Last updated 4 September 2026 · Gqeberha

Privacy Policy

What we hold, why we hold it, and how to make us stop. This site has no cookies, no analytics and no tracking of any kind — so this page is shorter and more specific than most.

The rest of this page is the long version, because a summary you cannot check is just a promise. It is written to satisfy sections 18 and 69 of the Protection of Personal Information Act 4 of 2013 (POPIA), and it is written in plain language on purpose.

1. Who is responsible for your information

Dot is one person and a small amount of software. There is no call centre, no data broker relationship, and nobody else reading your messages.

2. What this website collects — which is almost nothing

Most privacy policies at this point list a page of tracking technologies. Ours is short because the site genuinely does not use them.

Web-server logs. This site is hosted by Afrihost on shared hosting in South Africa. Like every web server, theirs records ordinary technical information about each request: the IP address it came from, the time, the page asked for, and the browser identifier. That happens at the server, not in your browser, and it exists so the host can keep the site up and defend it against attack.

We do not use those logs to build a profile of anyone, we do not connect them to anything else, and we do not look at them unless something is broken. We should also be straight with you about the limit of what we control: the retention period for those logs is Afrihost's, not ours.

We asked them directly, because the previous version of this page said we would. Afrihost replied on 2 September 2026 (support ticket OIZ‑200‑13143) and told us three things. There is no published retention period for raw access logs on shared hosting, and their privacy policy does not set one; in their words it is “generally… around a month”, which is an estimate and not a commitment. Logging and log rotation are managed at the server level, so they cannot give an individual shared-hosting account a shorter retention period or reduced logging — we asked for that too, and the answer was no. And the logs for this site are reachable by us through cPanel.

So the honest position is this: a record of your IP address, the time, the page and your browser identifier exists on that server for a period we do not set and cannot shorten, probably about a month. We do not read it, we do not export it, and nothing in Dot's software touches it. If that is not acceptable to you, the remedy is not something we can offer — it is a question for Afrihost, or a reason to use a VPN.

The free Stock Check

The stock check at /assessment/ asks for your business name, your name, your role, a WhatsApp number, an optional email address, your sector and some questions about how stock moves through your business.

None of that is sent anywhere when you fill it in. The questions are scored by JavaScript running in your own browser and the result is drawn on your own screen. It leaves your device only if you press “Send result to Dot on WhatsApp”, which opens WhatsApp with the text prepared so you can read it before you send it. If you close the tab instead, we never see any of it, and there is nothing for us to delete.

If you do send it, we receive it as a WhatsApp message and it is covered by section 3 below.

3. What we collect when you contact us

When you WhatsApp us, email us, or send a stock-check result, we hold whatever is in that message. In practice that is your name, your business, the number or address you contacted us from, and what you told us about your business.

WhatsApp is not ours. It belongs to Meta. If you message us on WhatsApp, Meta handles that message on its own terms and its own privacy policy applies to it as well as this one. The same is true of email in transit. If you would rather not use either, phone conversations and meetings in person are always available and leave no third party in the middle.

4. If you are a Dot Book client — where your records actually live

This is the part that matters most, and it is the reason Dot Book is built the way it is.

Dot Book installs on your device and your records stay on your device. Your stock, your job cards, your second-hand goods register, your customers' details, the photographs — those sit on your machine, not on our server. We do not have a copy, we cannot read them, and if we vanished tomorrow you would still have every record.

That is a deliberate design decision and it has a cost: the backup is your responsibility, and Dot Book has a backup button for exactly that reason. We would rather tell you that plainly than pretend a cloud we do not run is safer.

When we do touch your data. If you send us a backup file so we can help with a problem, or we sit at your counter during setup, we are handling personal information that belongs to your business and to your customers. In POPIA's language, for that data you are the responsible party and we are your operator. That means, under sections 20 and 21 of the Act:

• We process it only on your instruction and only for the reason you gave it to us.
• We treat it as confidential, and we do not use it for anything of our own.
• We delete the copy when the job is finished, and we will confirm that we have.
• If it were ever compromised, we would tell you immediately so that you can meet your own section 22 obligation to notify the Information Regulator and the people affected.

Where your register contains your customers' identity numbers — as the Second-Hand Goods Act requires it to — that is special personal information under POPIA and we treat any contact with it accordingly.

5. How we approach businesses that have not contacted us

We would rather set this out than have you wonder how we got your number.

We build a list of businesses in our area from publicly published sources — a shop's own website, its own public listing, its own advertisement. We record where each number came from, so any one of them can be traced back to the page it was published on.

