Privacy Policy

Last updated: June 2026  ·  Effective date: [TO BE CONFIRMED ON LAUNCH]

This Privacy Policy explains how Generator Financial Services (Pty) Ltd ("we", "us", or "our"), registration number [REGISTRATION NUMBER], collects, uses, stores, and protects your personal information when you use Loanbooq ("Service").

By using the Service, you consent to the collection and processing of your personal information as described in this policy.

1. Who We Are

Responsible Party (POPIA):
Generator Financial Services (Pty) Ltd
Registration number: [REGISTRATION NUMBER]
Address: [PHYSICAL ADDRESS]
Email: support@loanbooq.com

Information Officer:
Name: [INFORMATION OFFICER NAME]
Email: support@loanbooq.com

Our Information Officer has been designated and registered with the Information Regulator of South Africa in accordance with section 55 of POPIA.

2. Information We Collect

2.1 Information you provide directly

• Account information: Your name, email address, company name, VAT number, and billing email address, collected when you register and complete onboarding.
• Communications: Any information you send us via email or support channels.

2.2 Information collected via Xero

When you connect your Xero account, we access and process the following data from your Xero organisation solely to provide the Service:

• Chart of accounts (account names, codes, and types);
• Bank and journal transaction history for selected loan accounts;
• Balance Sheet report data for opening balance detection;
• Organisation currency and settings.

We do not access payroll, employee records, invoices, or any Xero data beyond what is necessary for the Service.

2.3 Technical and usage information

• Log data: IP address, browser type, pages visited, and actions taken within the Service;
• Session data: Login timestamps and session identifiers;
• Error reports: Technical error information collected via Sentry (our error monitoring provider) to help us identify and fix bugs.

3. Purpose of Processing

We process your personal information for the following purposes, as required by section 13 of POPIA:

• To provide, maintain, and improve the Service;
• To create and manage your account;
• To process subscription payments and issue invoices;
• To communicate with you about your account, updates, and support;
• To detect, investigate, and prevent fraud and security incidents;
• To comply with our legal and regulatory obligations;
• To analyse aggregate usage patterns to improve the Service (no individual profiling).

4. Legal Basis for Processing

We process your personal information on the following grounds:

• Contract performance: Processing necessary to provide the Service you have subscribed to;
• Consent: Where you have given specific consent, including for Xero data access;
• Legitimate interest: For security monitoring, fraud prevention, and service improvement;
• Legal obligation: Where required by South African law.

5. How We Store and Protect Your Information

5.1 Your data is stored on secure servers [HOSTED IN / DATA CENTRE LOCATION]. We implement the following security measures:

• Xero OAuth tokens are encrypted at rest using AES-256 encryption;
• All data is transmitted over HTTPS (TLS 1.2+);
• Access to production systems is restricted to authorised personnel only;
• Regular automated backups are performed and stored securely.

5.2 While we take all reasonable steps to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your personal information for the following periods:

• Account and billing information: For the duration of your subscription plus 5 years, for legal and tax compliance purposes;
• Transaction and journal posting data: For the duration of your subscription plus 5 years, as required by the Companies Act 71 of 2008 and South African tax legislation;
• Xero access tokens: Retained only while your account is active and valid; deleted on disconnection or account termination;
• Technical logs: Up to 90 days.

After account termination, your data is retained for 30 days before deletion, unless we are required by law to retain it for longer.

7. Sharing of Personal Information

We do not sell your personal information. We share it only in the following circumstances:

7.1 Service providers (operators in terms of POPIA)

We share information with trusted third-party service providers who process data on our behalf:

• Xero Limited — cloud accounting platform (data accessed via OAuth on your behalf);
• Paddle [or current payment provider] — payment processing and invoicing;
• Sentry — error monitoring and application performance;
• [HOSTING PROVIDER] — server infrastructure and data storage.

All service providers are required to process your data only as instructed by us and in accordance with applicable data protection laws.

7.2 Legal requirements

We may disclose your information where required by South African law, court order, or lawful request by a government authority.

7.3 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before such a transfer occurs.

8. Cross-Border Transfers

Some of our service providers may process your data outside South Africa (for example, Sentry is based in the United States). Where we transfer personal information across South African borders, we do so in accordance with section 72 of POPIA, ensuring that the recipient country provides an adequate level of protection or that appropriate safeguards are in place.

9. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights:

• Right to access: You may request a description of the personal information we hold about you;
• Right to correction: You may request correction of inaccurate or incomplete personal information;
• Right to deletion: You may request deletion of your personal information, subject to our legal retention obligations;
• Right to object: You may object to processing of your personal information in certain circumstances;
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time, though this will not affect processing already carried out;
• Right to lodge a complaint: You may lodge a complaint with the Information Regulator if you believe your rights have been violated.

To exercise any of these rights, contact us at support@loanbooq.com. We will respond within 30 days.

10. Cookies

The Service uses session cookies to maintain your logged-in state. These are strictly necessary for the Service to function and do not track you across other websites. We do not use advertising or analytics cookies.

11. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by a prominent notice within the Service at least 30 days before taking effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact and Complaints

For any privacy concerns or to exercise your rights, contact our Information Officer:

• Email: support@loanbooq.com
• Address: [PHYSICAL ADDRESS]

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email: inforeg@justice.gov.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Complaints: complaints.IR@justice.gov.za