Privacy Policy

Effective date: 22 October 2026 · Version 1.0 · Responsible Party: Influx Online (South Africa)

1. Who we are

Influx Online ("Influx", "we", "us") is an independent marketing automation consultancy operating in the Republic of South Africa. We build and run automated Google review-request and reputation-management systems for home services and trade contractors.

For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA") we are the Responsible Party in respect of personal information we collect from website visitors, prospects and clients. For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), where it applies, we are the Controller of that information.

Our Information Officer is registered, or in the process of registration, with the Information Regulator (South Africa) as required by section 55 of POPIA and Regulation 4 of the POPIA Regulations.

2. Scope and definitions

This policy applies to personal information processed through our website (influxonline.net), our Meta (Facebook / Instagram) lead forms, our sales and onboarding processes, and the services we deliver to clients. It does not apply to third-party websites we link to, which have their own policies.

"Personal information" has the meaning given in section 1 of POPIA and includes "personal data" under Article 4(1) GDPR. "Processing", "operator" (POPIA) / "processor" (GDPR), "data subject" and "responsible party" / "controller" carry their statutory meanings.

3. Information we collect

3.1 Information you give us directly

• Enquiry and qualifier data: business name, city, monthly customers-served range, invoicing or booking software used, decision-maker name, WhatsApp / telephone number, email address, consent timestamp and consent wording.
• Meta lead-form data: the same fields when submitted through a Facebook or Instagram Instant Form, together with the form identifier and the campaign that generated it.
• Client account data: contracting entity details, VAT number, billing contact, Google Business Profile URL(s), location details and software credentials or API keys needed to connect your systems.
• Communications: emails, WhatsApp messages, call bookings, Zoom or Loom recordings (where you have been told the session is recorded) and support tickets.

3.2 Information we collect automatically

• Server and security logs: IP address, user agent, referrer, pages viewed and timestamps.
• Limited analytics and conversion data as described in section 12.

3.3 Information we receive from clients about their customers

When a client connects its invoicing, booking or POS system (for example Xero, Jobber, QuickBooks, Shopify, Stripe, Sage or ServiceM8), we receive the customer's name, mobile number and/or email address, order or invoice reference, completion date and, where provided, the service type. We process this strictly as an operator on the client's instructions (see section 6).

3.4 Payment information

Card and bank details are entered directly on PayFast's secure pages. We never see or store full card numbers. We receive only a payment token, the last four digits, the amount, the payment status and the subscription reference.

3.5 Special personal information

We do not knowingly collect special personal information (POPIA s26; GDPR Art 9) such as health, biometric, religious or political data, or information about children, and we ask that you do not send it to us.

4. Purposes and lawful basis

POPIA section 11 requires that processing be justified, and GDPR Article 6 requires a lawful basis. The table below sets out each purpose and its basis.

Where we rely on legitimate interests we have balanced those interests against your rights and concluded that the processing is proportionate. You may object at any time (see section 11).

5. Direct marketing (POPIA section 69)

POPIA section 69 prohibits unsolicited electronic direct marketing unless the data subject has consented, or is an existing customer whose details were obtained in the context of a sale and who is marketed only about similar products or services, with an opportunity to object at the time of collection and in every communication.

• Prospects: we contact you only after you submit a qualifier form or lead form with the consent box ticked. The box is never pre-ticked. You may withdraw consent at any time.
• Existing clients: we may tell you about similar services under the section 69(3) exception. Every marketing email contains a one-click unsubscribe link, and every SMS or WhatsApp marketing message explains how to reply STOP.
• Transactional messages (invoices, service notices, booking reminders, security alerts) are not direct marketing and will continue while you are a client.
• We honour opt-outs within 72 hours and keep a suppression list so you are not contacted again by mistake.

6. Review-request messaging sent on behalf of clients

This section explains how we handle the personal information of our clients' customers when we send review requests.

6.1 Roles

The client (the business whose customer you are) is the Responsible Party / Controller. Influx acts solely as an Operator / Processor under POPIA sections 20 and 21 and GDPR Article 28. We process the information only on the client's documented instructions, under a written operator agreement contained in our Terms of Service.

6.2 What is sent

After a customer has been served (a completed booking, delivery or paid invoice), our system sends a single email and, if that email is not opened within 48 hours, a single SMS or WhatsApp message. Each message:

• identifies the client business as sender and the customer's recent purchase or service as the reason for contact;
• offers two neutral, equally prominent options: a public Google review link and a private feedback link to management (no review gating, consistent with Google Business Profile policies);
• contains a one-click unsubscribe link (email) or "Reply STOP" instruction (SMS / WhatsApp); and
• is sent only within 08:00–20:00 South African Standard Time.

6.3 Lawful basis the client relies on

Requesting feedback on a transaction the customer has just completed is a legitimate interest of the business (POPIA s11(1)(f); GDPR Art 6(1)(f)) and, to the extent it is treated as direct marketing, falls within the existing-customer exception in POPIA s69(3). Customers can object at any time and will not be contacted again.

6.4 What we do not do

• We never use a client's customer data for our own marketing or for any other client.
• We never sell, rent or publicly disclose customer data.
• We never post reviews on a customer's behalf, offer incentives for reviews, or filter who receives a request based on expected sentiment.

6.5 If you received a review request and want it to stop

Use the unsubscribe link or reply STOP. You may also email [email protected] with the business name and your number or email; we will suppress you across that client's account within 72 hours and notify the client.

