Privacy Policy

1. Who we are

EPromotions (Pty) Ltd (“Yasenza”, “we”) runs yasenza.co.za and the Yasenza app. This policy explains how we process personal information under the Protection of Personal Information Act, 2013 (POPIA).

• For visitors to this website and for practices that use Yasenza, we are the responsible party.
• For the clients of a practice (people who book with a practitioner), the practice is the responsible party and we are its operator: we process their details only on the practice’s instructions. See the Operator Agreement and the practice’s own privacy notice on its booking page.

Information Officer: Yatin Soni, hello@yasenza.co.za.

2. What we collect

When you visit this website

• If you ask for a demo: your name, the kind of practice, your phone or WhatsApp number, and, if you give them, your email address and message.
• Basic technical information our hosting provider records to deliver and protect the site (for example your IP address and browser type). This website uses no advertising, analytics or tracking cookies. Our hosting provider may set a strictly necessary security cookie to protect the site from abuse.

When your practice uses Yasenza

• Your account details: names, email addresses, a protected (hashed) password and your role.
• Your practice details: name, venues, hours, services and prices, photos you upload, payment details you choose to show to clients, and your plan and billing status.

For a practice, about its clients (as operator)

• Name, phone number and, if given, email address and birthday; appointments; invoices and payments; and the consent the client gave when booking.
• Yasenza has no fields for health or treatment information, and practices are asked not to enter any.

3. Why we use it

• To answer a demo request and arrange the demo (your consent, which you can withdraw at any time).
• To provide Yasenza to your practice and bill for it (our contract with you).
• To keep Yasenza secure, prevent abuse and fix problems (our legitimate interest).
• To meet legal duties, for example keeping financial records (the law).

We do not sell personal information, and we do not use it for advertising.

4. Who processes it for us

We use trusted providers (operators) for: cloud hosting and the database; file storage for photos; website hosting and security; sending email; and processing our own subscription payments. Each receives only what it needs for that job and is bound to protect it. We share information with authorities only where the law requires it.

5. Information stored outside South Africa

Some of our providers store data outside South Africa (currently [the United Kingdom and the European Union]). We use only providers that protect personal information to a standard substantially similar to POPIA, under binding agreements, as section 72 of POPIA allows.

6. How long we keep it

• Demo requests: up to [12 months] unless you become a customer.
• Practice accounts: while the account is active, then deleted or anonymised within [30] days of closure, except what the law requires us to keep.
• Invoices and payment records: at least five years, as tax law requires.
• A practice’s client details: as the practice instructs, and deleted when the practice closes its account (see the Operator Agreement).

7. Security

We protect personal information with encryption in transit, protected passwords, role-based access, a strict separation between practices and audit logs. No system is perfectly secure; if a breach affects your information we will tell you and the Information Regulator as POPIA requires.

8. Your rights

You may ask to see the personal information we hold about you, ask us to correct or delete it, object to how we use it, or withdraw consent you gave. Email hello@yasenza.co.za. If you booked with a practice, contact that practice first: it decides how your details are used, and we will help it respond.

You may also complain to the Information Regulator of South Africa: inforegulator.org.za.

9. Children

Yasenza is a business tool for practices and is not aimed at anyone under 18. A practice that sees children must have a parent’s or guardian’s consent to process the child’s details.

10. Changes

We may update this policy and will show the new effective date here. For material changes we will also tell practices by email or in the app.