POPIA & PAIA

Who you are dealing with

QuickBill - The Invoice Man is a product of Kanvas Creative Solutions ("Kanvas", "we", "us"), a South African creative and technology company based in Rustenburg. Kanvas builds and operates QuickBill, and it is the company you contract with when you use it.

Kanvas is the merchant of record for QuickBill. Your subscription and AI credit are paid to Kanvas through its PayFast and Yoco merchant accounts, and your statement shows a Kanvas Creative Solutions or QuickBill reference. Payments your own customers make to you are different: they go through the payment accounts you connect, straight to you.

• Registered nameKanvas Creative Solutions
• Registration number2019/136304/07
• ProductQuickBill · quickbill.co.za
• Physical address42 Heystrek Street, Rustenburg, North West, South Africa
• QuickBill supportsupport@quickbill.co.za
• Legal and privacylegal@kanvas.co.za
• Telephone and WhatsApp+27 81 788 0727
• Office hoursMonday to Friday, 09:00 to 17:00 (SAST)
• CurrencyAll prices are in South African Rand (ZAR)
• Company termsknvs.co.za legal set

1. Two roles: responsible party and operator

Kanvas is the responsible party for the information it processes for its own purposes: QuickBill account holders, team members' sign-ins, subscriptions, AI credit purchases, support conversations and security logs.

Kanvas is an operator for the information a QuickBill business loads or collects: its customers, leads, invoice recipients, catalogue orders, and the visitors who chat to its business card. That business is the responsible party. Kanvas processes the information only on its instruction, keeps it confidential and secure, and does not use it for anything else (sections 20 and 21 of POPIA).

2. Information officer

• Information officerThe information officer of Kanvas Creative Solutions
• Emaillegal@kanvas.co.za
• Telephone and WhatsApp+27 81 788 0727
• Address42 Heystrek Street, Rustenburg, North West, South Africa

The information officer handles POPIA requests, PAIA requests and complaints about QuickBill, and all dealings with the Information Regulator.

3. Why we may process your information

Every use rests on one of the grounds in section 11 of POPIA:

• Performance of a contract - running your account, sending your documents, answering through Bill and the card assistant, taking payment.
• Legal obligation - tax, company and consumer records, and lawful demands.
• Legitimate interests - fraud prevention, platform security, debt recovery and keeping QuickBill working, where they do not override your rights.
• Consent - marketing and optional features you switch on. You can withdraw it at any time.
• A business's instruction - where a QuickBill business loads or collects its customers' information, we act as its operator.

We do not process special personal information or children's information for our own purposes.

4. How we meet the eight conditions

• Accountability - the information officer answers for compliance.
• Processing limitation - we take the minimum needed, lawfully, and from you where possible.
• Purpose specification - collected for stated purposes and kept per the retention table in the Privacy Policy.
• Further processing limitation - not repurposed into something unrelated. AI providers may not train on your content.
• Information quality - you can correct your own details in Settings, and we act on correction requests.
• Openness - this page, the Privacy Policy and the PAIA manual.
• Security safeguards - hashed passwords, one-time PINs, account separation, encryption in transit, private directories, monitoring, and operator contracts with providers.
• Data subject participation - the request process below.

5. Your duties as a QuickBill business

Because you are the responsible party for your customers' information, POPIA asks things of you too:

• Have a lawful reason to hold each customer's and lead's details, and keep them accurate.
• Only send email, SMS or WhatsApp messages people expect, and give them a way to opt out of marketing.
• Answer your own customers' access, correction and deletion requests. You can edit or delete their records in QuickBill, and we will help if you need it.
• Tell visitors on your business card what you do with what they share, if it goes beyond answering them.
• Give team members access only to what their work needs.

6. Your rights

• Ask whether we hold information about you, and ask for a copy.
• Ask us to correct or delete information that is wrong, misleading, out of date, excessive or unlawfully held.
• Object, on reasonable grounds, to processing based on legitimate interests.
• Withdraw consent where the processing rests on consent.
• Object to direct marketing at any time.
• Not be subject to a decision based solely on automated processing that significantly affects you. QuickBill's AI does not make such decisions.
• Complain to the Information Regulator, and approach a court.

Exercising a right is free, except that a prescribed PAIA fee may apply to a request for access to records.

7. Making a request

1. Write to the information officer at legal@kanvas.co.za, or post to the address above.
2. Say what you want - access, correction, deletion, objection or withdrawal of consent - and that it concerns QuickBill: your account, a business card, an invoice or a chat.
3. Prove who you are. We ask for identification so that we never hand your information to somebody else. Do not send passwords or card numbers.
4. We respond. Acknowledgement within five business days, and a decision within 30 days, which the Acts allow us to extend once, with reasons.

We may refuse a request where the law requires or allows it - where a record must be kept for tax, where release would expose another person's information, or where the request is manifestly excessive - and we give reasons.

Where the information belongs to a QuickBill business (you are its customer, lead or card visitor), we pass the request to that business as the responsible party and tell you we have done so.

8. PAIA manual

Section 51 of PAIA requires every private body to publish a manual setting out the records it holds and how to request them. QuickBill is covered by the Kanvas manual, which sets out the company, the information officer, the records held by Kanvas and each of its products, the request procedure, the prescribed fees and the remedies if a request is refused.

Download the Kanvas PAIA manual (PDF)

A printed copy may be requested from the information officer.

9. Records QuickBill holds

• Account records - account holders, business profiles, team members, settings and sign-in records (including the email address Google confirms when someone continues with Google).
• Financial records - subscriptions, AI and SMS credit purchases and usage, gateway references, refunds and chargebacks.
• Business-owned records - customers, leads, invoices, quotations, payments, expenses, inventory, catalogues, orders and business cards, held for the business.
• AI records - conversations with Bill and with business card assistants, and the instructions businesses give them.
• Technical records - access, security and error logs.

10. Information sent outside South Africa

Some providers process information outside the Republic: the AI providers behind Bill, Smart Import and the card assistant (Anthropic, OpenAI and Google), Meta for WhatsApp, Google for Continue with Google sign-in and Firebase app notifications, and email delivery. Section 72 of POPIA permits this where the recipient is bound by rules giving comparable protection, where you consent, or where it is necessary to perform our contract with you. We rely on our contracts with those providers and send no more than the feature needs.

11. Security compromises

If personal information is accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and the people affected as soon as reasonably possible. Where the information belongs to a QuickBill business, we notify that business at once so it can meet its own duty. Our notice says what happened, the likely consequences, and what we and you can do about it.

12. The Information Regulator

You may complain to the Regulator at any time, whether or not you have complained to us first.

• Information Regulator (South Africa)JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• PostalP.O Box 31533, Braamfontein, Johannesburg, 2017
• POPIA complaintsPOPIAComplaints@inforegulator.org.za
• PAIA complaintsPAIAComplaints@inforegulator.org.za
• General enquiriesenquiries@inforegulator.org.za
• Websiteinforegulator.org.za