Privacy Policy

Ataa Pay (registration number 2026/540145/07) is a South African company at 120 Church Street, Cape Town, 8001. We run the Ataa platform at ataapay.co.za.

For the purposes of the Protection of Personal Information Act (POPIA), Ataa Pay is the responsible party for the information described here. Our Information Officer can be reached at help@ataapay.co.za.

If you are a vendor or a cause, we collect what we need to confirm you are real and to get you paid: your name and business name, your South African ID or passport number, company, non-profit or trust registration number, VAT number where it applies, your business address and its map location, your phone number and email address, your logo and photographs, the description of your business or your cause, and your banking details along with any proof-of-banking or identity document you upload.

If you book or buy something, we collect your name, email address, phone number, the details of the booking including how many people are coming, any special requests or dietary notes you give the vendor, and a reference for the payment.

If you give to a cause, we record the amount, the payment reference, which cause or campaign it was for, and whether you asked for it to be shown publicly.

If you leave a review, we keep your rating, your comment and the name you give.

For everyone with an account, we hold your email address and, if you connect it, your WhatsApp number. Your password is handled by our login provider and is never visible to us. We also keep basic records of your plan, trial and any referral code, and short-lived technical records used to stop abuse such as repeated login attempts.

• To provide the service you asked for — an account, a page, a booking, a payment or a donation.
• To meet legal obligations, including South African financial record-keeping rules and, where relevant, FICA requirements for confirming who a vendor is before paying them.
• For our legitimate interests in running the platform safely — preventing fraud and abuse, and reviewing vendor and cause applications before approving them.
• With your consent, where you have given it — for example connecting WhatsApp to receive booking messages.

We do not sell your personal information to anybody. We share it only with the services that make the platform work:

• Supabase — stores our database, handles logins, and holds uploaded files such as logos, photographs and documents.
• Vercel — hosts the website itself.
• Payment providers such as Paystack, or the vendor's own payment provider — to take a payment. Card details are entered on the payment provider's own secure page and never reach Ataa.
• Twilio — sends the WhatsApp messages, such as booking confirmations, reminders and one-time login codes.
• Resend — sends our emails.
• Google — only if you choose to sign in with a Google account.
• OpenStreetMap — if you use the 'use my location' button while filling in your address, your coordinates are sent there to look up the street address.

Some of these services store information outside South Africa. Where that happens, we rely on the provider's contractual and technical safeguards to protect it, as POPIA permits for cross-border transfers.

We may also share information where the law requires it, or where we need to establish or defend a legal claim.

Ataa is deliberately built so that causes never publish information about the people they help. We ask causes to describe their work, not the individuals who receive it, and we ask for a quote from a partner or staff member rather than from a beneficiary. If you run a cause, please do not upload photographs, names or details of the people you support.

• All traffic to the site is encrypted.
• Passwords are managed by our login provider and are never stored or seen by us.
• Database rules mean one vendor cannot read another vendor's records.
• Further database-level protections stop anyone changing their own verification status, plan or locked banking details by going around the app.
• Banking details lock once an account is verified, and can only be changed again with our involvement.
• Administrator access requires a second factor from an authenticator app, not just a password.
• One-time login codes are stored scrambled, never in readable form.

No system is perfect. If we ever discover a breach affecting your personal information, we will notify you and the Information Regulator as POPIA requires.

You can delete your account from your account settings. What happens then depends on whether money has moved through it:

• If you have never had a booking or a donation, everything is erased — your login, your profile, your listings, your banking details and every file you uploaded.
• If you have, we immediately remove your name, ID number, address, phone number, banking details, photographs and uploaded documents, and permanently close your login. What remains is an anonymous record of the transactions themselves, which South African record-keeping rules require us to hold.

Either way, account deletion cannot be undone.

Under POPIA you may ask us to:

• Tell you what personal information we hold about you.
• Correct anything that is wrong or out of date.
• Delete information we no longer have a reason to keep.
• Stop using your information for a particular purpose, where you have the right to object.

Email help@ataapay.co.za and we will respond. If you are not satisfied with how we have handled it, you may complain to the Information Regulator of South Africa, whose details are at inforegulator.org.za.

We use only what the site needs to work — mainly a cookie that keeps you logged in. We do not use advertising trackers, and we do not build profiles of you for marketing.

Ataa is not intended for anyone under 18, and we do not knowingly collect information about children. If you believe a child has given us information, contact us and we will remove it.

If we change this policy we will update the date at the top of this page, and for significant changes we will tell account holders directly.