EquityFlowSA Privacy Policy
Version 1.0. Effective 6 September 2026.
This policy explains what personal information EquityFlowSA collects, why, who else touches it, and what you can do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who is responsible
| Responsible party | Marijke Vermaat, sole proprietor, trading as EquityFlowSA |
| Information Officer | Marijke Vermaat |
| Address | 12 Weltevreden Street, Swellendam, Western Cape, 6740, South Africa |
| hello@equityflowsa.com | |
| Telephone | 072 503 8516 |
If you want to exercise any right in this policy, that email address is the place to start.
2. What this policy covers
Two different sets of information, and it matters that they are kept apart.
- Your information as a subscriber. Who you are and what you pay for.
- The client file content you capture. The workforce figures you enter in order to produce an EEA2 and EEA4.
3. What we collect, and why
| What | Why | Where it comes from |
|---|---|---|
| Your email address | It is your identity in the service and where notices are sent | You, at sign up, or from Google if you sign in with Google |
| Your full name, and your capacity if you give it | Recorded when you accept the Terms of Use, together with the date, time and version accepted, so both of us have a record of what was agreed | You |
| Subscription plan, status and renewal dates | To give you the access you paid for | You and Payfast |
| A Payfast payment reference | To match a payment to your account and to handle refunds | Payfast |
| Client file contents: a client reference you choose, sector, province, headcounts by occupational level, race, gender and disability, income differential figures, barriers, plans, committee records and dates | This is the reporting work itself. It is what the EEA2 and EEA4 are built from | You |
| An audit trail of actions taken in your account, and a record of any time we open a client file to answer a support question | So that changes can be traced, and so that support access is never invisible to you | The application |
4. What we do not collect
This is short, and it is the most important section in this policy.
- No employee names. Not anywhere in the system.
- No employee identity numbers.
- No card numbers, expiry dates or CVV numbers. Payment happens on Payfast's own pages. We never see your card and we could not store it if we wanted to.
- No analytics, no tracking pixels, no advertising cookies, no third party marketing tools. We do not measure you and we do not sell or share anything about you.
The EEA forms require headcounts by occupational level, race and gender. They do not require individuals, so the system does not hold individuals.
5. Race, gender and disability figures
Race, health and disability are special personal information under section 26 of POPIA. In EquityFlowSA they are held as counts, not people: a number of employees at an occupational level, in a race and gender category. Those counts are not linked to any named individual, because no individual is recorded.
One honest caveat. In a very small workforce a single figure can point at a particular person to somebody who already knows the organisation. You decide what to enter and you remain responsible for how you handle your own or your client's information. If that risk applies to you, treat the file accordingly.
6. Who else processes it
We use a small number of service providers, called operators under POPIA. They act on our instruction and for no other purpose.
| Who | What they do | What they see |
|---|---|---|
| Base44 | Runs the application: hosting, the database, sign in, file storage and notification emails. Its servers are in the United States, as section 8 explains | Everything stored in the service, in the course of operating it |
| Payfast | Takes payment | Your name, email and payment details. Payfast is a South African payment provider and is the responsible party for its own processing |
| Only if you choose "Continue with Google" to sign in | Google confirms your email address to us. We receive no other information from your Google account | |
| A large language model provider, through Base44 | Two optional features described in section 7 | Only what those features send, described below |
7. The two features that use AI, stated plainly
EquityFlowSA has two optional features that send information to a large language model in order to draft suggestions. Neither runs on its own. Both run only when you press the button.
- Barrier suggestions, in the EEA12 analysis. Sends a single number, the count of workforce records in the file, and a fixed list of standard barrier category names. It sends no demographic figures and nothing that identifies you or your client.
- Workforce forecast. Sends the aggregate headcounts by race and gender for one occupational level, together with your planned figures and the applicable targets, and asks for a projection. It sends no names, no identity numbers, no client name and no contact details, because the system holds none.
