Terms of Service

1. About DataRights

DataRights is a South African consumer privacy service that helps subscribers prepare, submit, track, follow up on, and where appropriate prepare escalation material for POPIA requests to covered data holders.

The service is provided by DataRights in South Africa. Service address: South Africa.

Support: support@datarights.co.za. Information Officer: privacy@datarights.co.za.

2. Acceptance

By using the website, submitting a scan or sign-up form, selecting a plan, authorising DataRights to act on your behalf, accessing your Privacy Control Center, or paying for a subscription, you agree to these Terms. If you do not agree, do not use the service.

3. Authorised Agent Model

By accepting these Terms and giving service consent, you appoint DataRights as your authorised agent for the limited purpose of preparing, submitting, tracking, and following up on POPIA Section 24 deletion, correction, or update requests on your behalf.

DataRights acts on your behalf for the request process. DataRights is not the responsible party for personal information held by brokers, credit bureaus, telecoms providers, marketing databases, public record sources, or other data holders that receive a request.

4. The Service

DataRights may provide profile creation, consent capture, broker coverage matching, scan signals, POPIA request letter preparation, request dispatch, response tracking, follow-up reminders, customer dashboard reporting, monthly rescans, support workflows, and escalation preparation where included in your plan.

DataRights may improve, change, suspend, or discontinue parts of the service where reasonably necessary for legal, operational, security, provider, or product reasons.

5. POPIA Honesty and Outcome Limits

DataRights submits structured POPIA requests and tracks responses. A data holder may not respond, may refuse the request, may not hold information about you, or may take a different action from the one requested.

DataRights may not find every source of your personal information, stop spam calls, or eliminate identity theft or fraud risk. A request may be refused where a data holder has a lawful basis to refuse.

DataRights only marks a request as completed or confirmed when a data holder confirms an outcome in writing or when there is another documented basis for the status.

6. Eligibility and Customer Responsibilities

You may use DataRights if you are at least 18 years old, are using the service for yourself or have lawful authority to act for another person, provide accurate information, and comply with these Terms.

You are responsible for correct contact details, accurate identity and matching information, keeping your email account secure, responding when more information is needed, and not using DataRights to impersonate another person or submit unauthorised requests.

7. Consent and Authorisation

DataRights needs explicit service consent and authorisation before submitting requests on your behalf. Consent records may include the wording shown to you, version, timestamp, email address, IP address where available, user agent where available, and related subscriber profile.

You may withdraw authorisation by contacting DataRights. Withdrawal means DataRights may no longer be able to submit requests, continue follow-ups, or provide parts of the service. Marketing opt-in is separate from service consent.

8. Plans and Pricing

Prices are shown in South African Rand. Price changes should not affect a paid period already purchased unless required by law, payment provider rules, or a change you request.

9. Payments, Renewal, Downgrades, and Cancellation

Payments are processed through PayFast or another payment provider DataRights chooses. DataRights may activate paid service only after payment confirmation is received and validated.

If you choose a recurring plan, your subscription may renew automatically according to the selected billing cycle until cancelled. Downgrades or annual-to-monthly changes normally take effect at the next renewal date; no partial refund is issued for the current paid term unless required by law or approved by DataRights.

You may request cancellation through the Privacy Control Center or by contacting support@datarights.co.za. Cancellation normally stops future billing but does not automatically delete records DataRights must retain for payment, audit, compliance, dispute, or service history purposes.

10. Refunds

Unless required by law, refunds are not automatic once DataRights has started operational work, including request preparation, request creation, request dispatch, scan processing, or manual support. DataRights may consider refund requests case by case, including duplicate payments, clear payment errors, or service failures caused by DataRights.

11. Acceptable Use

You must not use the service unlawfully, submit requests for a person without authority, provide false or fraudulent information, attempt to access another user's data, interfere with the website or systems, scrape or overload the service, or use DataRights to harass data holders or other people.

