privacy policy.

1. Who is responsible for your information

Shyshark Digital (Pty) Ltd, a private company registered in South Africa, is the responsible party for personal information processed under this policy. For any privacy queries or requests, contact us at legal@shyshark.co.za.

2. Our products and brands

This policy applies as the base privacy policy for our website and for products and brands operated by Shyshark Digital, including Shy Invoicing and other products we may launch from time to time. Individual products may publish their own privacy notices covering product-specific processing (such as account data, billing information or banking integrations). Where a product notice exists, it supplements this policy and prevails for that product where the two conflict.

3. What we collect

We collect personal information in the following ways:

• Contact form: your name, email address and the content of your message, when you submit our contact form.
• Business engagement: contact details, billing details and project-related information you provide when engaging our services.
• Product accounts: where you sign in to one of our products using a third-party provider (such as GitHub or Google), we receive the basic profile information that provider shares, as described in the relevant product's privacy notice.
• Technical data: limited technical information needed to operate and secure our website and services.

4. Why we collect it

We use personal information to:

• respond to your enquiries and follow up on contact form submissions;
• provide, administer and invoice the services and products you have engaged;
• operate, secure and improve our website, services and products; and
• comply with legal obligations, such as tax and accounting requirements.

We process personal information on the basis of your consent, the performance of a contract with you, our legitimate interests in operating our business, or compliance with law. We do not sell personal information, and we do not use it for third-party marketing.

5. Sharing and service providers

We do not share your personal information with third parties for their own purposes. Your information may pass through, or be stored by, trusted service providers we use to operate our business, such as email delivery services (for example Postmark), hosting and infrastructure providers, and email providers (for example Google Workspace). These providers process information on our behalf under their own security and privacy commitments.

We may disclose personal information where required by law or to protect our legal rights.

6. International transfers

Some of our service providers store or process information outside South Africa. Where this happens, we ensure the recipient is subject to laws, binding corporate rules or contractual terms that provide an adequate level of protection substantially similar to POPIA.

7. Security

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access and unlawful processing. These include access controls limiting personal information to authorised personnel, Multi-Factor Authentication on our systems, strong credential management, and reputable third-party platforms with robust security measures. If a data breach occurs that affects your personal information, we will notify you and the Information Regulator as required by POPIA.

8. Retention

We keep personal information only as long as needed for the purposes described in this policy, or as required by law (for example, tax and accounting records). When information is no longer needed, we delete or de-identify it.

9. Your rights

Under POPIA, you have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or outdated information;
• request deletion of your personal information, subject to legal retention requirements;
• object to processing based on our legitimate interests; and
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at legal@shyshark.co.za. You also have the right to lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).

10. Cookies

Our website uses only essential cookies and local storage, for example to persist form data so previously entered information can be pre-populated. We do not use cookies for advertising or cross-site tracking. Individual products may use additional cookies necessary for authentication and session management, as described in their own notices.

11. Changes to this policy

We may update this policy from time to time. The current version will always be published on our website with its effective date. You can request previous versions by contacting us.

12. Contact

For questions or concerns about our privacy practices, contact us at legal@shyshark.co.za or via the contact form on our website.