Privacy policy

1. Who we are

Enoki is operated by [company legal name] (registration number [number]), of [registered address] ("Enoki", "we", "us"). We are the responsible party for the personal information described in this policy. Our Information Officer is [name], who you can reach at service@enoki.co.za.

2. Information we collect

We collect only what we need to run the marketplace and the stock and ordering tools:

• Account details: your name, email address, phone number, company name, profile picture and password. Passwords are stored only as a secure hash.
• Business registration details: business name and type, company registration and VAT numbers, and the address you register with.
• Delivery and billing addresses, including the recipient name and phone number for each address.
• Orders, carts, lists, catalogues, prices and stock records that you or your business create.
• Contacts you add for customers and vendors, such as names, job titles, email addresses and phone numbers.
• WhatsApp ordering: if you link your WhatsApp number, we store the number and the order messages you send to suppliers, encrypted.
• Photos and files you upload, such as product images.
• Connected apps you authorise, such as an AI assistant, and the access you granted them.
• Technical information: your IP address and request logs, used to keep the service secure and working.

3. How we use your information

We use your personal information to:

• create and secure your account, and confirm your email address;
• review and approve business registrations and supplier-customer relationships;
• show buyers the suppliers, catalogues and prices they are approved for, and pass orders to the supplier;
• send service emails, such as account links, order notifications and order exports;
• provide WhatsApp ordering, supplier system integrations and connected apps when you turn them on;
• prevent abuse, investigate faults and keep the service available; and
• meet our legal obligations.

4. Who we share it with

We do not sell personal information. We share it only as follows:

• With the businesses you trade with: when you order from a supplier, the supplier receives your business details, delivery address, contact details and the order.
• Amazon Web Services, which hosts the platform and its database in Cape Town, South Africa.
• Postmark (ActiveCampaign), which sends our emails.
• Meta (WhatsApp), when you or a supplier use WhatsApp ordering.
• A supplier's own business system, such as Sage, when the supplier connects it to receive orders.
• Apps you connect to your account, such as an AI assistant, with the access you approve.
• Google Analytics, which may measure visits to this marketing website (not the dashboard or app).
• Authorities, where the law requires it.

5. Information sent outside South Africa

Some of the service providers above, including Postmark, Meta and Google, process information outside South Africa. We use providers that are bound by law or by contract to protect personal information to a standard comparable to POPIA.

6. Cookies and local storage

The dashboard uses essential cookies to keep you signed in securely. It and the app also keep small settings on your device, such as your chosen workspace, unsent drafts and display preferences. This marketing website may use Google Analytics cookies to count visits. We do not use advertising cookies.

7. How we protect it

Data is encrypted in transit. Passwords are hashed, and WhatsApp numbers and messages are encrypted at rest. People in a business see only what their role in that business allows, and one business cannot see another's records.

8. How long we keep it

We keep account and business information while the account is active. Orders and other business records are kept for as long as tax and company law requires. Request logs are deleted after 14 days, and backups after 7 days. When information is no longer needed, we delete it or remove what identifies you.

9. Your rights

Under POPIA you can ask us what personal information we hold about you, and ask us to correct or delete it. You can also object to how we use it. You can delete your account yourself from Account in the dashboard or app. For anything else, email service@enoki.co.za and we will respond within a reasonable time. If you are not satisfied with our response, you can complain to the Information Regulator at inforegulator.org.za.

10. Children

Enoki is a service for businesses and is not intended for anyone under 18.

11. Changes to this policy

We will update this page when our practices change and change the date at the top. We will tell account holders by email about significant changes.