Privacy Policy

1. Who this policy applies to

This Policy applies to:

• visitors to the DebtDesk website;
• mediation practices and other organisations that subscribe to DebtDesk;
• users authorised by those organisations;
• individuals whose information is entered into DebtDesk, including mediation clients, creditors, and other contacts; and
• people who contact DebtDesk for support or enquiries.

If your information was entered into DebtDesk by a mediation practice, that practice may be responsible for explaining its own privacy practices and responding to requests about your information. DebtDesk may process that information on the practice’s instructions.

2. Personal information we may process

Depending on how the service is used, we may process:

Account and business information

• name and contact details;
• business name and registration details;
• login and user-role information;
• subscription and billing administration details; and
• communications with DebtDesk.

Mediation and case information

A customer may enter information such as:

• names and contact details;
• South African identity numbers or other identification information;
• income, expenses, and affordability information;
• creditor and account details;
• balances, instalments, proposals, offers, and responses;
• payment-allocation records supplied or created by the customer;
• signed mandates, statements, correspondence, and paid-up letters; and
• notes and other information relevant to the customer’s mediation work.

DebtDesk does not independently verify the accuracy, completeness, or legality of information entered by a customer.

Technical information

When you use the website or application, we may process:

• IP address;
• browser and device information;
• login activity;
• error and diagnostic information;
• usage information; and
• cookies or similar technologies.

DebtDesk currently uses email-and-password authentication. SMS functionality and analytics are not currently configured.

3. How we use personal information

We may use personal information to:

• provide, operate, and maintain DebtDesk;
• create user accounts and manage permissions;
• provide customer support;
• secure the service and investigate misuse;
• send service notices and operational communications;
• process DebtDesk subscription administration and billing;
• improve reliability, performance, and usability;
• comply with legal obligations or lawful requests;
• prevent fraud, abuse, or security incidents; and
• establish, exercise, or defend legal claims.

DebtDesk subscription payments are processed through Peach Payments. Peach Payments is used for DebtDesk subscription payments only. It is not used to receive or distribute mediation-client payments.

Where a mediation practice enters information about its own clients into DebtDesk, the practice remains responsible for collecting and using that information lawfully and for giving any required notices.

4. Our role and the customer’s role

Depending on the circumstances, DebtDesk may process information as a service provider or operator for a mediation practice, while the mediation practice determines why and how its clients’ information is used.

The customer is responsible for:

• having a lawful basis for collecting and using personal information;
• providing any required notices to its clients and contacts;
• obtaining any required consent or authorisation;
• ensuring that information entered into DebtDesk is accurate and appropriate;
• deciding how long records should be kept;
• responding to requests from its clients and other data subjects; and
• complying with laws and professional obligations that apply to its mediation practice.

DebtDesk does not decide whether a consumer is over-indebted, does not conduct statutory debt review, and does not provide legal or financial advice.

5. When we share personal information

We may share personal information:

• with the customer that entered or controls the information;
• with authorised users within the customer’s organisation;
• with service providers that host, secure, maintain, support, or provide infrastructure for DebtDesk;
• with Peach Payments for DebtDesk subscription billing;
• with professional advisers who are bound to protect the information;
• where required by law, court order, or lawful regulatory request;
• to investigate or prevent fraud, security incidents, or unlawful activity; or
• in connection with a merger, acquisition, restructuring, or sale of all or part of the business.

DebtDesk does not sell personal information.

We do not send a customer’s mediation information to creditors, payment providers, or other third parties unless the customer instructs us to do so, the customer uses a feature that requires it, or disclosure is required by law.

6. Service providers and hosting

DebtDesk currently uses the following infrastructure and service providers:

• Railway: backend hosting, database, file storage, error monitoring, and backups;
• Vercel: frontend hosting and delivery;
• Render: email infrastructure; and
• Peach Payments: DebtDesk subscription-payment processing only.

These providers may process information in jurisdictions outside South Africa. We use contractual and technical measures intended to protect information processed through these services.

7. Retention

Customer data is retained while the customer’s DebtDesk account remains active and for 30 days after termination, unless a longer period is required by law or agreed with the customer.

Backup copies may remain for a reasonable period while backup systems are overwritten or securely deleted.

Customers remain responsible for exporting any records they need before terminating their account and for complying with their own legal and professional record-retention obligations.

8. Security

DebtDesk uses reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration, or destruction.

These measures may include access controls, user permissions, password authentication, logging, encryption in transit, backups, and security monitoring.

No internet-based system is completely secure. Customers are responsible for protecting their login credentials, assigning appropriate user permissions, reviewing exported records, and notifying DebtDesk promptly of suspected unauthorised access.

9. Data breaches

If DebtDesk becomes aware of a security compromise involving personal information, we will investigate and take reasonable steps to contain and address it.

Where required by applicable law, we will notify the relevant customer, the Information Regulator, and affected data subjects.

10. Data-subject requests

Subject to applicable law, a data subject may have rights to:

• ask whether we hold personal information about them;
• request access to that information;
• request correction or deletion of inaccurate or unlawfully held information;
• object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with the Information Regulator.

If a mediation practice entered your information into DebtDesk, please contact that practice first. You may also contact DebtDesk at support@debtdesk.co.za.

We may need to verify your identity before responding. We may also refer a request to the relevant customer where that customer is responsible for the information.

Information Regulator of South Africa: https://inforegulator.org.za/

11. Cookies

DebtDesk may use necessary cookies and similar technologies to:

• keep users signed in;
• protect the service;
• remember preferences;
• understand service performance; and
• measure website usage.

You can view our cookie information at: https://debtdesk.co.za/cookies

12. Children

DebtDesk is intended for businesses and adults. It is not directed at children.

If you believe that a child’s personal information has been submitted to DebtDesk unlawfully, contact us at support@debtdesk.co.za.

13. Changes to this Policy

We may update this Policy from time to time. We will publish the updated version on this page and update the effective date.

If a change is material, we may also notify customers through the service or by email.

14. Contact

Entity

SJ WEB DESIGN STUDIO trading as DebtDesk

Registration number

2019 / 451962 / 07

Email

support@debtdesk.co.za

Address

39 May Avenue, Van Wyksvlei, Wellington 7655

Information Officer

Siphiwo — support@debtdesk.co.za