Privacy Policy

Last Updated: October 10, 2026 · Version 2.0

1. Introduction

Teleios IT Consulting Pty Ltd (Registration No. 2025/487193/07), trading as StoreSuite ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cloud-based enterprise resource planning (ERP) software platform, including our website at storesuite.co.za, web application at app.storesuite.co.za, and mobile applications (collectively, the "Service").

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Service.

2. Data Controller & Information Officer

Teleios IT Consulting Pty Ltd (Registration No. 2025/487193/07), a company registered in the Republic of South Africa, acts as the data controller for personal information collected through the Service.

3. Information We Collect

3.1 Account Information

When you register for an account, we collect:

  • Identity data: Full name, email address, phone number (optional)
  • Organisation data: Company name, country of registration
  • Credentials: Password (stored as a salted cryptographic hash; we never store plaintext passwords)
  • Role: Your role within your organisation (Owner, Admin, Manager, User, Viewer)

3.2 Business Data You Enter

You voluntarily input business data into the Service, which may include:

  • Inventory: Products, materials, stock levels, batch/lot numbers, serial numbers, barcodes, warehouse locations
  • Sales: Customer records, quotes, invoices, payments, credit notes
  • Production: Bills of materials, work orders, quality control batches, defect records, labour tracking
  • Procurement: Supplier records, purchase orders, goods receipt notes
  • CRM: Leads, opportunities, activities, contact details

3.3 Financial & Billing Data

  • Subscription plan and billing cycle
  • Payment history and invoice records
  • Tax identification numbers and tax-exempt status (as entered by you for your customers/suppliers)
  • Credit limits and payment terms (as entered by you)

Note: Credit card numbers and banking details are processed directly by our payment processor (Paystack) and are never stored on our servers.

3.4 Employee Data

If you use the employee management or labour tracking features, the following data may be stored:

  • Employee name, email address, phone number
  • Department, position, hire date
  • Employment status (Active, On Leave, Terminated)
  • Hourly rate (for labour costing on work orders)

3.5 Technical & Usage Data

When you access the Service, we automatically collect:

  • Device information: Device type, operating system, browser type, unique device identifiers
  • Usage data: Pages visited, features used, time spent on the Service, interaction patterns
  • Log data: IP address, access timestamps, referring URLs
  • Region: Country of access inferred from IP address (for currency display purposes only, no precise or coarse location is collected)
  • Error reports: Crash data and error traces (via Sentry)

3.6 Email Engagement Data

Service emails sent through our platform (account notifications, password resets, team invitations) are delivered via SendGrid. We may track:

  • Email delivery status (delivered, bounced, failed)
  • Email open events
  • Link click events

This data helps us ensure reliable email delivery and troubleshoot delivery issues. You may opt out of non-essential email tracking via your Privacy Centre.

3.7 Consent Records

We maintain records of the consents you have given or withdrawn, including the type of consent, timestamp, IP address, and the version of the policy you accepted. This is required under GDPR Article 7 and POPIA Section 11.

4. How We Use Your Information

We use the collected information for the following purposes:

  • Service delivery: To provide, maintain, and improve the StoreSuite ERP service (Legal basis: Contract, Art. 6(1)(b))
  • Billing: To process subscription payments and send billing-related communications (Legal basis: Contract, Art. 6(1)(b))
  • Notifications: To send service notifications including downtime alerts, security warnings, and account updates (Legal basis: Contract, Art. 6(1)(b))
  • Security: To ensure platform security, prevent fraud, and detect abuse (Legal basis: Legitimate Interest, Art. 6(1)(f))
  • Improvement: To monitor and improve service performance and user experience (Legal basis: Legitimate Interest, Art. 6(1)(f))
  • Marketing: To send marketing communications and product updates, where you have opted in (Legal basis: Consent, Art. 6(1)(a))
  • Compliance: To comply with tax, financial, and regulatory obligations (Legal basis: Legal Obligation, Art. 6(1)(c))

5. Data Storage and Security

5.1 Data Location

All data is stored in AWS EU West-1 (Ireland) data centres within the European Union.

5.2 Security Measures

We implement industry-standard security measures including:

  • Encryption at rest: AES-256 for all stored data
  • Encryption in transit: TLS 1.3 for all data transmissions
  • Multi-tenant isolation: PostgreSQL Row-Level Security (RLS) ensures each organisation's data is isolated at the database level
  • Access controls: Role-based permissions with full audit logging
  • Password security: Salted cryptographic hashing using industry-standard algorithms
  • Authentication: JWT tokens with automatic rotation and blacklisting

5.3 Data Retention

We retain your data for as long as your account is active and as required by law:

  • Account data: Duration of account + 30 days after deletion
  • Financial records (invoices, payments, tax records): 7 years (legal/tax obligation)
  • Audit logs: 3 years
  • Login history and security events: 90 days
  • Email delivery logs: 90 days
  • Business data (inventory, orders, customers): Duration of account + 30 days after deletion
  • Backup copies: 30 days after primary data deletion

6. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

  • Notify the relevant supervisory authority (the Information Regulator under POPIA, or the applicable EU Data Protection Authority under GDPR) as soon as reasonably possible and, where feasible, within 72 hours of becoming aware of the breach
  • Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by POPIA Section 22 and GDPR Article 34
  • Provide details including the nature of the breach, categories and approximate number of individuals affected, likely consequences, and the measures taken or proposed to address the breach
  • Document all breaches, including those not requiring notification, as part of our incident response records

If you are an organisation using StoreSuite and a breach affects data you have entered into the platform, we will notify your account owner within 72 hours so that you can fulfil your own notification obligations to your customers, employees, and suppliers.

