POPIA Compliance
Protection of Personal Information Act 4 of 2013
Last updated: April 2026
Our Commitment
TruScan Systems (Pty) Ltd is committed to complying with the Protection of Personal Information Act 4 of 2013 (POPIA). We recognise the importance of protecting the personal information of our partners, merchants, customers, and website visitors in accordance with South African law.
As a WhatsApp-powered referral marketplace for digital products, we process personal information across multiple touchpoints — including web forms, WhatsApp conversations, QR scan events, and partner programme management. We are committed to ensuring that all such processing is lawful, transparent, and proportionate.
Information Officer
Nathi Emmanuel Middleton
Information Officer — TruScan Systems (Pty) Ltd
Email: hello@truscan.co.za
WhatsApp: 071 685 6449
Processing Conditions
We adhere to the eight conditions for lawful processing as set out in POPIA:
1. Accountability
We take responsibility for complying with the conditions set out in POPIA and have designated an Information Officer to oversee compliance across all our systems, including WhatsApp flows, referral tracking, and partner/merchant data.
2. Processing Limitation
We collect personal information lawfully, for a specific purpose, and with the data subject's knowledge. We do not collect more information than is necessary to operate the marketplace, manage partner accounts, or facilitate product transactions.
3. Purpose Specification
We collect personal information for specific, explicitly defined, and legitimate purposes: operating the WhatsApp referral marketplace; managing partner programmes (QR scan tracking, commission credits, Big 5 tier progression); reviewing and listing merchant products; facilitating WhatsApp-based commerce flows; sending merchant onboarding communications via Brevo; and preventing fraud.
4. Further Processing Limitation
We do not process personal information for purposes incompatible with the original purpose of collection. We do not sell personal information to third parties. Partner and merchant data is used exclusively to operate their respective accounts and is not shared for marketing or profiling by external parties.
5. Information Quality
We take reasonable steps to ensure that personal information is complete, accurate, not misleading, and updated where necessary. Partners and merchants are encouraged to notify us of any changes to their information.
6. Openness
We are transparent about what personal information we collect and how we use it, as documented in our Privacy Policy. Data subjects are notified of collection at the point of data capture (web forms, WhatsApp opt-in, QR scan interactions).
7. Security Safeguards
We implement appropriate technical and organisational security measures including encryption of data in transit and at rest, row-level security on our Supabase database, device fingerprinting for fraud prevention, secure API endpoints, and access controls that separate partner, merchant, admin, and automation system permissions.
8. Data Subject Participation
Data subjects have the right to request access to, correction of, or deletion of their personal information. Requests can be directed to our Information Officer at hello@truscan.co.za or via WhatsApp on 071 685 6449.
WhatsApp Data Processing
A significant portion of our platform operates via WhatsApp, powered by Meta's Cloud API. When you interact with TruScan on WhatsApp — whether as a partner checking your wallet, a customer browsing products, or a merchant receiving onboarding messages — your WhatsApp number and message content are processed by Meta in accordance with their terms and privacy policy, and by TruScan for the purposes described in our Privacy Policy.
We do not share WhatsApp conversation data with any third party beyond what is required to operate the platform (n8n automation workflows, Supabase database storage). WhatsApp interactions are retained only as long as necessary to fulfil the relevant service.
Your Rights Under POPIA
As a data subject, you have the right to:
Information Regulator
If you are not satisfied with how we handle your personal information, you may lodge a complaint with the Information Regulator of South Africa:
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: complaints.IR@justice.gov.za
Tel: 010 023 5207