Privacy notice

teQuila is accounting and payroll software. Each organisation that keeps its books in teQuila decides what it records about its customers, suppliers and employees. That organisation is the responsible party under POPIA for that information. teQuila is its operator: we process the information on the organisation’s behalf and do not use it for our own purposes.

For the accounts of people who sign in to teQuila, the company that operates teQuila is the responsible party: registered name to be confirmed.

• Contact records: name, email address, telephone number, VAT number and postal address.
• Transaction records: invoices, credit notes, statements, bills and payments between you and the organisation. Tax and accounting law requires them.
• Employee records, for organisations that run payroll in teQuila: name, identity or passport number, tax reference number, bank details, pay, leave and the statutory returns made from them.
• Attachments: documents the organisation attaches to your records, such as PDFs, scans and receipts.
• People who sign in: email address, a hashed password, an optional authenticator secret for two-factor verification, and session details (browser and IP address). teQuila uses no third-party trackers.

• To issue, record and reconcile invoices, bills and payments.
• To meet tax obligations to the South African Revenue Service (SARS), including VAT returns, payroll taxes and the content of tax invoices under section 20(4) of the Value-Added Tax Act.
• To prepare financial statements and statutory reports.
• To keep accounts secure and to record who changed what, and when.

SARS requires accounting records to be kept for five years from the end of the relevant tax year. Records older than that, and no longer needed for an open tax or legal matter, may be redacted.

• Primary database and application servers: hosting provider and region to be confirmed.
• Encrypted backups and document attachments may be copied to Backblaze B2 storage in the EU or US. They are encrypted before they leave the application server, and the key never goes to Backblaze, so the copies are unreadable to the storage provider (POPIA section 72, transfers outside South Africa).

• Access (section 23): ask the organisation for a copy of the personal information it holds about you.
• Correction or deletion (section 24): ask for incorrect information to be corrected, or for information the law no longer requires to be deleted. teQuila can redact a contact’s personal details while keeping the transactions intact: past invoices stay, and the name reads ‘[redacted]’.
• Objection (section 11(3)): object to further processing, except where the law requires it, such as tax record keeping.
• Complaints: you may complain to the Information Regulator (South Africa) through inforegulator.org.za.

Each organisation’s information officer is usually its public officer, a director or an authorised contact. Reach them through the contact details on any invoice, statement or payslip you received from that organisation.

teQuila’s information officer: contact address to be confirmed.

Every change to a contact or transaction, and every opening of an attached document, is recorded in an audit log. People with access to an organisation’s audit log can see who did what, and when. Erasures of personal information are listed in a redaction register.