12. Third-Party Services and Data Holders

DataRights depends on third-party services, including PayFast, Supabase, Cloudflare Workers, Resend, Have I Been Pwned, domain providers, email systems, and data holders. DataRights is not responsible for outages, delays, refusals, incorrect responses, or privacy practices outside DataRights' control.

Supabase provides database, authentication, storage, and related infrastructure used to operate DataRights. DataRights remains responsible for the subscriber information it chooses to collect, the instructions it gives Supabase, access controls, retention rules, and responding to subscriber rights requests.

Cloudflare provides hosting, Pages, Workers, DNS, routing, CDN, and security services used to operate and protect DataRights. DataRights remains responsible for the information it sends through that infrastructure, secure configuration, access controls, logging discipline, retention, and subscriber rights requests.

DataRights uses Have I Been Pwned only to help authorised subscribers understand their own breach exposure. DataRights must not use HIBP data for prospecting, cold outreach, solicitation, disadvantaging breach victims, resale, or building a competing breach database. Where HIBP information is displayed, DataRights will clearly attribute Have I Been Pwned as the source.

HIBP information is provided as an exposure signal and may be incomplete, changed, or removed. A clear result does not prove that your information has never appeared in a breach.

DataRights uses Resend to deliver transactional emails. Email recipient details, metadata, and message content are processed through Resend and may be processed in the United States or by Resend's authorised sub-processors. DataRights remains responsible for ensuring that the information and instructions it sends through Resend are lawful and reasonably necessary.

13. Support and Availability

Support is provided through support@datarights.co.za unless another support channel is published. Priority support changes support handling, not the legal, broker, regulator, or deletion outcome.

DataRights aims to keep the service available, but the website or workflows may be unavailable due to maintenance, provider outages, security incidents, or events outside DataRights' control.

14. Intellectual Property

The DataRights name, website, copy, workflows, designs, documents, templates, and service materials belong to DataRights or its licensors, except where otherwise stated. You may not copy, resell, sublicense, or commercially exploit DataRights materials without written permission.

15. Privacy

DataRights processes personal information according to its Privacy Policy. By using the service, you acknowledge that DataRights needs to process personal information to provide the service, including sharing relevant request details with covered data holders.

16. Disclaimers and Limitation of Liability

DataRights provides an administrative privacy request and tracking service. DataRights does not provide legal advice unless expressly agreed in writing with a qualified legal professional. Information on the website is general information and should not be treated as legal advice for your specific circumstances.

To the maximum extent allowed by South African law, DataRights is not liable for indirect, incidental, special, consequential, or punitive damages, including loss of profits, loss of data, reputational harm, or third-party conduct. DataRights' total liability for claims connected to the service is limited to the amount you paid DataRights for the service in the three months before the event giving rise to the claim. Nothing in these Terms excludes liability that cannot legally be excluded.

17. Limitations of Service and Indemnity

DataRights provides administrative support and automation for requests made under POPIA, including Sections 11 and 24 where applicable. DataRights submits requests and tracks responses, but third-party organisations remain responsible for their own compliance and response decisions.

DataRights submits POPIA Section 24 deletion requests and tracks responses on your behalf. Data brokers may refuse, delay, ignore, or limit deletion requests. Some organisations are legally permitted to retain your data under South African legislation including FICA, RICA, and the National Credit Act. DataRights will clearly communicate any such refusals to you.

DataRights is responsible for providing the service with reasonable care and skill, but it is not responsible for decisions or conduct by data holders outside its control. Where included in your plan and appropriate to the case, DataRights may prepare escalation material and support escalation to the Information Regulator. Escalation outcomes depend on the regulator and the facts of the case.

18. Changes, Governing Law, and Disputes

DataRights may update these Terms from time to time. The updated version will be posted on the website with a new effective date. Continued use after changes means you accept the updated Terms.

These Terms are governed by the laws of the Republic of South Africa. If a dispute arises, you agree to contact DataRights first so the parties can try to resolve it in good faith.

19. Contact

Questions about these Terms: support@datarights.co.za or privacy@datarights.co.za.