Privacy Policy

Last updated: July 2026  ·  Compliant with the Protection of Personal Information Act, 2013 (POPIA)

1. Who we are

BAYT ULAB (Pty) Ltd, trading as "BaniFin" ("BaniFin", "we", "us"), is the Responsible Party for personal information collected through the BaniFin platform, as defined under POPIA.

Information Officer: support@banifin.co.za

2. What personal information we collect

Account information

• Your name and email address (collected at registration)
• Your business name and address
• Your VAT registration number (if applicable)
• Your chosen password (stored as a one-way bcrypt hash — we cannot read it)

Financial data you enter

• Client names, email addresses, and billing addresses
• Invoice amounts, line items, and payment records
• Expense and income records
• Budget figures

This data belongs to you. BaniFin processes it only to provide the Service.

Employee & payroll data (if you use Payroll/HR)

• Employee names, contact details, and identity numbers
• Tax reference numbers and UIF/Compensation Fund reference numbers
• Banking details, for salary payment and bank export files
• Salary, remuneration, and payslip records
• Leave balances and disciplinary records
• Contract terms feeding into salary structures

This information is entered by you, the employer, about your employees. In relation to this data, you are the Responsible Party under POPIA and BaniFin acts as an Operator, processing it only on your instruction to provide the Service. You are responsible for ensuring you have a lawful basis (such as the employment relationship) to provide your employees' personal information to us.

Usage and technical data

• IP address and browser type (server logs, retained for up to 90 days)
• Session data (stored in a server-side session cookie)
• Actions within the platform (for security and audit purposes)

Payment information

Payments are processed by Yoco. BaniFin does not receive or store your card number, CVV, or other sensitive payment credentials. We receive a transaction reference and confirmation of payment from Yoco. Yoco's privacy policy applies to the information you provide during checkout.

3. Why we process your information

4. Who we share your information with

We do not sell your personal information. We share it only with:

• Yoco — payment processing. Only the information needed to complete a transaction is shared.
• Email delivery provider — to send transactional emails on your behalf (e.g. invoice PDFs to your clients).
• Hosting provider — your data is stored on servers that host the BaniFin application.
• Law enforcement or regulators — only when required by South African law.

Statutory filings (VAT201, EMP201, EMP501, IRP5, COIDA Return of Earnings, UI-19) are prepared by BaniFin for you to review and submit yourself to SARS, the Compensation Fund, or the Department of Employment & Labour — BaniFin does not transmit these filings, or the personal information within them, directly to any authority.

All third-party processors are required to handle your data in accordance with POPIA.

5. Data retention

• Account and financial data is retained for the duration of your subscription plus 5 years, as required for tax and legal purposes.
• After account termination, data may be deleted after 30 days unless a longer retention period is required by law.
• Server logs are retained for up to 90 days.

6. Your rights under POPIA

As a data subject, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate personal information.
• Deletion — request deletion of your personal information (subject to legal retention obligations).
• Object — object to processing based on legitimate interest.
• Complain — lodge a complaint with the Information Regulator of South Africa at justice.gov.za/inforeg.

If you have a BaniFin account, you can exercise these rights directly from Your Data & Privacy in the app — view and download a copy of your data instantly, correct your details, or submit a deletion request. You can also contact our Information Officer at support@banifin.co.za. We respond to requests within 30 days.

7. Security

We implement reasonable technical and organisational measures to protect your personal information, including:

• Passwords stored using bcrypt hashing (we cannot read your password)
• HTTPS encryption for all data in transit
• Sensitive personal information — ID numbers, tax references and banking details — encrypted at rest using authenticated AES-256 encryption, and masked by default in the interface
• Access controls limiting which staff can access data
• Regular security reviews

No system is 100% secure. If you suspect a security incident involving your account, contact us immediately.

8. Cookies

BaniFin uses a single session cookie to maintain your login state. This cookie is essential for the Service to function. It is deleted when you log out or when your session expires. We do not use advertising or tracking cookies.

9. Cross-border transfers

Your data is stored and processed in South Africa. Some third-party processors (such as email providers) may process data outside South Africa. Where this occurs, we ensure that adequate protection is in place consistent with POPIA requirements.

10. Changes to this policy

We may update this policy to reflect changes in the law or our practices. Material changes will be communicated to registered users by email. The date at the top of this page indicates when it was last updated.

11. Contact

Information Officer, BAYT ULAB (Pty) Ltd
Email: support@banifin.co.za
South Africa