Privacy Policy

This notice explains how TIN Solutions (Pty) Ltd handles personal information in enquiries, accounts, websites, services and business communications. It covers visitors, customers, authorised contacts and people whose details are supplied for an instructed service. South African law, including POPIA, applies.

Reading or browsing this page is not blanket consent to every use of your information. Processing must have an appropriate lawful basis and a specific purpose. The information needed for a particular service should be explained when it is collected. This notice does not replace a customer’s own privacy notice for a website, mailbox or system they operate.

Personal information means information relating to an identifiable person and, where applicable under POPIA, an identifiable existing juristic person. Processing includes collecting, recording, using, sharing, storing and deleting it. A responsible party determines the purpose and means of processing; an operator processes on that party’s behalf under its authority.

Consent is a voluntary, specific and informed indication of permission. Special personal information and children’s information receive additional protection. Direct marketing promotes goods or services to a person; an essential invoice or security notice is not automatically marketing. PAIA is the Promotion of Access to Information Act. “You” includes a visitor or person whose information we handle.

TIN Solutions (Pty) Ltd, registration 2020/437198/07, is the responsible party for its own customer administration, billing and business records. Public business address: 585 Bhuga Trust, Kabokweni, Mbombela, Mpumalanga, South Africa. Website: https://tinsolutions.co.za/. Contact support@tinsolutions.co.za or 087 265 2842 for a privacy request addressed to the Information Officer.

When we host or administer information solely on a customer’s instructions, that customer may be the responsible party and TIN an operator. The appropriate role depends on the actual activity. Address privacy requests to the Information Officer through the contact details above so that they can be routed appropriately.

We seek consent where it is the lawful basis for a particular activity, such as optional marketing where required. We may instead process information where necessary for a contract, a legal obligation, or a legitimate interest permitted by POPIA, subject to your rights and the relevant conditions. We do not rely on a general “use of this website means consent” statement.

You can withdraw consent by contacting us and identifying the activity. Withdrawal does not make earlier lawful processing unlawful, and we may still retain or process information where another valid legal basis applies. We will explain if information is necessary to provide an active service and what withdrawing it would mean.

Depending on the service, we may receive names, company and authorised-contact details, contact addresses, email addresses, phone numbers, account references, orders, invoices, payment references, transaction status, support messages and service configuration. Device, IP address, browser, access and diagnostic records may be generated by the systems you use.

Domain, connectivity and company-compliance work can require registrant, director or verification information, including identity and address documents where necessary. Repair work can involve device diagnostics and access to files you specifically authorise us to examine or recover. Social connections involve the authorised business profile, publishing content and access credentials or tokens needed for that connection.

Do not submit full payment-card details, passwords, unrelated identity documents, children’s information or special personal information through an ordinary public enquiry. If a task genuinely requires sensitive information, agree the purpose and an appropriate submission method first. A service that can process such information is not permission for unrestricted collection.

We use relevant information to respond to enquiries, confirm authority, quote, fulfil orders, register and administer services, collect and allocate payments, provide support, diagnose faults, deliver approved communications and comply with applicable requirements. Security and fraud-prevention records help protect customers, staff and systems.

Optional marketing requires an appropriate lawful basis and an effective way to object or unsubscribe. It is separate from operational billing, security and service messages. We do not sell personal information as part of these services.

Where an AI-assisted or automated feature is enabled, its purpose and provider must be appropriate to the task. External AI services may process submitted information outside our own hosting environment; we do not claim all AI processing stays in South Africa. Limit submitted information to what is needed, protect credentials and request a human review of a consequential service decision. We must not make a decision prohibited by POPIA’s automated-decision rules.

We generally obtain information from you, your authorised contact, your account activity and communications with us. We may receive information from an authorised organisation representative, a payment or service provider, a public registry or another lawful source where POPIA permits it. If you supply another person’s details, you must have authority and a lawful basis.

We must explain relevant collection circumstances and purposes as required, rather than treating publicly available information as free of privacy obligations. You may browse general information without opening an account, although web infrastructure can still generate technical logs. An IP address or online identifier can be personal information; technical records are not assumed to be anonymous.

Cookies and similar storage can support sessions, authentication, preferences and security. Third-party services reached through our links may set their own cookies. A feature’s use of local storage or a token can also have privacy consequences even if it is not called a cookie.

Non-essential analytics or advertising tracking requires clear information and any choice required by applicable law. This notice does not itself enable or authorise such tracking. Browser settings can restrict or remove storage, but may affect sign-in and other essential functionality. Contact us to ask about a specific cookie or integration.

Processing must be lawful, reasonable, relevant to its purpose and not excessive. We restrict collection and access to what is needed, take reasonable steps to keep records accurate, and assess whether a less intrusive method can meet the purpose. We must not retain identifiable records indefinitely merely because a person has not objected.

We are accountable for applying these principles in the systems and services we control. Information supplied to operators must be covered by appropriate instructions and safeguards. Where we act on a customer’s instructions, our agreement should identify the respective responsibilities.

Information may be disclosed to parties needed for the service: hosting and infrastructure providers; registrars and registries; communications networks; payment and banking providers; email, SMS and WhatsApp delivery providers; authorised social platforms; software and integration providers; and professional or administrative providers handling an authorised filing or support task. The relevant category depends on what you actually purchase or connect.

We may disclose information where lawfully required by a court, regulator or authority, or where a lawful and proportionate disclosure is necessary to address fraud, security or a legal claim. A business transfer must have a lawful basis and appropriate safeguards. We do not claim every recipient is merely our operator; some independently determine their own processing.