7. Operators and sub-processors

We use the following third parties to deliver our services. Each is bound by a written agreement or terms that require them to secure the information and process it only for the stated purpose (POPIA s21; GDPR Art 28).

We may also disclose personal information to professional advisers, auditors, insurers, a prospective purchaser of our business (under confidentiality), or where required by law, court order or a regulator.

8. Cross-border transfers

Several operators listed above store information outside South Africa, principally in the United States. We transfer personal information across borders only as permitted by POPIA section 72, namely where:

• the recipient is subject to a law, binding corporate rules or binding agreement that provides substantially similar protection to POPIA and restricts onward transfer (s72(1)(a));
• the transfer is necessary for the performance of a contract with you or in your interest (s72(1)(c)–(d)); or
• you have consented (s72(1)(b)).

Where GDPR applies, transfers outside the EEA / UK rely on Chapter V mechanisms, principally the European Commission's Standard Contractual Clauses (and the UK Addendum) incorporated in our operators' data processing agreements, or an adequacy decision where one exists.

9. Retention

We keep personal information only as long as necessary for the purpose for which it was collected, or as required by law (POPIA s14; GDPR Art 5(1)(e)).

10. Security safeguards

In line with POPIA section 19 and GDPR Article 32 we maintain appropriate, reasonable technical and organisational measures, including:

• TLS encryption in transit for all web, API and messaging traffic; encryption at rest with our operators;
• role-based access, unique credentials and multi-factor authentication on all administrative systems;
• API keys and integration credentials stored in encrypted secret stores, never in email or chat;
• separate client workspaces so that one client's data is never visible to another;
• regular review of operator security certifications (e.g. SOC 2, ISO 27001, PCI DSS for PayFast);
• staff and contractor confidentiality undertakings.

Breach notification. If we reasonably believe personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible as required by POPIA section 22 (and, where applicable, supervisory authorities within 72 hours under GDPR Art 33).

11. Your rights

Under POPIA (sections 5, 23, 24 and 11(3)) and GDPR (Articles 15–22) you have the right to:

• Access — confirm whether we hold your personal information and obtain a copy (POPIA s23; GDPR Art 15).
• Correction — have inaccurate or incomplete information corrected (POPIA s24; GDPR Art 16).
• Deletion / destruction — where the information is no longer needed, was unlawfully processed, or you withdraw consent (POPIA s24; GDPR Art 17).
• Objection — object to processing based on legitimate interests, and to direct marketing at any time (POPIA s11(3), s69; GDPR Art 21).
• Withdraw consent — at any time, without affecting the lawfulness of prior processing (POPIA s11(2)(b); GDPR Art 7(3)).
• Restriction — ask us to restrict processing while a dispute is resolved (POPIA s14(6); GDPR Art 18).
• Portability — where GDPR applies, receive your data in a structured, machine-readable format (Art 20).
• Not be subject to solely automated decisions with legal or similarly significant effects (POPIA s71; GDPR Art 22). See section 14.
• Complain to the Information Regulator or, under GDPR, your supervisory authority (section 15).

How to exercise your rights

Email [email protected] with the subject line "POPIA request" and tell us which right you are exercising. For access requests under POPIA you may use Form 2 of the POPIA Regulations; for correction or deletion, Form 2 or a plain email is sufficient. We may ask for proof of identity to protect your information. We respond within 30 days (extendable once by 30 days for complex requests, with notice). Access requests are free except where a prescribed fee applies under PAIA for voluminous copies.

12. Cookies and analytics

Our website is designed to work without tracking cookies. We use:

• Strictly necessary storage — none at present beyond a session value to remember an unsent form draft; no cookies are set by the page itself.
• Google Fonts — the font files are requested from Google's servers, which receive your IP address and user agent. No cookies are set.
• Meta Pixel / Conversions API — if and when enabled, it is loaded only after you accept it in a consent banner, and is used to measure lead-form conversions and exclude existing enquirers from ads. You may opt out through the banner, your browser settings or Meta's ad preferences.

You can delete or block cookies in your browser at any time; the site will continue to function.

13. Children

Our services are for businesses and are not directed at children under 18. We do not knowingly process a child's personal information (POPIA s34–35; GDPR Art 8). If you believe a child has submitted information to us, contact us and we will delete it.

14. Automated decision-making

Our qualifier form and lead-form automation apply a simple volume rule (fewer than 40 customers served per month is marked "not yet a fit"). This determines only whether you receive an immediate booking link or a courtesy message; it has no legal or similarly significant effect and a human reviews every enquiry. You may ask for a human reconsideration at any time.

15. Complaints and the Information Regulator

Please raise any concern with our Information Officer first; we aim to resolve complaints within 14 days. If you remain dissatisfied you have the right to lodge a complaint with:

If you are in the EEA or UK you may also complain to the supervisory authority of your place of residence or work.

16. PAIA manual

Our manual under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), which describes the records we hold and how to request access, is available free of charge on request from our Information Officer and will be published at influxonline.net/legal/paia-manual.html.

17. Changes to this policy

We may update this policy to reflect legal, technical or business changes. The effective date at the top will change and, for material changes affecting existing clients or enquirers, we will notify you by email at least 14 days before the change takes effect. Continued use of our services after that date constitutes acceptance.

18. Contact

Influx Online is an independent marketing automation consultancy and is not affiliated with Google LLC. See also our Terms of Service.