What comes back is a draft for you to check and edit. As with everything else this tool produces, you are responsible for reviewing it before you use or issue it.
If you would rather not use these features, do not press those buttons. Every form the service produces can be completed without them.
8. Information leaving South Africa
EquityFlowSA runs on the Base44 platform, whose servers are in the United States. Information held by the service is stored and processed there. Uploaded files, account details and billing information are held in the United States in every case.
Three things worth being precise about.
- Storage and processing are not the same thing. A request may be handled by platform services in another region before the result is stored in the United States.
- Payfast processes payments in South Africa. Google, if you choose to sign in with Google, processes under its own arrangements. Each of those is a separate transfer made by that provider, which is the responsible party for its own processing.
- Most of what the service stores has no identifiable data subject in it at all. Client file contents are headcounts, not named individuals, as section 4 sets out. The cross border question bites hardest on the small amount of information that identifies you: your name and email address.
Section 72 of POPIA permits a transfer outside the Republic where the recipient is subject to a binding agreement providing an adequate level of protection, and where the transfer is necessary for the performance of the contract between us. Our arrangement with Base44 is made on that basis, and Base44 states that its own vendors are bound by data processing agreements using recognised transfer mechanisms including adequacy decisions, standard contractual clauses and the EU-US Data Privacy Framework. Accepting the Terms of Use when you sign up records your agreement to the service operating this way.
If you need this confirmed in writing for your own compliance file, email hello@equityflowsa.com.
9. When we can see your client file
Each account can see only its own client files. This is enforced by the database, not by the application, so no subscriber can reach another subscriber's data.
One exception exists. The operator of this service can open a client file in order to answer a support question or investigate a fault. Every time that happens it is written to the audit trail, with the account, the file and the time. You can see those entries. We do not open files for any other reason.
10. Cookies and what is stored in your browser
We use no analytics cookies, no advertising cookies and no tracking of any kind.
The only thing the service keeps in your browser is the sign in token that keeps you signed in between visits, and small preferences such as which client file you last had open. Clearing your browser data removes them and signs you out.
11. How long we keep it
| What | How long |
|---|---|
| Client file contents | For as long as your subscription is active. After cancellation they are retained for 30 days, as set out in the Cancellation Policy, and then deleted |
| Your account and email address | Until you ask us to delete the account |
| Terms of Use acceptance records | Kept for as long as we may need to show what was agreed and when |
| Audit trail entries, including support access | Kept with the client file, and deleted with it |
| Payment records | Kept as long as tax and financial record keeping law requires |
You can delete a client file yourself at any time, from the client files screen.
12. Your rights
Under POPIA you may:
- Ask what we hold about you, and get a copy.
- Correct anything that is wrong.
- Ask us to delete it, where we are not required to keep it.
- Object to processing, on reasonable grounds.
- Withdraw consent where processing rests on consent, without affecting what was lawful before you withdrew it.
- Complain, either to us or to the Information Regulator.
Email hello@equityflowsa.com. We will answer within a reasonable period and in any event no later than 30 days. We do not charge for a first request.
13. Complaining to the Information Regulator
You do not have to come to us first, although it is usually quicker.
| Information Regulator (South Africa) | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za |
| Telephone | 010 023 5200 |
| Toll free | 0800 017 160 |
14. Keeping information safe
Information is encrypted in transit. Access is separated per account by the database itself rather than by the application, which is the stronger place for it to be enforced. Support access is logged. Payment card details never reach us.
No service can promise that nothing will ever go wrong. If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as section 22 of POPIA requires.
15. Changes to this policy
If this policy changes materially we will publish the new version here with a new version number and effective date, and tell subscribers by email. The version in force is the one published on this page.
16. How this fits with the other documents
This policy sits alongside the Terms and Conditions, the Cancellation Policy, the Refund Policy and the Delivery Policy, and alongside the Terms of Use you accept inside the application. Where this policy and another document appear to disagree about personal information, this policy prevails.