Solutha (Pty) Ltd ("Solutha", "we", "us", or "our"), trading as Zuzan, is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share your information when you use the Zuzan platform, in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and the Electronic Communications and Transactions Act 25 of 2002 ("ECTA").
1. Who We Are
- Responsible Party: Solutha (Pty) Ltd
- Trading name: Zuzan
- Registration: 2012/086257/07
- Address: 369 Long Avene, Ferndale, Johannesburg, 2194
- Information Officer: Sonwabiso Gwadiso sonwabisog@solutha.co.za
- Email: support@solutha.co.za | Website: zuzan.co.za
2. Personal Information We Collect
2.1 Information you provide directly
- Account registration: name, email address, password.
- Company profile: company name, registration number, VAT number, industry, address, phone number.
- Banking details: bank name, account number, and branch code (stored encrypted at rest).
- Employee records: names, ID numbers, tax numbers, salaries, and bank account details (Payroll module).
- Invoices and financial records: client names, email addresses, transaction amounts.
- Payment credentials: PayFast Merchant ID and Key (stored encrypted; Zuzan never accesses your PayFast funds).
2.2 Information collected automatically
- Log data: IP address, browser type, pages visited, and timestamps.
- Usage data: features used and actions taken within the application.
- Cookies: session cookies for authentication only. We do not use advertising or tracking cookies.
3. How We Use Your Information
We process your personal information only for the following lawful purposes:
- Service delivery: to provide, maintain, and improve the Zuzan platform.
- Billing: to process subscription payments, send invoices, and manage your account.
- Communication: to send service notifications, security alerts, and support responses. We do not send unsolicited marketing without opt-in consent.
- Legal compliance: to meet obligations under South African tax law and applicable legislation.
- Security: to detect fraud, prevent unauthorised access, and protect your data.
- Analytics: aggregated, non-identifiable usage analytics to improve the platform.
4. Sharing of Personal Information
We do not sell, rent, or trade your personal information. We share it only in limited circumstances:
- Email service provider: your email address is shared solely for delivery of transactional emails.
- Payment processing: payment links direct your clients to your own PayFast account. Zuzan does not process or receive your clients' payments.
- Cloud infrastructure: the platform is hosted on Render.com (United States) under a Data Processing Agreement. Render is GDPR-compliant.
- Legal obligation: we may disclose information if required by law, court order, or a regulatory authority such as SARS or the Information Regulator.
- Business transfer: in the event of a merger or acquisition, data may be transferred to the acquiring entity under equivalent protections.
5. Cross-Border Data Transfers
Our hosting infrastructure is located in the United States. By using Zuzan, you consent to your data being stored outside South Africa. We have taken steps to ensure adequate protection through contractual data processing agreements with our hosting provider.
6. Data Security
We implement the following measures to protect your data:
- All data in transit is encrypted using TLS 1.2 or higher (HTTPS).
- Sensitive fields (bank account numbers, PayFast credentials) are AES-256 encrypted at rest.
- Passwords are hashed using bcrypt and never stored in plain text.
- Access to production systems is restricted to authorised personnel only.
- Audit logs record all significant platform actions.
- Role-based access controls limit what each user within your organisation can see and do.
7. Data Retention
- Active accounts: personal and company data retained for the subscription period plus 5 years (SARS requirements).
- Closed accounts: retained for 60 days from cancellation for export, then securely deleted or anonymised. Financial records are retained for 5 years from closure to meet SARS requirements.
- Payroll records: retained for 5 years from the last payroll run (BCEA and SARS requirements).
- Audit logs: retained for 3 years.
8. Your Rights Under POPIA
You have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of your information (subject to legal retention obligations).
- Object to processing of your personal information.
- Lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).
To exercise these rights, email support@solutha.co.za with subject line "POPIA Data Request". We will respond within 30 days.
9. Cookies
Zuzan uses only essential session cookies required for authentication and security. We do not use advertising cookies, tracking pixels, or third-party analytics that identify individuals. You may disable cookies in your browser but this will prevent you from logging in.
10. Changes to This Policy
We will notify you by email at least 14 days before material changes take effect. The current version is always available at zuzan.co.za/privacy.
11. Contact Us
- Solutha (Pty) Ltd | trading as Zuzan
- Information Officer: Sonwabiso Gwadiso
- Email: support@solutha.co.za
- Address: 369 Long Avenue, Ferndale, Johannesburg, 2194
Last updated: 5 July 2026