POPIA notice

The Protection of Personal Information Act 4 of 2013 (POPIA) regulates how organisations in South Africa collect, store, use, and share personal information. FlowLeads complies with POPIA in full, and this notice explains how — without legal jargon.

We collect the minimum information needed to give you a solar quote, we tell you exactly who we share it with before we share it, we keep it only as long as we need to, and we give you the right to see, correct, or delete it at any time.

FlowLeads is operated by Pieter Muller, who is the responsible party (data controller) under POPIA. FlowLeads is based in Durban, South Africa.

Pieter Muller is the Information Officer for FlowLeads and is reachable at hello@flowleads.co.za. The Information Officer is responsible for ensuring that FlowLeads complies with POPIA and for handling all data-subject requests and complaints.

We rely on two lawful bases under section 11 of POPIA:

(a) Consent — when you submit a quote request, you give us specific, informed, and voluntary consent to share your details with a small number of vetted SAPVIA-registered installers in your area. The consent text is stored with a timestamp.

(b) Legitimate interest — for fraud prevention, security logging, basic analytics (Plausible self-hosted, no cookies), and service improvement. We have run a legitimate-interest assessment and your privacy is not overridden.

We do not rely on consent for legitimate-interest processing, and we do not use legitimate interest as a fallback when consent has been refused or withdrawn.

Identifying information: full name, email address, mobile number.

Property information: suburb / city, estimated monthly electricity bill (range), roof type, homeowner status.

Technical information: IP address, browser user-agent, referring URL, pages viewed (anonymised by Plausible).

Consent record: timestamp, wording shown, and the IP address from which consent was given.

We do not knowingly collect special personal information as defined by section 26 of POPIA (race, health, religion, biometrics, etc.) and we do not collect information from children under 18.

A small number of vetted SAPVIA-registered installer partners, selected on the basis of suitability, response time, and homeowner ratings — only after you have submitted a quote request.

Operators (POPIA term for processors) acting on our written instructions: Vercel (frontend hosting, EU/US), Fly.io (backend hosting, JNB region), Neon Postgres (database, EU region), Upstash Redis (queue, EU region), Cloudflare (CDN and Turnstile bot protection), Resend (transactional email).

Authorities, only if compelled by South African law (e.g. SAPS, SARS, court order).

We never sell your personal information. We never share it for advertising profiling. We never share it with marketing data brokers.

Some of our operators host infrastructure outside South Africa. POPIA section 72 permits this when the destination jurisdiction has an adequate data-protection law or the operator is bound by contract to provide an equivalent level of protection. All our operators meet at least one of these requirements (most are bound by GDPR, which exceeds POPIA in nearly all material respects).

We keep your personal information only for as long as it is needed for the purpose it was collected for, or as long as we are legally required to. After that, it is deleted or anonymised.

If you would like your information deleted sooner — for example, if you no longer want to be matched with installers — email hello@flowleads.co.za and we will action your request within 30 days, unless we are legally required to retain it.

Aggregated, non-identifying analytics (e.g. "how many homeowners in Durban submitted a quote last month") are retained indefinitely for service-improvement purposes.

You have the right to: (a) be notified of processing, (b) access your personal information, (c) request correction or deletion, (d) object to processing on legitimate-interest grounds, (e) withdraw consent at any time, (f) lodge a complaint with the Information Regulator, and (g) institute civil proceedings.

To exercise any right, email hello@flowleads.co.za. We will respond within 30 days and never charge a fee, unless your request is manifestly unfounded or excessive (in which case we will tell you in advance).

Withdrawing consent does not affect the lawfulness of processing already carried out, and does not require us to reverse referrals already made to installers — but no further processing will take place.

All traffic is HTTPS-only with HSTS preload. Database connections use TLS. All secrets are stored in Fly.io secrets and Vercel environment variables (never in the repository).

Cloudflare Turnstile protects the quote form against bot abuse.

Access to production data is restricted to the Information Officer and named engineers, all under written confidentiality undertakings.

We log all access to personal information and review logs monthly.

We will notify you and the Information Regulator of any reasonably-suspected security compromise that involves your personal information, in accordance with section 22 of POPIA.

Please contact us first at hello@flowleads.co.za — most issues resolve within a week.

If you are not satisfied, you may complain directly to the Information Regulator of South Africa: complaints.IR@inforegulator.org.za. Their full contact details are at https://inforegulator.org.za.

We will update this notice when our processing changes. The 'Last updated' date at the top reflects the most recent change. Material changes will be communicated by email to anyone with an active quote request.