Privacy & POPIA notice
Version 1.0 · effective 17 October 2026
This notice explains how FlashAware (Pty) Ltd ("FlashAware", "we") processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It covers visitors to flashaware.com, people who request a trial or report, users of the FlashAware service, and the alert recipients our customers list.
1. Responsible party and Information Officer
FlashAware (Pty) Ltd (registration number 2026/380675/07, registered office 6 Rooikransie, Herolds Bay, George, Western Cape, 6529) is the responsible party. Our Information Officer is the company's director, reachable at hello@flashaware.com (subject line "Information Officer"). For alert recipients, our customer organisation is the responsible party and FlashAware processes that information as its operator under section 20 of POPIA.
2. What we collect and why
| Who | Information | Purpose and lawful basis |
|---|---|---|
| People who request a trial, report or quote | Organisation, site name and location, your name, work email, mobile number (optional), site type, what you asked for, your marketing choices, IP address and time of submission | To deliver what you asked for (performance of a contract or steps at your request, s11(1)(b)); to send marketing only where you consented (s69) |
| Account users (admins, operators, viewers) | Name, email, hashed password, role, organisation, sign-in times, IP address, actions taken (audit log) | To provide and secure the service and keep the audit trail customers rely on (contract; legitimate interest in security, s11(1)(f)) |
| Alert recipients listed by a customer | Name, email, mobile number, channel preferences, phone-verification status, delivery receipts and acknowledgements | To deliver operational safety alerts on the customer's instruction (we act as operator; the customer is responsible for its lawful basis) |
| Prospective customer venues | Publicly listed venue names, addresses and generic contact details, and satellite lightning statistics around those addresses | Legitimate interest in offering a safety service to venues exposed to lightning (s11(1)(f)); we only send electronic marketing with consent, and you may object at any time |
| Website visitors | Standard server logs (IP address, user agent, pages requested). No analytics or advertising cookies. | Security and operation of the site (legitimate interest) |
We do not collect information about children. Alert recipients are staff listed by our customers.
3. Direct marketing and your consent
We only send electronic marketing (email, SMS, WhatsApp, social-media messages) to people who are not yet customers if they have opted in, through an unticked checkbox on our forms or a clear "yes" to a single request for permission. Each message identifies FlashAware and tells you how to stop. Customers may opt out of marketing about similar services at any time. We keep a record of consents given and withheld, and a do-not-contact list that we honour across every channel. We send marketing only between 08:00 and 20:00 on weekdays and 09:00 and 13:00 on Saturdays.
4. Where your information comes from
From you, from your organisation's administrator when they add you as a user or recipient, and — for prospective venues — from publicly available directories and websites. Lightning data is from EUMETSAT and is not personal information.
5. Who we share it with (operators and recipients)
- Fly.io — hosting, Johannesburg region (application and database).
- Twilio — SMS and WhatsApp delivery (servers in the United States and the EU).
- Email delivery provider — transactional alerts and, with consent, marketing email.
- Paystack — payment processing; card details are held by Paystack, not by us.
- Customer-relationship and productivity tools (including monday.com and Microsoft 365) — for managing trial requests and customer communication.
- Cloud AI services — used under contract to help draft communications; they process only the limited contact and site details needed for the draft and may not use them for their own purposes.
- Professional advisers, and authorities where the law requires.
Some of these providers are outside South Africa. Where personal information leaves the country we rely on section 72 of POPIA: the recipient is bound by a contract or binding rules that give substantially similar protection, including for onward transfers.
6. How long we keep it
- Lightning flash data: 30 days.
- Alert records: 30 days; personal details inside alert records are removed after 7 days.
- Audit logs: 90 days.
- Account and recipient data: for the life of the organisation's account plus a 30-day grace period, then deleted.
- Trial, report and quote requests and marketing consents: until you withdraw consent or 24 months after our last contact, whichever is sooner; withheld consents and opt-outs are kept on the do-not-contact list so that we do not contact you again.
- Invoices and payment records: five years, as tax law requires.
7. Security
Data is encrypted in transit; passwords are hashed; access is role-based and logged; alert acknowledgement links are single-use tokens. We notify the Information Regulator and affected people of any compromise as section 22 of POPIA requires.
8. Your rights
You may ask what personal information we hold about you, ask us to correct or delete it, object to processing based on legitimate interest, withdraw marketing consent at any time, and complain to the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg; complaints.IR@justice.gov.za; inforegulator.org.za. Contact our Information Officer first and we will respond within a reasonable time, normally 30 days.
9. Cookies
The signed-in application uses two strictly necessary cookies: fa_auth (your
session) and fa_csrf (protection against cross-site request forgery). We use no
analytics, advertising or tracking cookies on this site.
10. Promotion of Access to Information Act (PAIA)
This section serves as FlashAware (Pty) Ltd's manual under section 51 of PAIA, read with the Information Regulator's guidance for small private bodies.
- Contact details: Information Officer, FlashAware (Pty) Ltd, hello@flashaware.com.
- Guide: The Information Regulator's guide on how to use PAIA is available at inforegulator.org.za.
- Records held: company and statutory records; financial and tax records; customer contracts, invoices and correspondence; personnel records; service data (site configurations, alert and audit logs, recipient lists) held on behalf of customers; marketing consent records.
- Records available without a request: this notice, the terms of service and the pricing page.
- How to request a record: complete Form 2 (Request for Access to Record) from the Information Regulator's website and email it to the Information Officer. Fees are charged according to the PAIA Regulations. We respond within 30 days, extendable once by 30 days where the Act allows.
- Personal information processed: as set out in section 2 of this notice; purposes in section 2; recipients in section 5; cross-border transfers in section 5; security measures in section 7.
11. Changes to this notice
We will post changes here with a new version date and, for material changes, email account holders.