Last updated: June 2026
1. Introduction
Total Effex PTY Ltd ("Total Effex", "we", "us", or "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and all applicable South African data protection legislation.
This Privacy Policy applies to all personal information we collect through our billing platform at billing.totalfx.co.za, our website at totalfx.co.za, and any services we provide.
By using our services, you acknowledge that you have read and understood this Privacy Policy.
2. Who We Are (Responsible Party)
3. What Personal Information We Collect
We collect personal information necessary to provide our invoicing and billing services. This includes:
3.1 Account Information
- Full name and business name
- Email address and telephone number
- Business registration and VAT numbers
- Billing and postal address
- Login credentials (passwords are stored in encrypted form only — we never store plain-text passwords)
3.2 Financial Information
- Invoice and payment history
- Banking reference information (for reconciliation purposes — we do not store full bank account details of our customers)
- Subscription and billing records
3.3 Client Data You Upload
- Your clients' names, email addresses, telephone numbers, and addresses that you enter into the system to generate invoices
- Invoice line items, products and services you bill for
3.4 Technical Information
- IP address and browser type (used for security and invoice view tracking)
- Session tokens and login cookies
- Date and time of access
4. Why We Collect Your Information (Lawful Basis)
We process personal information on the following grounds under POPIA:
- Contract performance: To provide the billing and invoicing services you have subscribed to
- Legal obligation: To comply with South African tax, accounting and financial legislation
- Legitimate interest: To improve our services, ensure platform security, and communicate service-related updates
- Consent: For optional communications such as product updates and newsletters (you may withdraw consent at any time)
5. How We Use Your Information
- To create and manage your billing account
- To process and track invoices and payments
- To send invoices, statements, and payment confirmations to your clients on your behalf
- To send you account notifications, receipts, and service updates
- To process subscription payments via our payment provider (PayFast)
- To maintain platform security and prevent fraud
- To respond to support requests
- To comply with legal and regulatory obligations
6. Your Clients' Data — You as a Responsible Party
When you use our billing platform to manage your own clients' data (names, email addresses, invoices), you are the Responsible Party for that data under POPIA. We act as an Operator processing that data on your behalf.
You are responsible for:
- Ensuring you have a lawful basis to store and process your clients' personal information
- Informing your clients that their data is processed using third-party software
- Complying with any data access or deletion requests from your clients
We will only use your clients' data as necessary to provide the invoicing service to you and will never sell, share, or use it for our own marketing purposes.
7. How We Share Your Information
We do not sell or rent your personal information. We may share it only with:
- PayFast (Pty) Ltd — our payment gateway, for subscription billing only. PayFast is PCI-DSS compliant and subject to their own POPIA-compliant privacy policy.
- Hosting Provider — our web hosting provider for platform infrastructure. Servers are located in South Africa.
- Law enforcement or regulators — where required by South African law.
All third parties are required to handle your data securely and in accordance with POPIA.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal information, including:
- HTTPS encryption for all data in transit
- Bcrypt hashing for all stored passwords (we cannot see your password)
- Database files protected from direct web access
- Login rate limiting to prevent brute-force attacks
- Signed authentication tokens with 30-day expiry
- Session-based access controls with per-business permissions
While we take all reasonable steps to protect your data, no internet-based system is 100% secure. You should use a strong, unique password and log out of shared devices.
9. Data Retention
- Active accounts: Data is retained for as long as your account is active
- After cancellation: We retain invoicing records for a minimum of 5 years to comply with South African tax legislation (SARS requirements). After this period, data is permanently deleted.
- Backup data: May be retained for up to 90 days in encrypted backups
10. Your Rights Under POPIA
You have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Ask us to correct inaccurate or incomplete information
- Deletion: Request deletion of your personal information (subject to legal retention requirements)
- Objection: Object to processing of your information in certain circumstances
- Withdrawal of consent: Withdraw consent at any time where processing is based on consent
- Complaints: Lodge a complaint with the Information Regulator of South Africa
To exercise any of these rights, contact us at kyle@totaleffex.co.za. We will respond within 30 days.
11. Request Account or Data Deletion
Right to be forgotten
You may request that we delete your account and the personal information we hold about you at any time. Submit a request using the form below, or email us directly at kyle@totaleffex.co.za.
Please note: Where you are a business owner using our platform, certain invoicing records must be retained for a minimum of 5 years to comply with South African tax legislation (SARS). We will delete everything we are legally permitted to delete, and remove the remainder once the retention period expires. If you are an end-client of one of our business owners, your data is controlled by that business — we will forward your request to them.
12. Information Regulator
If you are not satisfied with how we handle your personal information, you may contact:
13. Cookies
Our billing platform uses the following cookies:
- Authentication cookie (tfx_auth_v2): Essential — keeps you securely logged in for up to 30 days. Signed and encrypted; contains no personal information beyond your account identifier.
- Tenant context cookie (tfx_tenant_ctx): Essential — for business owners on the platform, identifies which account's data you are working in. Session-based.
We do not use advertising, tracking, or analytics cookies. No third-party cookies are set by our platform.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users by email of any material changes. The date of the most recent revision is shown at the top of this page. Continued use of our services after changes constitutes acceptance of the updated policy.
15. Contact Us
For any privacy-related questions, data access requests, or concerns: