POPIA operator agreement

Under the Protection of Personal Information Act (POPIA), you are the responsible party for your clients' personal information, and Zarbook is your operator: we process it only on your instructions, to provide the service. This is a draft for testing only.

What we process

Your client's first name, phone number or email, the service booked, the appointment time, and payment status. Card details are handled by Paystack only. We never see or store them.

Where it is stored

Our database is hosted by Supabase in the European Union (Ireland). Payments are processed by Paystack. [Lawyer to confirm cross-border transfer wording under section 72 of POPIA.]

Your calendar

If you connect your calendar or add a booking to it, the client's first name and cellphone number, the service, the appointment time and the deposit details are sent to the calendar provider you choose (for example Google, Apple or Microsoft), on your instruction. The private calendar link is shown to you once; anyone you share it with can see those booking details. You can replace or turn off the link at any time in Settings.

Security and breaches

We keep the information secure and will tell you without undue delay if we become aware of a breach affecting your clients' information.

Deleting information

[Lawyer to confirm retention periods for payment records, and how client information is deleted on request.]