Privacy Policy

Effective date: 24 August 2026

Thank you for using SimplyPaid (referred to as “the Service”). This Privacy Policy explains how we collect, use, and protect information when you access and use our Service. We are committed to safeguarding privacy and ensuring the security of personal data under the Protection of Personal Information Act 4 of 2013 (POPIA). Please read this policy to understand our practices.

The Service is provided by Debtflow (Pty) Ltd, trading as SimplyPaid (“we”, “us”, “our”), a company registered in South Africa. Contact: privacy@simplypaid.co.za

This policy covers two kinds of people:

• Customers — the business that lists a debt (the creditor).
• Debtors — the person or business named on a listed invoice.

1. Information We Collect

1.1 Account Data: When you create an account or list a debt, we collect information you provide such as your name, email address, phone number, business details, and bank account details for payouts.

1.2 Service Data (customers): In order to operate the Service, we collect the information you enter, including invoices, statements, amounts, due dates, and the details of the person or business who owes you.

1.3 Service Data (debtors): When a customer lists a debt, we receive personal information about the debtor that the customer already holds: legal name, identity or registration number (if provided), contact details, the invoice, the statement, and the amount owing. We do not scrape or buy debtor lists. We only process what the customer uploads.

1.4 Payment Data: If you pay the R50 listing fee, our payment processor (Paystack) collects the card or EFT details needed to take that payment. We do not store full card numbers.

1.5 Usage Data: When you use our Service, we may collect technical information, including your IP address, browser type, operating system, and device information. This is collected automatically through cookies and similar technologies to operate and improve the Service.

1.6 Log Files: We retain logs of requests made to our Service. These logs help us analyse and troubleshoot issues, and generate reports for monitoring. They may include IP addresses, timestamps, and other technical details.

2. Use of Information

2.1 Service Operation: We use the collected information to provide and operate the Service, including, but not limited to:

• processing payments;
• sending the customer’s final demand to the debtor (email and SMS), in the customer’s name, asking the debtor to pay the customer;
• managing hand overs with the registered debt collector;
• account management, support, and security.

2.2 Improving the Service: The data we collect enables us to analyse trends, track usage, and identify areas for improvement. Aggregated analytics do not identify you.

2.3 Communication: We may send you service-related announcements, updates, or important notifications by email or SMS. These are necessary for the Service. Where we send marketing, you can opt out.

We do not use debtor information for marketing.

3. Why this is lawful (POPIA)

We process personal information only where POPIA allows it.

3.1 Customers: We process your information to perform our contract with you, to take payment, and to operate the Service.

3.2 Debtors: We process debtor information because the customer has a contract with the debtor and a legitimate interest in recovering an unpaid invoice, and because recovery of a debt is a purpose compatible with the original collection of that information (POPIA section 15(3)(c)(iii)). We do not need the debtor’s consent to send the customer’s final demand or to hand a complete file to a registered collector.

3.3 The customer is responsible for uploading only accurate, relevant information about a debt that is actually owing, and for having collected that information lawfully. We may refuse or close a listing that is incomplete, disputed as to the work itself, prescribed, or a government invoice.

4. Data Security

We implement appropriate technical and organisational measures to protect the security and confidentiality of your information. We use industry-standard encryption (including TLS in transit) and regularly update our security practices to safeguard data from unauthorised access, alteration, disclosure, or destruction.

Debtor files are not published. Each file is assigned to a partnered collector, not placed on a public board.

5. Data Retention

We retain information only as long as needed for the purposes in this policy and for the law.

• Listing and account records: for as long as the account is open, and then for as long as tax and financial-record laws require (typically at least five years).
• Debtor files that were handed over: for as long as the collector and the customer need them to work the debt, and then in line with appropriate legal holds.
• Debtor files that were paid on the final demand: we keep enough to show the file was closed, then delete or anonymise the rest.
• Logs: a reasonable period for security and troubleshooting.

We will securely delete or anonymise data when it is no longer required, subject to those legal holds.

6. Data Sharing and Disclosure

6.1 Registered collectors: If the debt is still owing after the final demand, we share the complete file with one registered collector who becomes responsible for how they collect. They may contact the debtor and add fees as prescribed by the Debt Collectors Act.

6.2 Payment processing: Paystack processes the listing fee. Paystack’s own privacy policy applies to the payment itself.

6.3 Other operators: We use trusted providers to host the Service, send email and SMS, and keep the product running. They may have access to information only to do that work, and only under confidentiality and operator terms.

6.4 Legal requirements: We may disclose information if required by law or in response to a valid legal request (for example a court order).

We do not sell personal information. We do not share debtor files with multiple collectors to compete over the same debt.

7. Cross-border transfers

Some operators (including payment and email providers) may process information outside South Africa. Where that happens, we take steps to keep the level of protection reasonable and in line with POPIA, including operator agreements.

8. Your rights

You may ask us to confirm whether we hold your personal information, to see it, to correct it, or — where the law allows — to delete it or object to our using it. We may need to keep some records for a legal reason (for example a paid invoice, or a file already with a collector).

• Customers: use your account, or email privacy@simplypaid.co.za.
• Debtors: email privacy@simplypaid.co.za with the reference on the message you received. We will work with the customer and, if the file has been handed over, with the collector.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18, and we do not knowingly list debts owed by children. If we become aware that we have collected personal information of a child under 18, we will take steps to delete it promptly.

10. Changes to this Privacy Policy

We may modify this Privacy Policy at any time. Changes are effective when posted on our website. We encourage you to review it periodically.

11. Contact Us

Debtflow (Pty) Ltd t/a SimplyPaid
Email: privacy@simplypaid.co.za

If you have questions, concerns, or feedback about this policy or our privacy practices, please contact us.

Thank you for trusting SimplyPaid.