Legal & policies
Privacy notice
Last updated: 1 November 2026
1. Who we are
Future Investments Ventures (Pty) Ltd (registration number 2026/332001/07), trading as Trade a Quote, of 57 Duminy Street, Tygervalley, Cape Town, Western Cape, 7536. Our Information Officer is Gabor Adam Gulyas, reachable at support@tradeaquote.co.za.
2. Our two roles
Responsible party. For the people who sign up for and use Trade a Quote (account holders, their staff and partner firms), and for visitors to our website, we decide why and how personal information is processed. This notice covers that information in full.
Operator. Businesses that use Trade a Quote capture information about their own clients, suppliers and employees: names, contact details, site addresses, quotes, invoices and payroll records. For that information the business is the responsible party and we process it only on its instructions, under our operator agreement. If you are a client of a business that uses Trade a Quote, contact that business first about your information. We will help them respond.
3. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored only as a one-way hash), role | You, or the colleague who invited you |
| Business details | Company name, registration and VAT numbers, address, logo, banking details shown on invoices, payment-provider IDs | You |
| Business records | Clients, quotes, invoices, payments, expenses and receipts, job cards, suppliers, bookkeeping and payroll data, and compliance documents you upload (such as registration certificates, tax letters and directors’ ID copies) | You and your team (we act as operator, see section 2) |
| Client-portal use | When a quote is viewed or accepted, the name entered on acceptance | Your clients |
| Technical data | IP address, browser and device type, sign-in times, error logs | Automatically, when you use the service |
| Activity log | What was done in your account and by whom (e.g. invoice deleted, bank details changed), with the approximate city your connection comes from. Never GPS or your exact location | Automatically, when you or your team use the service |
| Website analytics | Pages visited, referring site, approximate location | Analytics cookies, only if you allow them (see our Cookie policy) |
| Communications | Support emails and feedback | You |
We do not intentionally collect special personal information (such as health or religious beliefs) or information about children. Payroll records may include ID numbers and tax numbers of employees. That is captured by the employer for SARS purposes and handled as operator data.
4. Why we use it, and the lawful basis
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Creating and running your account, generating documents, sending them to your clients | Performance of our contract with you |
| Sending service email (invites, password and billing notices, document delivery) | Performance of contract |
| Security: preventing fraud and abuse, rate-limiting sign-ins, keeping audit logs | Our legitimate interest in a safe service |
| Showing owners an activity log of their account, and seeing which towns and provinces the service is used in (city level only) | Our legitimate interest in running and improving the service |
| Billing, tax and accounting records | Compliance with law (e.g. the Tax Administration Act) |
| Improving the website using analytics | Your consent, which you can withdraw at any time |
| Product news and offers by email | Your consent (POPIA s69), given at sign-up or later. Unsubscribe any time |
Providing account and business details is voluntary, but we cannot provide the service without them. We do not sell personal information and we do not use your business records to market to your clients.
5. Who we share it with
We share personal information only with these service providers, under written agreements that require them to keep it secure and confidential:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and delivery | United States / global edge network |
| Neon Inc. | Database hosting | United States / European Union |
| Functional Software Inc. (Sentry) | Error alerts from our servers, so we can fix faults quickly | United States / European Union |
| Resend Inc. | Sending transactional email | United States |
| Google LLC | Optional “Sign in with Google”; website analytics if you allow it | United States |
| PayFast | Taking subscription payments for Trade a Quote plans | South Africa |
| PayFast / Yoco | Card payments, only when a business connects its own account | South Africa |
Partner firms that offer Trade a Quote under their own brand can see and support the client companies they manage. We may also disclose information where the law requires it, for example to SARS or under a court order.
6. Transfers outside South Africa
Some of our providers store or process information outside South Africa. POPIA (s72) allows this where the recipient is bound by law, binding corporate rules or an agreement that gives adequate protection. We rely on contracts with these providers that include data-protection terms at least as protective as POPIA, and choose providers that hold recognised security certifications.
7. How long we keep it
- Account and business records: while your account is open.
- After you close your account: deleted within 30 days, except backups, which roll off within a further 30 days.
- Our own billing records: five years, as the Tax Administration Act requires.
- Security logs: up to 12 months.
- Activity log: two years, or until the account is closed.
Your own tax obligations may require you to keep invoices and payroll records for five years. Export them from Import / Export in the app before closing your account.
8. How we protect it
Encrypted connections (TLS) everywhere, passwords stored as salted hashes, each business's data kept separate from every other business, role-based access for team members, sign-in rate limits, and access to production systems limited to the people who need it. If a security compromise affects your personal information we will notify you and the Information Regulator as POPIA s22 requires.
9. Your rights
Under POPIA you may:
- ask whether we hold information about you, and for a copy of it;
- ask us to correct, update or delete it;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent you gave (for example to analytics cookies or marketing email);
- complain to the Information Regulator.
Account owners can export their data and delete their account themselves under Settings → Privacy & data. For anything else, see our POPIA notice or email support@tradeaquote.co.za. We respond within 30 days.
10. Cookies
We use strictly necessary cookies to keep you signed in, and analytics or marketing cookies only with your consent. Details and controls are in our Cookie policy.
11. Complaints
Please contact our Information Officer first. You also have the right to complain to the Information Regulator (South Africa): inforegulator.org.za, POPIAComplaints@inforegulator.org.za.
12. Changes
When we change this notice we update the date above. If a change materially affects how we use your information, we will tell account owners by email before it takes effect.