Privacy notice
Last updated: 22 May 2026
Who we are
flits.co.za is shop-management software operated by AquaSoft (Pty) Ltd, Stellenbosch, South Africa. For the personal information our software stores on behalf of shops that use flits.co.za, those shops are the responsible party under POPIA — the shop decides what's collected, why, and for how long. We are the operator: we keep the software running, we don't access your records ourselves, and we process personal information only on the shop's instructions.
What personal information we hold
The shop you booked with may have asked us to store:
- Your name, email, and phone number — so they can confirm and remind you about appointments.
- Your date of birth — for age-appropriate services and birthday offers (only if you've opted in).
- Appointment history, services received, and any notes the stylist took.
- Payment records (amount, method, date — but never your card number).
- Consent history — what you agreed to, when, and from where.
How we use it
Transactional messages — appointment confirmations and 24-hour reminders — are sent on a legitimate-interest basis (POPIA s11(1)(f)): if you booked a service, telling you when it's happening is necessary to deliver it.
Marketing messages — birthday specials, win-back offers, shop promotions — are sent only if you tick the matching opt-in box. You can withdraw consent at any time by asking the shop or by following the unsubscribe link on any marketing message.
Payment records are retained for 5 years to comply with the South African Revenue Service's tax-record rules (Income Tax Act s29). If you ask for erasure, we anonymise the row but keep the financial value so the shop's books stay reconciled — POPIA s14 specifically allows this for legal-retention obligations.
Your rights
Under POPIA you can, at any time:
- Ask for a copy of everything we hold on you — use /popia/export.
- Ask us to erase it — use /popia/delete.
- Withdraw consent for marketing messages — ask the shop, or reply STOP to any marketing SMS.
- Complain to the Information Regulator (South Africa) if you believe your rights aren't being honoured — inforegulator.org.za.
Where the data lives
Personal information is stored on servers in South Africa (Cape Town, hosted by AquaSoft). When you book at a shop, your data sits in two places: the shop's till computer (offline-capable) and a central database that syncs both ways. We use TLS for every connection between them.
Who we share with
We do not sell personal information. We share it with:
- The shop that holds your record — it's their database, not ours.
- SMS and email gateways (e.g. BulkSMS, Resend) to deliver messages you've opted into. They see only the contact field and the message body, never your full profile.
- SARS, on subpoena or audit — and only the records SARS is entitled to see.
Contact
Our Information Officer is reachable at privacy@flits.co.za. Shop-specific queries (consent withdrawal, corrections to your record) are best handled at the shop itself, since the shop is the responsible party.