Section 69 of POPIA governs direct marketing by electronic communication, and the Information Regulator's guidance treats WhatsApp and social-media messages as electronic communication. Section 69 permits a responsible party to approach someone who has not previously withheld consent only once, in order to ask for that consent. So:

• One approach. Ever. If you do not reply, that is an answer, and we do not send a second message. Our own software enforces this — it locks the rest of the list until a reply comes back.
• Every message says who we are, where we got the number, what we are offering, and how to stop it, as section 69(4) requires.
• “STOP” is permanent. Reply with it and you go on the do-not-contact list and never hear from us again. You do not have to explain, and it costs you nothing.
• We keep the do-not-contact list forever, on purpose. Deleting it would mean forgetting that you asked. If you would rather be erased from it completely, say so and we will — but understand that it removes the record of your objection.

Note that in South Africa a company is itself a data subject: POPIA protects juristic persons as well as people. So these rules apply to the shop, not only to the person answering the phone.

6. Our Facebook Page, and the software that posts to it

We run a Facebook Page, and we use a small application of our own to publish posts to it. It exists so that Dot can post its own guides without a person having to retype them.

• The application only posts to our own Page. It holds a single access token belonging to that Page. It does not read your profile, your friends, your messages, or anything else on Facebook.
• It collects no data from anyone visiting our Page. There is no database of followers, no export of commenters, no lookalike audience.
• Nothing is posted without a person reading it first. Every post is drafted, then displayed in full, then published only by a deliberate click by Darius in the same sitting. There is no unattended scheduling.
• If you comment on or message our Page, Meta processes that under its own terms, and Meta gives us aggregate Page statistics we did not ask it to collect. We cannot switch those off; they are counts, not identities.

If you have interacted with our Page and want anything we hold as a result of it deleted, the route is on our data deletion page, and it works whether or not you have a Facebook account.

7. How long we keep things

Section 14 of POPIA says records must not be kept longer than necessary. Our periods are:

Ask us to delete something sooner and we will, unless the law obliges us to keep it — in which case we will tell you which law and for how long, rather than just saying no.

And a note on how these are actually kept. A retention period nobody enforces is a sentence on a web page, not a practice. Ours are recorded against each contact when it is made, and the software we use to run outreach shows us what has passed its date, so deletion is a task that appears rather than one we have to remember. We would rather tell you the mechanism than ask you to trust the promise.

8. Who we share it with

Nobody. We do not sell, rent, trade or share personal information with anyone for any commercial purpose. We have no advertising partners, no data brokers, no affiliate arrangements.

The only third parties involved at all are the ones carrying the message: the company hosting this website, the provider carrying our email, and Meta if you chose to reach us on WhatsApp. Each sees what it must to deliver the thing, and none of them gets a list from us.

We would disclose information if a court ordered us to, or where the law requires it. If that ever happened and we were permitted to tell you, we would.

Nothing is transferred outside South Africa by us. Note that WhatsApp and email providers operate internationally, so a message you send through them may cross a border in their hands before it reaches ours.

9. Keeping it safe

Section 19 of POPIA requires reasonable technical and organisational measures. At our size that means: devices are password protected and encrypted; access is limited to one person; we do not keep client data we do not need; and the architecture itself does most of the work, because data we never hold cannot be leaked by us.

Two commitments about money, because this is where small businesses actually get hurt:

• We will never publish our bank account on this website.
• We will never email or message you a change of banking details. If you ever receive such a message claiming to be from Dot, it is not from us. Phone the number on this page and check before you send anyone money.

10. Your rights, and how to use them

Under POPIA you may:

• Ask what we hold about you and get a copy — section 23.
• Have it corrected or deleted if it is wrong, misleading, out of date, excessive, or we no longer have a reason for it — section 24.
• Object to us processing it at all — section 11(3).
• Stop direct marketing at any moment — section 69.
• Complain to the Information Regulator — section 74.

How: email info@dotreceive.co.za or WhatsApp 079 677 3392 and say what you want. There is no form to fill in and no fee. We will confirm within a few days and do it within 30 days — usually the same week, because there is not much to search.

Step-by-step instructions are on the data deletion page.

11. If you are not satisfied

Tell us first, honestly — it is one person and it is usually a misunderstanding that takes a phone call. But you do not have to, and you are entitled to go straight to the regulator:

12. Changes to this page

If we change it, the date at the top changes with it. If a change materially affects what we do with information we already hold about you, we will tell the people affected rather than relying on you noticing a date.

This page describes what the website and the business actually do as at 4 September 2026. If you find something on this site that contradicts it, that is a bug and we want to know: info@dotreceive.co.za.