Privacy Policy
This is a starting point, not legal advice. It is written to be honest about what Easybook actually does with your data, but it has not been reviewed by an attorney. Have it checked before you rely on it.
This explains what Easybook does with personal information, and is written against the Protection of Personal Information Act (POPIA). Zimla (Pty) Ltd is the responsible party for the information described here.
1. What we collect
- Your account — name, email address, and a hash of your password. We never store the password itself.
- Your company — registered and trading name, registration and tax reference numbers, address and contact details.
- What you put in the books — customers, suppliers, invoices, bills, bank transactions and ledger entries.
- Payroll — employee names, ID numbers, tax numbers, banking details and earnings. This is the most sensitive information Easybook holds.
- Technical records — sign-in times, IP address and error logs, kept to keep accounts secure.
2. Where employee information comes from
Most of what Easybook holds about employees comes from you, not from them. You are the responsible party for your own employees' information, and it is your duty to have told them what you collect and why. We process it on your instruction, as your operator under POPIA.
3. Why we hold it
- To run the service you have asked for — the ledger, invoices, payroll and returns.
- To meet legal duties, including the records SARS and the Companies Act require.
- To keep accounts secure and to investigate misuse.
- To contact you about your account, billing and anything that affects your service.
Those last messages are part of running your account and are sent whether or not you asked for marketing. Marketing is separate and opt-in: if you ticked the box when signing up we may write to you about Easybook, and every such message carries a way to stop them.
4. Who else sees it
We do not sell personal information. It is shared only with:
- The hosting and email providers that run the service for us, under contract and on our instruction.
- SARS and other authorities, where you submit a return or where the law compels us.
- Anyone you give access to — your accountant, auditor or colleagues, through the access you grant them.
5. Where it is kept
We keep data in South Africa where we can. Where a provider processes it elsewhere, we only use providers that offer protection comparable to POPIA, as section 72 requires.
6. How long we keep it
For as long as your account is open, and afterwards for as long as the law requires — generally seven years for accounting and payroll records. Technical logs are kept for a shorter period. We delete or de-identify what we no longer need.
7. Keeping it safe
- Passwords are hashed and never recoverable, by us or anyone else.
- Connections are encrypted, and stored secrets are encrypted at rest.
- Each company's books are separated, and access is by role.
- Posted entries are never edited — corrections are reversing entries, so the audit trail stands.
8. Your rights
Under POPIA you may:
- ask what we hold about you and get a copy;
- have what is wrong corrected, or what we no longer need deleted;
- object to processing in some circumstances;
- withdraw marketing consent at any time;
- complain to the Information Regulator.
Write to privacy@easybook.co.za. If an employee of one of our clients asks us directly, we will refer them to their employer, who is the responsible party for that information.
9. Cookies
Easybook sets the cookies it needs to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies.
10. If something goes wrong
If personal information is compromised we will notify the Information Regulator and the people affected, as section 22 of POPIA requires.
11. Changes
We will post any change here and update the date above. Where a change materially affects you, we will tell you.