Privacy Policy
This policy explains how Tafel collects, uses and protects personal information, in line with South Africa's Protection of Personal Information Act, 2013 (POPIA).
Who we are
Tafel is a reservations and dispatch system for chauffeur, transfer and tour companies, made in Cape Town and hosted in South Africa. In this policy, "we" and "us" mean Tafel, Dunkeld Office Park, 6 North Road, Dunkeld West, 2196.
Our Information Officer is Ryno Terblanche, reachable at sales@gettafel.co.za.
What this policy covers
- Our website and what happens when you contact us, ask for a demo or become a client.
- The Tafel systems we host for our clients, and the personal information of their guests, partners and staff (see "When we host a client's system").
What we collect on this website
| What | Why | Where it comes from |
|---|---|---|
| Your name, company, email, phone number and what you tell us | To answer you, arrange a demo and, if you sign up, set up your system and our agreement | You, when you email, phone or WhatsApp us |
| Technical details: your IP address, browser and the pages you open | To keep the website running and secure | Your browser, in our hosting provider's logs |
| Your cookie choice | So we don't ask you again | Stored in your own browser only |
The website has no forms, no advertising and no tracking. We don't buy personal information, and we never sell it.
Cookies
We don't use tracking or advertising cookies. The website remembers your choice in the cookie notice in your browser's own storage. You can change it at any time with Cookie settings at the bottom of the website, or by clearing your browser's data for this site.
To show our typefaces and maps, your browser may contact Google Fonts and our website host. Like any website, they see your IP address when you load the page.
Why we may use your information (lawful basis)
- Your consent, when you ask us to contact you or choose to receive news from us. You can withdraw it at any time.
- To make and carry out a contract with you or your business.
- Our legitimate interests, such as keeping the website and our systems secure, as long as these don't outweigh your rights.
- The law, for example tax and accounting records.
Who we share it with
Only service providers who help us run Tafel, under written agreements that require them to protect it: our hosting provider (data centres in Cape Town and Johannesburg), our email provider, and our accounting software. We share information with authorities only when the law requires us to.
Some providers, such as Google Fonts, may handle data outside South Africa. When information leaves the country we make sure it's protected as POPIA requires (section 72).
When we host a client's system
Each Tafel client runs its own system, on its own server, which we host and maintain. The client decides what personal information goes into it (their guests, passengers, partners, chauffeurs and staff) and is the responsible party under POPIA. We are their operator: we process that information only on the client's instructions and under a written operator agreement (POPIA section 21), and never use it for ourselves.
- Each client's data is kept apart, on its own server in South Africa, encrypted at rest, and backed up nightly in encrypted form.
- Access is limited to the client's own staff, with roles and an audit trail. We access a client's system only to support or maintain it.
- The system gives clients POPIA tools: automatic clean-up of old personal details, exports of one person's information, and their Information Officer's details on their booking form and client portal.
- Guests who want to see, correct or delete their information should contact the company they booked with. We help our clients answer those requests.
How long we keep it
Only as long as we need it for the purpose we collected it for, or as long as the law requires (for example, financial records for at least five years). Then we delete it or make it anonymous. A client's system data is returned or deleted when their subscription ends, as their agreement sets out.
How we protect it
Encryption in transit and at rest, encrypted backups, strong sign-in for our staff, access only when needed, and regular updates. If a breach affects your personal information, we will tell you and the Information Regulator as POPIA requires.
Your rights
- Ask whether we hold personal information about you, and for a copy of it.
- Ask us to correct or delete it.
- Object to how we use it, or withdraw your consent.
- Complain to the Information Regulator: inforegulator.org.za.
To use these rights, contact our Information Officer (see "Who we are"). We'll answer within a reasonable time and may ask you to confirm who you are first.
Changes to this policy
We may update this policy. The date at the top shows when it last changed, and we'll tell our clients about important changes.