Appointnet - Manage your Appointments

1. Overview and Scope

Appointnet (Pty) Ltd ("Appointnet", "we", "us", or "our") operates the Appointnet appointment scheduling platform and related applications. This Privacy Policy sets out how we collect, process, disclose, and store personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") of South Africa and applicable international privacy principles including the General Data Protection Regulation ("GDPR"). This Policy applies to all registered service providers ("Businesses"), their staff members ("Staff"), and clients who book appointments or interact with Appointnet services ("Clients").

2. Information We Collect

We collect personal information necessary to deliver, maintain, and secure our appointment scheduling services:

2.1 Business & Staff Account Data

When you register a business profile or invite team members, we collect names, business email addresses, contact phone numbers, business entity names, physical addresses, operating hours, service catalogs, pricing, and profile images.

2.2 Client Booking & Appointment Information

When clients book appointments through Appointnet, we process client full names, email addresses, phone numbers, booking notes, appointment times, selected services, assigned staff members, and status records (e.g. confirmed, completed, cancelled).

2.3 Technical & Telemetry Information

We automatically collect device identifiers, IP addresses, browser types, operating system details, time zones, authentication timestamps, and session logs essential for network security, fraud prevention, and performance monitoring.

2.4 Business KYC & Identity Verification Documents

For registered business service providers setting up merchant payout accounts or subaccounts, we collect compliance and verification records including official identity document numbers/copies, proof of address documentation, tax identification numbers, and verified bank account details. These records are collected strictly to comply with the Financial Intelligence Centre Act 38 of 2001 ("FICA"), anti-money laundering ("AML") regulations, Know-Your-Customer ("KYC") statutory standards, and payment gateway underwriting rules.

3. Lawful Basis & Purpose of Processing (POPIA Section 11)

Under Section 11 of POPIA, we process personal information strictly under the following lawful conditions: • Performance of Contract: Processing necessary to deliver booking software features, send booking confirmations, manage account credentials, and facilitate client-business interactions. • Consent: Where explicitly provided by users for optional features, marketing updates, or optional telemetry analytics. • Compliance with Legal Obligations: Fulfilling tax laws, FICA/KYC regulatory requirements, accounting obligations, corporate record-keeping, and legal requests from regulatory authorities. • Legitimate Interests: Improving system security, detecting malicious activity, debugging software issues, and analyzing aggregated product metrics.

4. Data Sharing & Cross-Border Data Transfers

We do not sell, rent, or trade personal information to third-party data brokers. We share data only with verified technology sub-processors necessary to run the platform:

4.1 Service Infrastructure & Third-Party Sub-processors

We share necessary operational and payment data only with verified technology sub-processors required to operate the platform: • Google Firebase: Cloud database infrastructure, user authentication, and secure document storage with end-to-end encryption in transit (TLS 1.3) and at rest (AES-256). • Paystack Payments Limited: Financial technology & payment gateway sub-processor for subscription billing, merchant subaccount provisioning, bank account verification, payout settlements, and payment card processing. Business owner details, bank verification information, and transaction metadata are shared with Paystack to enable deposit settlements and payment processing.

4.2 Transborder Information Flows (POPIA Section 72)

Where personal information is stored or processed on cloud servers located outside South Africa, we ensure the recipient sub-processor operates under data protection laws providing an equivalent level of protection to POPIA Section 72 or binding corporate rules.

5. Data Retention & Safeguards

We retain personal data only for as long as your account remains active or as required by applicable South African legislation (such as tax, company law, and FICA regulations). KYC identity verification documents, bank account details, and compliance records are stored securely with end-to-end encryption (TLS 1.3 in transit and AES-256 at rest) and strict role-based access control (RBAC). KYC records are retained for statutory legal audit periods mandated by financial regulations and are never shared or used for marketing purposes. We enforce strict technical and organizational safeguards including multi-factor authentication options, automatic token expiration, isolated database records, and routine vulnerability scanning.

6. Data Subject Rights under POPIA & GDPR

Under POPIA Sections 23 and 24, as well as applicable international laws, data subjects have the following rights:

6.1 Right of Access (Section 23)

You may request confirmation of whether we hold personal information about you and receive a copy of that record.

6.2 Right to Correction & Deletion (Section 24)

You may request the correction, amendment, or destruction of personal information that is inaccurate, irrelevant, out of date, incomplete, or unlawfully obtained.

6.3 Right to Object & Withdrawal of Consent

You may object to the processing of your personal information on reasonable grounds or withdraw consent previously given for non-essential processing.

7. Information Officer & Complaints

If you have questions regarding this Privacy Policy or wish to exercise your data subject rights, please contact our Information Officer: • Email: support@appointnet.co.za • Company: Appointnet (Pty) Ltd • Address: Johannesburg, Gauteng, South Africa If you believe your personal data rights under POPIA have been infringed, you also have the right to lodge a complaint with the South African Information Regulator: • Website: https://inforegulator.org.za/ • Email: POPIAComplaints@inforegulator.org.za