Privacy & POPIA notice
Version 1.1 · effective 19 October 2026 · replaces version 1.0 of 17 October 2026
This notice explains how FlashAware (Pty) Ltd ("FlashAware", "we") processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It covers visitors to flashaware.com, people who request a trial or report, users of the FlashAware service, and the alert recipients our customers list.
1. Responsible party and Information Officer
FlashAware (Pty) Ltd (registration number 2026/380675/07, registered office 6 Rooikransie, Herolds Bay, George, Western Cape, 6529) is the responsible party. Our Information Officer is the company's director, reachable at hello@flashaware.com (subject line "Information Officer"). For alert recipients, our customer organisation is the responsible party and FlashAware processes that information as its operator under section 20 of POPIA.
2. What we collect and why
| Who | Information | Purpose and lawful basis |
|---|---|---|
| People who request a trial, report or quote | Organisation, site name and location, your name, work email, mobile number (optional), site type, what you asked for, your marketing choices, IP address and time of submission | To deliver what you asked for (performance of a contract or steps at your request, s11(1)(b)); to send marketing only where you consented (s69) |
| Account users (admins, operators, viewers) | Name, email, hashed password, role, organisation, sign-in times, IP address, actions taken (audit log) | To provide and secure the service and keep the audit trail customers rely on (contract; legitimate interest in security, s11(1)(f)) |
| Administrators who accept the terms of service | Name, email, terms version, time of acceptance, IP address | To evidence the agreement with your organisation and the notice given under section 49 of the Consumer Protection Act (contract, s11(1)(b); legitimate interest in proving it, s11(1)(f)) |
| Alert recipients listed by a customer | Name, email, mobile number, channel preferences, phone-verification status, delivery receipts and acknowledgements | To deliver operational safety alerts on the customer's instruction (we act as operator; the customer is responsible for its lawful basis) |
| Prospective customer venues | Publicly listed venue names, addresses and generic contact details, and satellite lightning statistics around those addresses | Legitimate interest in offering a safety service to venues exposed to lightning (s11(1)(f)); we only send electronic marketing with consent, and you may object at any time |
| Website visitors | Standard server logs (IP address, user agent, pages requested). No analytics or advertising cookies. | Security and operation of the site (legitimate interest) |
We do not collect information about children. Alert recipients are staff listed by our customers.
3. Direct marketing and your consent
We only send electronic marketing (email, SMS, WhatsApp, social-media messages) to people who are not yet customers if they have opted in, through an unticked checkbox on our forms or a clear "yes" to a single request for permission. Each message identifies FlashAware and tells you how to stop. Customers may opt out of marketing about similar services at any time. We keep a record of consents given and withheld, and a do-not-contact list that we honour across every channel. We send marketing only between 08:00 and 20:00 on weekdays and 09:00 and 13:00 on Saturdays.
4. Where your information comes from
From you, from your organisation's administrator when they add you as a user or recipient, and — for prospective venues — from publicly available directories and websites. Lightning data is from EUMETSAT and is not personal information.
5. Who we share it with (operators and recipients)
- Fly.io — hosting, Johannesburg region (application and database).
- Twilio — SMS and WhatsApp delivery (servers in the United States and the EU).
- Email delivery provider — transactional alerts and, with consent, marketing email.
- Paystack — payment processing; card details are held by Paystack, not by us.
- Customer-relationship and productivity tools (including monday.com and Microsoft 365) — for managing trial requests and customer communication.
- Cloud AI services — used under contract to help draft communications; they process only the limited contact and site details needed for the draft and may not use them for their own purposes.
- Professional advisers, and authorities where the law requires.
Some of these providers are outside South Africa. Where personal information leaves the country we rely on section 72 of POPIA: the recipient is bound by a contract or binding rules that give substantially similar protection, including for onward transfers.
6. How long we keep it
- Lightning flash data: 30 days.
- Alert records: 30 days; personal details inside alert records are removed after 7 days.
- Audit logs: 90 days.
- Account and recipient data: for the life of the organisation's account plus a 30-day grace period, then deleted.
- Trial, report and quote requests and marketing consents: until you withdraw consent or 24 months after our last contact, whichever is sooner; withheld consents and opt-outs are kept on the do-not-contact list so that we do not contact you again.
- Invoices and payment records: five years, as tax law requires.
- Terms acceptance records (who accepted which version, when, from which address): for the life of the organisation's account and five years after closure.
7. Security
Data is encrypted in transit; passwords are hashed; access is role-based and logged; alert acknowledgement links are single-use tokens. We notify the Information Regulator and affected people of any compromise as section 22 of POPIA requires.
8. Your rights
You may ask what personal information we hold about you, ask us to correct or delete it, object to processing based on legitimate interest, withdraw marketing consent at any time, and complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg; POPIAComplaints@inforegulator.org.za; inforegulator.org.za. Contact our Information Officer first and we will respond within a reasonable time, normally 30 days.
9. Cookies
The signed-in application uses two strictly necessary cookies: fa_auth (your
session) and fa_csrf (protection against cross-site request forgery). We use no
analytics, advertising or tracking cookies on this site.
10. PAIA manual (section 51 of the Promotion of Access to Information Act)
This section is the manual of FlashAware (Pty) Ltd under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA), prepared in line with the Information Regulator's template for private bodies. It is available here free of charge and at our registered office on request. Last updated 19 October 2026.
- Private body and head: FlashAware (Pty) Ltd (2026/380675/07), 6 Rooikransie, Herolds Bay, George, Western Cape, 6529. Head of the private body and Information Officer: the director, hello@flashaware.com (subject line "Information Officer"). Postal and telephone enquiries are answered from that address.
- The Regulator's guide: The Information Regulator has compiled a guide under section 10 of PAIA on how to use the Act, in every official language. It is available from the Regulator at inforegulator.org.za and at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.
- Records available without a request: this notice, the terms of service, the pricing page and the other public pages of flashaware.com. No notice under section 52(2) of PAIA has been published.
- Records available under other legislation: company records under the Companies Act 71 of 2008 (through the Companies and Intellectual Property Commission); tax records under the Income Tax Act 58 of 1962 and the Tax Administration Act 28 of 2011 (to the South African Revenue Service); a data subject's own personal information under section 23 of POPIA.
- Subjects and categories of records held: company and statutory records (incorporation, directors, beneficial ownership, resolutions); financial and tax records (invoices, bank and payment records, returns); customer records (agreements, terms acceptances, invoices, correspondence, support history); service records held for customers (site configurations, alert and audit logs, recipient lists, delivery receipts); marketing records (trial and report requests, consents and opt-outs, the do-not-contact list); personnel and contractor records; technical records (source code, infrastructure and security logs).
- How to request a record: complete Form 2 (Request for Access to Record of Private Body) from the Regulator's website and email it to the Information Officer with proof of identity. State which record you want, the form of access you prefer and, if you ask on someone else's behalf, your authority to do so. The request fee and access fees prescribed in the PAIA Regulations, 2021 apply; we tell you the amount before we proceed. We decide within 30 days of receiving a complete request, extendable once by up to 30 days where section 57 of PAIA allows, and we give reasons for any refusal. If we refuse, you may complain to the Information Regulator or apply to court.
- Personal information (section 51(1)(c) of PAIA): the purposes of processing are in section 2 of this notice; the categories of data subjects and of information in section 2; recipients in section 5; planned transfers outside South Africa in section 5; security measures in section 7.
11. Changes to this notice
We will post changes here with a new version date and, for material changes, email account holders.