Privacy notice
Version 2026-10. Applies to Paid, operated by Xee Holdings (Pty) Ltd.
Who we are
Paid is a product of Xee Holdings (Pty) Ltd (registration 2021/435618/07), 160 Belmont Road, Effingham Heights, Durban North, 4051. Our Information Officer is Xien Singh, reachable at hello@heypaid.co.za.
Two roles, depending on whose information it is
Business owners and their staff. When you sign up, we are the responsible party for your name, email address, sign-in details and your business's details, which we use to run your account and bill you.
Your clients, parents and members. When a business uses Paid, that business is the responsible party for its clients' information, and we process it on the business's behalf as an operator under POPIA section 21, under a written agreement. Questions about that information go to the business first; we will help them answer. Our staff see it only when the business lets Paid support into its account to help (the business is told every time); our own account reports show totals and counts, never a client's name or number.
What we collect and why
- Contact details (name, cellphone, email) so the business can confirm bookings, send statements and receipts.
- Children's first names and surnames, only when a parent or guardian has agreed, so a fee statement can say who it is for (POPIA section 35). We hold no date of birth, school or health information.
- Booking and payment records: what was booked, amounts and receipt numbers. Card details never reach us; PayFast handles them.
- Consent records: when you agreed to WhatsApp updates, or to news and specials, from which business, where, and the wording you saw; and when you stopped.
- Your replies: if you answer a business's WhatsApp, your message, so the business can read and answer it.
- Proof of payment: a screenshot or bank document you choose to upload on a pay link, so the business can check your EFT.
- Business owners and their staff: name, email and sign-in details, and a record of who did what in the account.
Messages go from Paid's verified WhatsApp Business number, in the business's name, only to people who opted in. Most are transactional: confirmations, statements, reminders and receipts.
News and specials from a business go only to people who agreed to them, separately from WhatsApp updates (the box is never ticked for you), and only on weekdays 08:00 to 20:00 and Saturdays 09:00 to 13:00, never on Sundays or public holidays (Consumer Protection Act). Reply STOP to any of them, or use the link in any email, and they stop at once; bookings, statements and receipts still reach you. Reply STOP ALL to stop WhatsApp messages from that business altogether; you will then get them by email if the business has your email address, or not at all.
Who else processes it
- PayFast (South Africa) processes payments into the business's own account.
- Meta Platforms delivers WhatsApp messages. Meta processes data outside South Africa; this transfer is allowed under POPIA section 72(1)(a) and (b), because Meta is bound by its WhatsApp Business terms and data processing terms, and because the transfer is needed to send a message you agreed to receive.
- Our servers and database are hosted in South Africa.
How long we keep it
- Payment records: five years, as tax records.
- Message contents, and your replies: 90 days, then the text is removed and only the delivery record remains.
- Proof-of-payment uploads: 90 days after the business accepted or rejected them.
- Team invitations (a name and email): 30 days after they were used, cancelled or expired.
- Raw payment notifications and delivery webhooks: 90 days.
- Audit trail of changes (which holds no personal details): five years.
Your rights
You may ask to see the information held about you, correct it, or have it removed (POPIA sections 23 and 24). Businesses can export or remove a person's information from Paid in one step. You may also complain to the Information Regulator at inforegulator.org.za.
Security
Every connection is encrypted. Owners sign in with a long password and a one-time code. Payment passphrases and bank details are encrypted at rest. Access is logged.