Last updated 19 October 2026. This policy explains how Thynkverse (Pty) Ltd collects, uses and protects personal information, as required by the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Who we are
Thynkverse (Pty) Ltd, registration number 2022/727212/07, Bay View Road, Wynberg, Cape Town, Western Cape, South Africa.
Information Officer: Stan Banilao, Director, accounts@thynkverse.co.za. Our PAIA manual is available on request.
2. Our two roles
We handle personal information in two different roles. Which one applies decides who is responsible for it.
| Role | When | Who decides how it is used |
|---|---|---|
| Responsible party | Our own website, demo bookings, client contacts, User accounts, licences and billing | Thynkverse |
| Operator | Information our clients process in our products, such as their customers' records, credit reports, messages and signed documents | Our client, who is the responsible party. We follow its instructions |
If you are a customer of one of our clients and want to know how your information is used, please contact that company first. We will help them respond.
3. What we collect as responsible party
- Contact details: name, job title, company, phone number, email and WhatsApp number.
- Account and licence details: User names, email addresses, roles, workspaces, device identifiers, sign-in times, licence status and seat counts, held in Super Control.
- Usage counts: for example how many captures or calls a Thynkly seat recorded, used for licensing and the Client's own reports.
- Billing details: invoices, payment records and company registration details.
- Communications: messages you send us by WhatsApp, email or our website.
- Website data: basic technical data such as browser type and pages visited.
We do not ask for special personal information, such as health or religious information, for our own purposes.
4. Why we use it
| Purpose | Lawful basis under POPIA (section 11) |
|---|---|
| Providing products, licences and support | Needed to perform our agreement |
| Billing and accounting | Needed to perform our agreement, and legal obligation |
| Keeping our products and Users secure | Legitimate interest |
| Improving our products | Legitimate interest |
| Responding to demo requests and enquiries | Your request, and legitimate interest |
| Telling clients about related products | Legitimate interest, with an opt-out in every message |
| Marketing to people who are not clients | Consent |
You may object to processing based on legitimate interest at any time.
5. Direct marketing
We only send marketing to people who are not our clients if they have agreed to it. Clients may receive information about our similar products. Every marketing message includes a way to opt out, and we stop as soon as you ask.
6. Who we share it with
We do not sell personal information. We share it only with:
- Service providers who host or run our systems, including Microsoft (Microsoft 365), Supabase (databases), Vercel (websites), GitHub (code hosting) and Meta (WhatsApp Business). They may only use it to provide their service to us.
- Professional advisers, such as our attorneys and accountants, under confidentiality.
- Authorities, when the law requires it.
- A buyer of our business, if Thynkverse is sold, under the same protections.
7. Information sent outside South Africa
Some of our service providers, such as Microsoft, Supabase and Vercel, may store information in data centres outside South Africa, including in Europe and the United States. We only do this where the recipient is bound by law or agreement to protect it at a level similar to POPIA, as section 72 requires.
8. How we protect it
- Licensed: every User and device is checked by Super Control before it can sign in.
- Separated: each client's data is kept apart, and most of it lives in the client's own environment.
- Role-based: Users only see the workspaces their role allows.
- Logged: changes are kept in history.
- Revocable: access can be suspended immediately.
- Tested: every release goes through TEST and DEMO before LIVE.
Our staff and contractors are bound to confidentiality.
9. Debt review information
Our debt review products, iThynk, Stride, StatusFlow and iThynk CRM, handle some of the most sensitive information a person has: ID numbers, credit reports, debts, income and expenses. We treat it with extra care.
- The debt counsellor is in charge. The registered debt counsellor is the responsible party for its clients' information and decides how it is used. Thynkverse is its operator.
- Used only for debt review. Credit reports and Form 16 details are used only to assess and manage the consumer's debt review, as the National Credit Act and the credit bureaus' rules allow. We never use them for our own purposes, marketing or profiling.
- Confidential by law. The National Credit Act gives consumers the right to have their information treated as confidential. We support the debt counsellor in meeting that duty.
- Stored in the client's own environment. Case records, credit reports and documents stay in the debt counsellor's own Microsoft 365 environment or on its own computers, not on Thynkverse servers.
- Only the right people see it. Access is role-based, so staff only see the workspaces their job needs, and every change is logged.
- Never shared by us. We do not send consumer information to credit providers, the NCR, credit bureaus or anyone else. Those submissions are made by the debt counsellor, through its own accounts.
- Checked by a person. Our tools flag and calculate; the debt counsellor makes every decision about a consumer's debt review.
Consumers who want to see, correct or object to their information should contact their debt counsellor, who will involve us if needed.
10. If something goes wrong
If we have reasonable grounds to believe personal information has been accessed without authority, we will notify the Information Regulator and the affected people as soon as reasonably possible, as section 22 requires. Where we are the operator, we tell the client immediately so it can do the same.
11. How long we keep it
- Account and licence records: for as long as the account is active, then 12 months.
- Billing records: 5 years, as tax law requires.
- Enquiries that did not lead to a sale: 12 months.
- Information we hold as operator: as the client instructs, and deleted or returned when our agreement ends.
12. Your rights
You have the right to:
- Ask whether we hold your personal information, and for a copy of it.
- Ask us to correct or delete it.
- Object to processing, including for direct marketing.
- Withdraw consent you gave, for the future.
- Complain to the Information Regulator.
To use these rights, email accounts@thynkverse.co.za. We respond within 30 days and may need to confirm your identity first.
The Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg. Complaints: POPIAComplaints@inforegulator.org.za. Website: inforegulator.org.za.
13. Children
Our products are for businesses and are not meant for anyone under 18. We do not knowingly collect children's information for our own purposes.
14. Cookies
Our websites use only the cookies needed for them to work. We do not use advertising or tracking cookies. If this changes, we will update this section first.
15. Our commitments as operator
When we process personal information for a client, we:
- Process it only on the client's documented instructions.
- Keep it confidential and do not use it for our own purposes.
- Apply the security measures in section 8.
- Tell the client immediately about any suspected breach.
- Help the client respond to data subjects' requests.
- Return or delete it when the agreement ends, as the client chooses.
16. Product notes
| Product | What it processes | Where it is stored |
|---|---|---|
| iThynk CRM | The client's customer, staff and case records | The client's own Microsoft 365 environment. Thynkverse does not access it unless the client grants access for support |
| iThynk | Credit reports, ID numbers and Form 16 details the client supplies | Processed for the client. Results go to the client |
| Stride | Debt review case data, NCR submissions, 17.1, 17.2 and proposals | The client's own environment |
| StatusFlow | Lead lists and DHS results | The User's own computer. Results of files sent for later checking are emailed to the User and then deleted within 30 days |
| Chatto | WhatsApp numbers, names and messages | The client's own environment, and WhatsApp's systems |
| ThynkSign | Signers' names, email or phone, signatures, IP addresses, signed documents and audit trails | Thynkverse-hosted, for the client, for the life of the account plus 90 days |
| Thynkly | User name, capture and call counts, link status | The client's CRM and Super Control |
17. Changes to this policy
We will post any update here with a new effective date, and tell clients directly about material changes.