Last updated 9 November 2026
Privacy Policy
What personal information Hlawula collects on this site, why, who processes it for us, and your rights under the Protection of Personal Information Act (POPIA).
Draft. Hlawula MoR is still in development and these terms will be reviewed by an attorney before we take real payments. Until then, no one is charged on this site.
Who is responsible
Hlawula MoR (Pty) Ltd, registration number 2026/184220/07, is the responsible party for personal information collected on hlawula.co.za. Requests and questions go to our Information Officer at privacy@hlawula.co.za.
What we collect
| Information | Why | How long |
|---|---|---|
| Email address and country you enter at checkout | To create the demo order and work out the tax line | In memory only, wiped whenever the service restarts |
| Card brand and last four digits (e.g. visa ·· 4242) | To label the demo payment on the receipt and in the dashboard | In memory only, as above |
| The bank you choose for Pay by bank | To label the demo payment | In memory only, as above |
| How you use the site: pages, clicks, scrolling and session recordings | To understand interest in Hlawula and improve the site | Up to 6 months, held by Sitetooling |
We don't keep:
- full card numbers, expiry dates, security codes or the name on a card, which are checked and then discarded;
- the cellphone number you enter for Capitec Pay or Absa Pay;
- anything you type on the checkout page in our analytics, because analytics never runs there.
Analytics and session recordings
We use Sitetooling (sitetooling.space) to measure how people use the website, docs and receipt page, including session recordings and heatmaps. Sitetooling's privacy mode is switched on, so anything a visitor types is masked in recordings. Analytics does not run on the checkout or the merchant dashboard, and the receipt page hides most of your email address. The events we record never include your name, email, phone number or card details.
Who processes information for us
- Vercel hosts the site and API. Its servers may be outside South Africa, including in the United States.
- Sitetooling provides analytics and session recordings.
Where information is processed outside South Africa, we rely on providers bound to protect it to a standard comparable to POPIA, as section 72 of the Act requires. We don't sell personal information.
Payments after launch
Once Hlawula takes real payments, card and bank details will go directly to our payment processor (PayFast or Peach) and never to our servers. This policy will be updated to cover the information we keep as seller of record, such as tax invoices, which tax law requires us to retain.
Your rights
Under POPIA you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct or delete it;
- stop using it for analytics.
Email privacy@hlawula.co.za and we will reply within 30 days. If you're unhappy with our answer, you can complain to the Information Regulator of South Africa at inforeg.org.za.
Security
The site is served over HTTPS only. Demo data is kept in memory, not written to disk. Access to the hosting and analytics accounts is limited to the people who run Hlawula.
Children
Hlawula is a service for businesses. It isn't aimed at children and we don't knowingly collect their information.
Changes
We will update this policy as Hlawula develops, and the date at the top will change when we do. See also our Cookie Notice.