7. Data Sharing and Third-Party Processors

We do not sell, rent, or trade your personal information to third parties. We share data with the following service providers, each bound by data processing agreements:

  • Amazon Web Services (AWS): Cloud infrastructure, database hosting, file storage (EU West-1, Ireland)
  • Paystack: Payment processing for African customers (South Africa)
  • SendGrid (Twilio): Transactional email delivery (US, with EU Standard Contractual Clauses)
  • Sentry: Error monitoring and crash reporting (US, with EU Standard Contractual Clauses)
  • Cloudflare: CDN, DDoS protection, DNS (Global, EU edge nodes)

We may also share information when required by law, court order, or governmental authority, or in connection with a merger, acquisition, or sale of assets with appropriate notice to you.

We will notify you of any changes to our sub-processor list with at least 30 days' notice.

8. International Data Transfers

Your primary data is stored within the European Union (Ireland). Where data is transferred to sub-processors outside the EEA (SendGrid and Sentry in the United States), we rely on:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • EU-U.S. Data Privacy Framework (DPF) certification where applicable
  • Supplementary technical measures including encryption in transit and at rest

9. Your Rights and Choices

Under the General Data Protection Regulation (EU) and the Protection of Personal Information Act (South Africa), you have the following rights:

  • Access (GDPR Art. 15 / POPIA s23): Request a copy of the personal data we hold about you
  • Rectification (GDPR Art. 16 / POPIA s24): Correct inaccurate or incomplete data
  • Erasure (GDPR Art. 17 / POPIA s24): Request deletion of your personal data, subject to legal retention obligations
  • Data Portability (GDPR Art. 20): Receive your data in a structured, machine-readable format (JSON, CSV, or PDF)
  • Restriction (GDPR Art. 18): Limit how we process your data in certain circumstances
  • Objection (GDPR Art. 21 / POPIA s11(3)): Object to processing based on legitimate interest or direct marketing
  • Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing

How to exercise your rights: Use the Privacy Centre in your account settings (Settings → Privacy Centre), or email privacy@storesuite.co.za. We will respond within 30 days.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. For full details, please see our Cookie Policy. In summary:

  • Essential Cookies: Required for the Service to function (authentication, CSRF protection, session management)
  • Preference Cookies: Remember your settings (theme, sidebar state)
  • Analytics Cookies: Google Analytics helps us understand how our website and web app are used. It is only loaded after you accept it in our cookie banner (Legal basis: Consent, Art. 6(1)(a))
  • Advertising Cookies: The Meta (Facebook) Pixel and the Google Ads tag measure how our advertising performs and let us show ads to people who have visited our site. They are only loaded after you accept them in our cookie banner, choosing “Necessary only” means they are never loaded (Legal basis: Consent, Art. 6(1)(a))
  • Third-Party Cookies: Our payment processor (Paystack) may set cookies on billing pages

Data collected by the Meta Pixel is shared with Meta Platforms, and data collected by the Google Ads tag and Google Analytics is shared with Google; each acts as an independent controller for it, see Meta's privacy policy and Google's privacy policy. You may withdraw your consent at any time from our Cookie Policy page.

You can control cookies through your browser settings, but disabling essential cookies may affect Service functionality.

11. Children's Privacy

StoreSuite is a business-to-business service and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us at privacy@storesuite.co.za and we will promptly delete it.

12. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

  • StoreSuite shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Service or any data breach that occurs despite our reasonable security measures.
  • Our total liability for any claims related to this Privacy Policy shall not exceed the amount you paid for the Service in the three (3) months preceding the claim.
  • We are not liable for any loss of data, business interruption, or damages arising from unauthorised access to your account due to your failure to maintain the confidentiality of your login credentials.
  • You acknowledge that no data transmission over the internet or electronic storage method is 100% secure, and we cannot guarantee absolute security.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice within the application at least 30 days before they take effect. Continued use of the Service after changes constitutes acceptance. The version number and date at the top of this page will always reflect the most recent revision.

14. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of South Africa. For users in the European Union, nothing in this policy affects your mandatory statutory rights under GDPR or applicable consumer protection law.

15. Supervisory Authorities & Complaints

If you believe your privacy rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority:

  • South Africa (POPIA): The Information Regulator, www.justice.gov.za/inforeg
  • European Union (GDPR): Your local Data Protection Authority

We encourage you to contact us first at privacy@storesuite.co.za so we can attempt to resolve your concern directly.

16. Contact Us

For privacy enquiries or to exercise your data rights: