1. Who we are

BayFlow is provided by INSIGHTSPHERE TECHNOLOGIES (PTY) LTD, registration number 2026/298628/07. This Privacy Policy explains how personal information is processed when people use BayFlow, our website, Workshop accounts, customer portals and related services. We process personal information in accordance with POPIA and applicable South African law.

2. Scope

This Policy applies to personal information processed through the BayFlow website, Workshop accounts, Platform Admin, Workshop users, customer portals and approval links, support interactions, transactional communications and related BayFlow services.

3. Our role and the Workshop's role

Our privacy role depends on why information is processed. For information used by INSIGHTSPHERE TECHNOLOGIES (PTY) LTD for its own purposes, such as account and subscription administration, security, support, service improvement, legal compliance and direct relationships with BayFlow users, we may act as the responsible party under POPIA.

For operational information a Workshop enters about its customers, employees or other persons, the Workshop generally determines why it is collected and used. In that context the Workshop generally acts as responsible party and BayFlow processes information on its behalf as an operator, subject to POPIA, the Terms and applicable agreements. The actual role always depends on the relevant facts and law.

4. Information we may process

Workshop and account information

• business name and contact information;
• user names, usernames, email addresses and mobile numbers;
• roles and permissions; and
• account and subscription information.

Customer information entered by Workshops

• customer contact and vehicle information;
• registration, Job Card, service and repair history;
• quotations, approvals, inspection information and photographs;
• communications and related Workshop records.

Employee and mechanic information

Name, role, work assignment, system permissions and Workshop activity relevant to operations.

Billing information

Billing contact, invoice details, payment status and references, and information needed to administer subscriptions. BayFlow should not store card information unless a future approved and compliant payment flow specifically requires it.

Technical, security and support information

IP address where legitimately captured, browser or device information, session information, authentication and security events, request identifiers, logs, timestamps, audit information, support requests, emails and troubleshooting information voluntarily provided.

5. How information is collected

Information may be collected directly from Workshop owners and users, during tenant provisioning, when users enter operational information, when customers use secure portal links, through support, through normal server and security logs, and from integrations expressly enabled by the Workshop.

6. Why we process information

We may process personal information to create and administer accounts; authenticate users; operate BayFlow; manage customers, vehicles and Job Cards; provide inspections and approvals; maintain workshop and vehicle history; facilitate customer communications; provide support; administer Pilots, Trials and paid subscriptions; administer invoices; secure the platform; prevent fraud or abuse; maintain audit and operational records; troubleshoot and improve BayFlow; comply with law; and establish, exercise or defend legal rights.

7. Lawful processing

BayFlow processes personal information only where permitted under POPIA. Depending on the circumstances this may include processing necessary to conclude or perform a contract, comply with a legal obligation, protect a legitimate interest of a data subject, pursue a legitimate interest as permitted by law, or act on consent where consent is the appropriate lawful basis.

Acknowledging this Privacy Policy is not blanket consent to every processing activity.

8. Information the Workshop enters into BayFlow

The Workshop is responsible for ensuring that information it collects about customers, employees and others is collected and used lawfully. It should place into BayFlow only information reasonably necessary for legitimate Workshop operations.

9. Special personal information and children

BayFlow is not designed for unnecessary collection of special personal information or children's personal information. Users should not upload it unless genuinely required for a lawful purpose and all applicable POPIA requirements have been met.

10. Service providers

BayFlow may use trusted third-party providers for cloud application hosting, managed databases, secure file or media storage, transactional email, monitoring, security and other necessary infrastructure. Providers may process information only as necessary for their services, subject to appropriate contractual, technical and organisational safeguards.

BayFlow does not represent that every provider or every record is located in South Africa.

11. Cross-border processing

Some technology providers may process or store information outside South Africa. BayFlow will take reasonable steps to ensure cross-border transfers are handled in accordance with POPIA and applicable law, including requirements governing transborder information flows.

12. Email and communications

BayFlow may send transactional or operational messages about account security, service administration, customer approvals, Job Cards, repair updates, vehicle collection, support, Trial or Pilot notices and other requested service functions. Transactional communications differ from marketing. Marketing or direct marketing must comply with POPIA, ECTA and applicable law and include an appropriate opt-out where required.

13. Cookies and session technology

BayFlow currently uses cookies or similar local browser technology required for secure login, authentication, session management, security and user preferences. These are essential to operating the service. BayFlow does not currently use advertising or marketing cookies. If optional analytics are introduced, this Policy and any required consent mechanism will be updated appropriately.

14. Information sharing

BayFlow does not sell Workshop or customer personal information to advertisers. Information may be disclosed only where reasonably necessary to operate the service through authorised providers, at the Workshop's instruction, to comply with law or lawful requests, to protect rights or platform integrity, during a legitimate corporate transaction with safeguards, or where otherwise authorised.

15. Security

BayFlow uses reasonable technical and organisational safeguards appropriate to the information processed. Measures may include authentication, tenant isolation, access controls, encryption, secure secret management, audit logging, managed infrastructure, database controls, secure media access and security monitoring. No system can guarantee absolute security.

16. Security compromises

If BayFlow becomes aware of a compromise involving personal information, it will respond in accordance with POPIA and applicable incident-response obligations. Where required, affected responsible parties, data subjects and/or the Information Regulator will be notified in the legally required manner.

17. Retention

Personal information will not be kept longer than reasonably necessary for its purpose, subject to legal requirements, Workshop instructions where BayFlow acts as operator, contractual obligations, legitimate operational records, disputes, security requirements and backup cycles. When no longer lawfully required, information may be deleted, destroyed, de-identified or anonymised as appropriate.

18. Account closure

Closing, suspending or cancelling an account does not necessarily cause immediate deletion. Data may remain temporarily for backup cycles, legal compliance, dispute handling, financial records, security, recovery or lawful Workshop access and export.

19. Data subject rights

Subject to POPIA and applicable limitations, a person may ask whether information is held; request access; request correction of inaccurate or outdated information; request deletion or destruction where legally appropriate; object to certain processing; withdraw consent where processing genuinely depends on consent; and complain about unlawful processing.

Identity may need verification. Where BayFlow holds information solely for a Workshop, a request may need to be referred to or handled with that Workshop as responsible party.

20. How to make a privacy request

This support address is not represented as the registered Information Officer's address.

21. Information Regulator

A person who believes their information has been processed unlawfully may have the right to complain to South Africa's Information Regulator. Visit the Information Regulator's official website.

22. Customer portal users

A customer receiving a BayFlow link from a Workshop is not required to accept the Workshop's commercial BayFlow Terms merely to view an authorised customer portal. This Privacy Policy remains available from customer-facing areas.

23. Automated decision-making

BayFlow does not currently perform automated decision-making that produces legal or similarly significant effects. Workshop users remain responsible for operational, repair, approval and account decisions made through the platform.

24. Changes to this Privacy Policy

BayFlow may update this Policy when processing practices, features, service providers, legal requirements, security or operations change. The current version and effective date will remain available and material changes will be communicated appropriately.

25. Contact