PRIVACY & POPIA
Privacy Notice (POPIA)
1. Who this notice covers
Created By Halo, trading through HALO Finance, processes personal information in connection with HALO Finance. This notice explains how personal information is handled under the Protection of Personal Information Act 4 of 2013 (“POPIA”).
2. Our role
For account administration, security, support, applications, platform communications and HALO's own business records, HALO generally determines the purpose of processing and acts as the responsible party. For personal information that a customer places in its private workspace about its own clients, suppliers or employees, the customer generally determines the purpose of processing and HALO processes the data as an operator on the customer's instructions.
3. Information we process
- Account data: names, usernames, contact information, roles and authentication/security records.
- Workspace data: client and supplier details, addresses, invoices, quotes, payment references, income, expenses, savings goals and reserve movements, employee-related financial data, notes and operational records entered by the customer.
- Technical/security data: session data, hashed network identifiers, device/browser metadata, audit events and failed-login records.
- Support and compliance data: communications, legal acceptances, privacy requests and incident records.
4. Why we process it
Purposes include providing the service, authenticating users, maintaining tenant isolation, generating requested financial documents, preventing fraud/abuse, supporting customers, maintaining auditability, complying with law and improving the product during Early Access. We limit collection and use to purposes that are compatible with the service and applicable legal requirements.
5. Sharing and operators/sub-operators
Information may be processed by hosting, infrastructure, email/support or other service providers that are necessary to operate HALO Finance, subject to appropriate contractual and security controls. HALO does not sell customer workspace data to advertisers. A current subprocessor register is maintained internally and should be reviewed when providers change.
6. Cross-border processing
If a service provider processes personal information outside South Africa, HALO will assess and document the transfer and the safeguards required by POPIA before relying on that provider for customer data.
7. Security safeguards
Application safeguards include server-side tenant scoping, prepared database queries, CSRF protection for state-changing requests, secure session cookies, login rate limiting, password hashing, security headers, restricted uploads and security/audit logs. Administrative access is separated from tenant access. No internet-connected system can guarantee absolute security, and safeguards are reviewed as the product evolves.
8. Retention
Personal information is kept only for as long as reasonably necessary for its purpose or as required by law. Financial and statutory records may need to be retained after account closure. HALO's current internal baseline for financial-record retention is up to 7 years where applicable, subject to the specific law and circumstances. Data no longer required should be securely deleted or de-identified.
9. Your rights
Depending on the circumstances, data subjects may request access to personal information, correction or deletion, object to certain processing, or raise a complaint. Where HALO acts only as an operator, a request concerning customer-controlled workspace data may be referred to the relevant customer as responsible party.
10. Security compromises
Suspected compromises are investigated under HALO's incident process. Where HALO is an operator, HALO will notify the affected responsible party when there are reasonable grounds to believe unauthorised access or acquisition occurred. Responsible parties remain responsible for statutory notifications required by POPIA.
11. Information Officer and contact
Information Officer details to be completed in HALO Admin → Compliance.
Privacy: createdbyhalo@gmail.com
Physical address: Physical address to be completed in HALO Admin → Compliance.
Complaints may also be directed to the Information Regulator (South Africa).