Privacy Notice

Last updated: 1 September 2026

1. Who this notice covers

Lwekosi Technologies (registration number 2026/126101/07), trading as Retufu, is the "responsible party" under POPIA for the personal information described in this notice — both on this website and within the Retufu application itself.

2. What we collect

Through this website

If you submit our contact form, we collect your name, email address, business name (if given), your message, and the IP address the request came from (kept only to prevent spam and abuse). This website doesn't use tracking or advertising cookies.

Through the Retufu application

If your business becomes a Retufu client, we hold what you and your team enter into your own dedicated workspace: account holder name and email, your customers'/suppliers' contact details, and — where you use HR & Payroll — your employees' personal information needed to run payroll correctly (ID numbers, banking details, tax numbers, salary information, leave records). This data is entered and controlled by you; we process it on your instructions, as your operator, not as its owner.

3. Why we collect it

• To respond to enquiries and provide the demo/quote you've asked for.
• To create and operate your Retufu workspace, including statutory payroll calculations (PAYE, UIF, SDL) that legally require the employee information above.
• To keep the service secure — an IP address on a contact submission is used only to apply rate limits against automated spam, never for tracking or marketing.
• To send account-related notices (billing, security, service updates) — never marketing email without your consent.

4. How we share it

We don't sell personal information, and we don't pool your business's data with any other client's — every workspace is its own dedicated, private environment. The only third party involved is our email delivery provider, used solely to send the notifications described above.

5. How we protect it

Every account requires two-factor authentication. Passwords are stored using strong one-way hashing, never in plain text. Your workspace is backed up automatically every day, and every meaningful change is recorded in an activity log.

6. How long we keep it

Website enquiry submissions are kept for as long as reasonably needed to follow up, then removed. Data within an active Retufu workspace is kept for as long as your subscription is active; if you cancel, we provide a full export and then remove your data from our systems within 30 days, unless a longer period is legally required (for example, statutory record-keeping for payroll and tax purposes).

7. Your rights under POPIA

You have the right to ask us what personal information we hold about you, to have it corrected if it's wrong, to have it deleted where we're not legally required to keep it, and to object to how it's processed. To exercise any of these, contact our Information Officer below.

8. Our Information Officer

Our Information Officer is reachable at infosec@retufu.co.za. If you're not satisfied with our response, you can lodge a complaint with South Africa's Information Regulator (inforegulator.org.za).

9. Changes to this notice

If we make a material change to how we handle personal information, we'll update this page and, where the change affects existing clients, notify you directly.

10. Contact us

Questions about this notice? Reach us at infosec@retufu.co.za or via our contact page.