicable retention period, personal information will be securely deleted or anonymised.
11. Security Measures
InstaBiz implements appropriate technical and organisational security measures to protect personal information against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:
- Encryption — all data transmitted through the Site is encrypted using SSL/TLS protocols. Passwords are stored in encrypted form and are never stored in plain text.
- Access controls — access to personal information is restricted to authorised personnel on a need-to-know basis
- Hosting security — servers are maintained by Unlimited Web Hosting Ltd in the United Kingdom, subject to UK GDPR security requirements
- Software updates — the WordPress platform and all plugins are kept up to date to address known security vulnerabilities
- Backups — regular automated backups are maintained to enable data recovery in the event of a security incident
- Payment security — no financial data is stored by InstaBiz. All payment transactions are processed through PCI-DSS compliant payment processors
Notwithstanding these measures, no electronic system is completely secure. In the event of a data breach that poses a risk to the rights of data subjects, InstaBiz will notify affected data subjects and the Information Regulator as required by Section 22 of POPIA.
12. Rights of Data Subjects
In terms of POPIA, data subjects whose personal information is processed by InstaBiz have the following rights:
- Right of access (Section 23) — the right to request confirmation of whether InstaBiz holds personal information about you, and to receive a copy of that information
- Right to correction or deletion (Section 24) — the right to request that inaccurate, irrelevant, excessive, outdated, or misleading personal information be corrected, destroyed, or deleted
- Right to object (Section 11(3)) — the right to object to the processing of personal information on reasonable grounds, including objection to direct marketing
- Right to withdraw consent (Section 11(1)(a)) — where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing
- Right to complain (Section 74) — the right to submit a complaint to the Information Regulator of South Africa if you believe your personal information has been processed in violation of POPIA
To exercise any of these rights, please contact the Information Officer:
| info@instabiz.co.za | |
| Telephone | +27 68 620 6618 |
We will respond to your request within a reasonable time and in accordance with the timeframes prescribed by POPIA.
13. Complaints and the Information Regulator
If you are not satisfied with how InstaBiz has handled your personal information or a request, you may lodge a complaint with the Information Regulator of South Africa:
| Name | Information Regulator of South Africa |
| Website | https://inforegulator.org.za |
| General Enquiries | inforeg@justice.gov.za |
| Complaints | complaints.IR@justice.gov.za |
14. Children’s Personal Information
InstaBiz does not knowingly collect personal information from persons under the age of 18. The Site and its services are intended for adults. If InstaBiz becomes aware that personal information has been collected from a minor without appropriate consent, it will take immediate steps to delete that information. Parents or guardians who believe their child’s personal information has been collected should contact the Information Officer immediately.
15. Direct Marketing
InstaBiz may use personal information for direct marketing purposes only where the data subject has consented to receive such communications, or where InstaBiz has obtained the contact details in the context of a prior sale of products or services and the communication relates to similar products or services, as provided for in Section 69 of POPIA.
Data subjects may opt out of direct marketing communications at any time by:
- Clicking the unsubscribe link in any marketing communication
- Contacting the Information Officer at info@instabiz.co.za
Once an opt-out request is received, InstaBiz will cease all direct marketing communications within a reasonable time.
16. Updates to This Manual
InstaBiz will review and update this Manual periodically to reflect changes in its processing activities, applicable legislation, or operational structure. The Effective Date at the top of this document indicates the date of the most recent revision.
Material changes to this Manual will be communicated to data subjects where practicable. Continued use of the Site following any update constitutes acceptance of the revised Manual.
InstaBiz — Smart Systems for Modern Business™
© Instabiz (Pty) Ltd. All rights reserved.