Privacy notice
FabTech Online (Pty) Ltd (registration number 2014/052752/07, "Fabtech", "we", "us") is responsible for the personal information described here, under the Protection of Personal Information Act 4 of 2013 (POPIA). This notice says what we collect, why, who we share it with, how long we keep it and what your rights are.
1. What this notice covers
- This website (https://fabtechonline.co.za), the account pages (https://account.fabtechonline.co.za) and our licensing service, which FAB POS uses to activate and check its licence.
- The businesses that sign up for FAB POS, and the people at those businesses whose details we hold, such as the contact on the account.
- It does not cover the information you keep in FAB POS itself (your sales, stock, customers and staff). That stays on your own computers; we do not receive it, and your business is responsible for it.
- Some of our other apps, such as FAB PA, have their own privacy notice.
2. What we collect
- Business details: legal and trading name, tax or registration number if you give one, billing address and country.
- Contact people: name, email address, phone number and their role on the account (owner, billing or technical).
- Signing in: your email address. We email you a 6-digit code instead of using a password. When you sign in, we record the IP address the session started from.
- Subscription and billing: your plan, computers and add-ons, invoices, credit notes, payments and refunds, and the emails we send you about them.
- Card payments: you enter your card on PayFast's payment page, not ours. We give PayFast your billing email address, the amount and the invoice reference, and receive the result. If your card is kept for automatic renewals, PayFast gives us a token that lets us charge it. We never receive or store your card number.
- Licences and computers: for each activated computer, the name FAB POS reports for it, the FAB POS version and a fingerprint made of scrambled (one-way hashed) hardware identifiers. The identifiers themselves never leave the computer. Each licence check also records its time, its IP address and the counts of users and tills.
- Requests and messages: changes you ask for on the account page or in FAB POS, with the IP address they came from, and the emails you send us.
Activation keys, sign-in codes and sign-in sessions are stored only in scrambled (one-way hashed) form.
Using this website
- We use no cookies, analytics or advertising trackers.
- Our pages load their fonts from Google Fonts, so your browser's IP address reaches Google.
- The FAB POS price section asks our licensing service for prices. To stop abuse, we count requests per IP address. The counts are stored only in scrambled form and deleted after two days.
- The account pages keep you signed in using your browser's session storage, until you sign out or close the tab.
3. Why we use it
- To create and run your account, issue and check your licences, invoice you and take your payments. We need it to carry out our agreement with you.
- To keep the accounting and tax records the law requires.
- To protect FAB POS, our service and our customers: for example, to notice a licence used on more computers than were paid for, and to stop fraud and abuse. This is our legitimate interest.
- To help you when you contact us.
We email you sign-in codes, invoices, receipts, payment reminders and notices about your subscription or our terms. We will not send you marketing unless you agree to it, and we never sell or rent your information.
4. Who we share it with
Only these service providers (operators under POPIA), each for its own task:
- Supabase, which hosts our licensing and billing system and its database in Ireland, in the European Union.
- PayFast, in South Africa, for card payments.
- Afrihost, in Johannesburg, South Africa, which hosts this website, the account pages and the mail server that sends our emails.
- Google, for the website's fonts (it sees your IP address only).
We also share information with our professional advisers, such as our accountant, where they need it, and with authorities where the law requires us to.
5. Information kept outside South Africa
Our licensing and billing system is hosted by Supabase in Ireland. Supabase processes your information only on our instructions, under a data processing agreement. That agreement, and EU data protection law (the GDPR), give it protection substantially similar to POPIA. The transfer is also needed to carry out our agreement with you (POPIA section 72). Everything sent to and from it is encrypted in transit.
6. How long we keep it
- Invoices, credit notes, payments, refunds and the record of changes to your account are our accounting records. We keep them permanently.
- Your account, licence and computer records are kept while you are a customer and afterwards, as our record of what was licensed and billed. On request, we remove personal details we no longer need, such as a former contact, unless the law requires us to keep them.
- Licence checks, with their IP addresses: 12 months.
- Sign-in codes: removed from our record of the email as soon as it is sent, and deleted within a day. Sign-ups that were never confirmed: deleted after a day. Sign-in sessions: deleted 30 days after they end.
- Request counts per IP address: two days.
7. How we protect it
- All connections to our website, account pages and licensing service are encrypted (HTTPS).
- Our staff must sign in with two-factor authentication to see customer information, and what each person can do is limited by their role.
- Every staff action, and every change to a licence or to billing, is written to an audit log that cannot be changed without it showing.
- We hold no card numbers, and keys, codes and sessions only in scrambled form (section 2).
- If your information is accessed by someone who should not have it, we will tell the Information Regulator and you as soon as reasonably possible, as POPIA requires.
8. Your rights
You may:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete information that is wrong, out of date, incomplete or that we are no longer allowed to keep (you can also ask for changes to your business details on the account page);
- object to our using your information for our legitimate interests;
- refuse marketing at any time;
- complain to the Information Regulator (section 10).
Email fabtechconsole@fabtechonline.co.za. We may first check that the request comes from you, for example with a code sent to the email address on your account. We reply within 30 days.
9. Contact us
Information Officer, FabTech Online (Pty) Ltd, 1 Sunlark Drive, Dawncrest, Verulam, KwaZulu-Natal, 4339, South Africa. Email fabtechconsole@fabtechonline.co.za, phone 076 530 8467.
10. The Information Regulator
If you are not satisfied with how we handle your information, you may complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Complaints: POPIAComplaints@inforegulator.org.za. Enquiries: enquiries@inforegulator.org.za or 010 023 5200. Website: https://inforegulator.org.za
11. Changes to this notice
We publish any change here (https://www.fabtechonline.co.za/privacy/) with a new version and date, and email you about changes that affect you.