Privacy Policy

Volta provides point-of-sale, inventory, kitchen display, loyalty, reporting, billing, and related back-office software for South African retailers and hospitality businesses, including the native Android Volta POS and KDS applications distributed via Google Play.

For privacy requests, please contact us using the details in section 14. Please update your organisation’s registered legal entity name and Information Officer details with us if you require them on a formal engagement letter or PAIA manual.

Account holders and staff. When you create an organisation account, manage billing, or use staff credentials, we generally act as the responsible party for that account and authentication data.

Merchant operational and customer data. Sales, products, stock, loyalty members, and similar records that you or your staff capture in the till or back office are processed so we can provide the Services. In many cases we act as an operator on behalf of your organisation (the responsible party for that merchant’s customers and employees). Your organisation remains responsible for its own POPIA compliance toward its customers and staff, including notices at the till where required.

If you are a customer of a Volta merchant (for example a loyalty member), please contact that merchant about their privacy practices. We will assist merchants with lawful access and deletion requests that relate to data we store for them.

Depending on how you use the Services, we may process:

• Identity and contact details — name, email address, phone number, organisation or trading name, and related account profile fields.
• Authentication and access data — passwords or PINs (stored in hashed or otherwise protected form), staff roles and permissions, terminal pairing codes, and device identifiers used to link Android tills or kitchen displays.
• Business operations data — locations, products, prices, inventory, sales and refunds, payment-method selections recorded on the till, tips, shifts, cashups, kitchen tickets, promotions, and loyalty membership details you choose to store.
• Billing and subscription data — plan selections, invoices, and payment references. Card and EFT payments for Volta subscriptions are typically processed by our payment service provider (for example PayFast); we do not store full card PAN data on Volta systems when the provider handles checkout.
• Device and technical data — IP address, browser or app type, operating system, device model, crash/diagnostics information, and approximate location derived from network data where needed for security or service delivery.
• Support communications — messages, emails, and attachments you send when you contact us for help.

We do not intentionally collect special personal information (as defined in POPIA) or biometric data for VoltaPOS operation. If you upload such information into free-text notes or similar fields, you are responsible for having a lawful basis to do so.

• You or your organisation, when registering, configuring, or using the Services.
• Staff and devices authorised by your organisation (tills, scanners, printers, scales).
• Payment and infrastructure providers that help us run billing, hosting, databases, email, and app distribution.
• Public or third-party sources only where needed for fraud prevention, security, or legal compliance.

We process personal information only for lawful purposes, including to:

• provide, maintain, and improve the Services (including offline sync on Android apps);
• authenticate users, pair terminals, and enforce roles and security controls;
• process subscriptions, invoices, and related billing support;
• provide customer support and respond to requests;
• monitor system health, prevent abuse, and investigate security incidents;
• comply with law, regulation, or lawful requests;
• send service notices (for example security or downtime). We only send marketing where permitted; you may opt out of marketing messages.

POPIA grounds we rely on include performance of a contract, legitimate interests that do not override your rights, compliance with a legal obligation, and consent where required (for example certain marketing).

We do not sell personal information. We may use aggregated or de-identified statistics that no longer identify a person for product improvement.

We may share personal information with:

• Service providers / operators who host infrastructure, databases, analytics, email, error monitoring, or payment collection under contracts that require them to protect the information and use it only for instructed purposes (examples may include cloud hosts, database providers, and PayFast or similar for subscription payments).
• App platforms such as Google Play when you install or update Volta mobile applications.
• Professional advisers or authorities where required by law or to establish, exercise, or defend legal rights.
• A purchaser or successor in the event of a merger, acquisition, or restructuring, subject to appropriate protections.

Merchants control which staff can access their organisation’s data. Volta staff access production data only as needed for support, security, or operations, under access controls.

Some of our operators may store or process information on servers outside South Africa (for example cloud infrastructure). Where we transfer personal information outside the Republic, we take steps intended to ensure an adequate level of protection consistent with POPIA section 72 — including contractual safeguards with operators — or another lawful basis for the transfer.

We implement reasonable technical and organisational measures to protect personal information against loss, unauthorised access, and unlawful processing. These include authentication controls, encrypted connections (HTTPS), organisation-level data isolation in our database where designed, and restricted administrative access.

No method of transmission or storage is completely secure. Please use strong passwords / PINs, limit staff permissions, and protect till devices. Notify us promptly if you suspect unauthorised access to your organisation’s account.

We retain personal information only as long as needed for the purposes in this policy, including providing the Services, resolving disputes, enforcing agreements, and meeting legal, tax, or accounting retention requirements. When information is no longer required, we delete or de-identify it where reasonably practicable.

After an organisation requests account closure, we may retain limited records as required by law or for legitimate business needs (for example billing disputes), then delete or anonymise remaining operational data according to our retention schedule.

Subject to POPIA and applicable exceptions, you may request to:

• access the personal information we hold about you;
• correct or update inaccurate or incomplete information;
• object to processing on reasonable grounds;
• request deletion or restriction where lawful;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Information Regulator (see below).

Organisation owners may request export or deletion of tenant data by contacting us. We may need to verify your identity and authority before acting. Some requests may be refused or limited where the law allows (for example where we must keep records).

The Services are intended for businesses and adult users. We do not knowingly collect personal information from children under 18 for the purpose of providing Volta accounts. If you believe we have collected a child’s information without proper consent, contact us and we will take appropriate steps.

Our websites and apps may use cookies, local storage, or similar technologies for session management, security, preferences, and measuring how the Services are used. You can control cookies through your browser settings; disabling them may affect login or functionality.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may be communicated via the Services or email where appropriate. Continued use after an update means you accept the revised policy.

For privacy questions, access requests, corrections, or objections, contact:

• Email: info@voltapay.co.za
• Website: https://www.voltapay.co.za

If you believe we are processing personal information unlawfully, you may lodge a complaint with the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Email: POPIAComplaints@inforegulator.org.za
• Tel: 010 023 5200
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001, South Africa