Operator processing must be authorised, purpose-limited and governed by the safeguards and written arrangements POPIA requires. Ask us to identify the material providers for your service. We do not publish passwords, access tokens, database credentials or private administration links in this policy.

Subject to applicable law and permitted limitations, you can ask whether we hold your personal information, request access, ask for correction or deletion, object to qualifying processing, withdraw consent where applicable, and complain about unlawful processing. You can object to direct marketing and ask for human consideration where an automated decision affects you in circumstances protected by law.

Send a request to support@tinsolutions.co.za, addressed to the Information Officer, and describe the record or activity. We may reasonably verify identity and authority without collecting excessive information. We will explain an applicable process, lawful fee, limitation or reason for refusing a request. Do not send unnecessary identity documents before we explain what verification is needed.

A new use of information must be compatible with the original purpose or otherwise lawfully permitted. We assess the link between purposes, the nature of the information, consequences and safeguards. Where fresh consent or another notice is required, it must be obtained or provided before the new activity. A broad mention of “business improvement” does not authorise unrelated reuse.

Keep account, billing, domain-holder and contact information current and tell us about an error. We take reasonable steps to correct information relevant to its purpose and will consider supporting evidence. Where accuracy is disputed, restriction or a record of the dispute may be appropriate under POPIA. A request does not require us to rewrite an accurate historical transaction or destroy records that law requires us to retain.

We must use reasonable technical and organisational measures appropriate to the information and risk, review foreseeable threats and maintain confidentiality with authorised personnel and operators. Access should be limited to authorised purposes; credentials and sensitive documents need suitable handling.

No system can be guaranteed completely secure. Security measures must be appropriate to the actual service and risk and should not be assumed to include a particular certification or technical feature unless confirmed. Keep your own credentials secure, use available security features and report suspected unauthorised access through support promptly. Do not include the suspected password in the report.

Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we must assess and respond under POPIA. Where required, the Information Regulator and affected people must be notified as soon as reasonably possible after discovery, subject to lawful delay and the circumstances contemplated by the Act.

A notice should explain available facts, likely consequences, containment and protective steps, without exposing additional information. The applicable POPIA notification requirements govern the response. If TIN acts as an operator, the responsible party must be informed through the applicable process.

Registries, software platforms, social networks, payment or communications providers and externally hosted AI services may process information outside South Africa. The actual service and provider determine the destination and role. We do not claim every customer record stays on a South African server.

A transfer must meet section 72 of POPIA, for example through adequate protection under an applicable law or binding arrangement, valid consent, or another permitted ground. We must assess and apply the relevant safeguards; this notice is not blanket permission to transfer sensitive information anywhere. Ask us about the providers and transfer basis for your particular service.

We retain identifiable records only for as long as a lawful purpose or requirement justifies it. Relevant factors include an active service, invoice and tax records, registry or network obligations, disputes, security investigation and your instructions where lawful. Different record categories can require different periods.

Retention periods vary by category and applicable obligation. When a purpose ends, records must be reviewed for deletion, destruction or appropriate de-identification unless continued retention is justified. If you ask about a particular record, we will explain the applicable basis and arrangements, including any relevant backup lifecycle.

When information is no longer lawfully required, it must be removed, destroyed or de-identified through an appropriate process. A requested export or return depends on identity, authority, available format and other people’s rights. We must not disclose another person’s private information to satisfy your request.

Backups and disaster-recovery copies may be overwritten through their managed lifecycle rather than edited individually. Retained copies must remain protected and must not become a reason for unrestricted reuse. If a retained backup is restored, applicable deletion or restriction instructions need to be considered again.

Email support@tinsolutions.co.za with the subject “Privacy request — removal”, or open a client-portal ticket addressed to the Information Officer. Identify the account and categories of information concerned; do not include your password. We will guide you through the appropriate process.

We will assess the request, verify authority where necessary, identify any continuing lawful retention and explain the outcome or required next step. An active service does not automatically defeat every deletion request, but deleting information essential to delivery may require a service change or cancellation. Cancellation alone does not erase statutory accounting or dispute records.

You can object on grounds permitted by POPIA and can object to direct marketing without having to purchase another service. Use an available unsubscribe method or email support@tinsolutions.co.za, identifying the communication or processing. We must consider the applicable legal basis and stop processing where required. Essential invoices, legal notices and security alerts can continue where lawfully necessary.

If unresolved, you may lodge a complaint with the Information Regulator using its published complaints process at https://inforegulator.org.za/complaints/. You do not have to waive that right or complete an internal process before using an available statutory remedy.

This notice is interpreted under South African law. Mandatory rights and obligations under other applicable laws are not excluded by this statement. We do not claim that every foreign privacy regime automatically applies to every visitor or that publishing this notice establishes worldwide compliance.

The publication date identifies this version. We will update the notice when practices or legal requirements materially change and provide additional notice where required. A new purpose requiring consent needs that consent; merely continuing to browse is not automatic acceptance of unrelated processing. Earlier processing remains subject to the applicable law and the notice and lawful basis relevant at the time.

For privacy enquiries or requests: support@tinsolutions.co.za, addressed to the Information Officer; telephone 087 265 2842; or the authenticated client portal at https://portal.tinsolutions.co.za/. Public business address: 585 Bhuga Trust, Kabokweni, Mbombela, Mpumalanga, South Africa.

For a formal request for access to records, ask us for the applicable PAIA process and manual. This privacy notice explains personal-information handling; a PAIA manual addresses the formal access-to-records process. The Information Regulator provides information on rights and complaints at https://inforegulator.org.za/.