POPIA
Effective 12 October 2026
The Protection of Personal Information Act 4 of 2013 (POPIA) sets the rules for how organisations in South Africa may collect, use, keep and share personal information. This page explains how Shelveo applies those rules and how you can use the rights the Act gives you. What we collect, and why, is set out in detail in our privacy policy.
1. Who is responsible
Shelveo Spatial Intelligence (Pty) Ltd (registration number 2026/587671/07), based in Langebaan, Western Cape, runs Shelveo.
- Information Officer: André Oberholzer, admin@shelveo.co.za. The Information Officer is the person responsible for Shelveo's compliance with POPIA and for answering your requests.
- As a responsible party, Shelveo decides how the information of its own account holders and field operators is used: accounts, the record of field work and the security records.
- As an operator, Shelveo processes a retailer's store photos, plans and staff accounts on that retailer's behalf and instructions, under a written agreement, and keeps them confidential and secure as the Act requires of an operator.
2. How we meet the eight conditions
POPIA allows personal information to be processed only when eight conditions are met. This is how Shelveo meets each of them.
| Condition | What Shelveo does |
|---|---|
| 1. Accountability | An Information Officer is appointed and named above. Privacy is considered when a feature is designed, and this page and the privacy policy are kept in step with what the system really does. |
| 2. Processing limitation | We collect only what the service needs, directly from the person where we can. The Capture app asks for no contacts, messages, microphone or photo library, and sends nothing about a capture until the operator presses Upload. |
| 3. Purpose specification | Each kind of information has a stated purpose in the privacy policy, and a stated time for which it is kept. A deleted store's original photos are removed after 60 days. |
| 4. Further processing limitation | Information is not used for anything unrelated to the purpose it was collected for. We do not sell personal information and do no advertising or direct marketing with it. |
| 5. Information quality | Account details can be corrected by the account's administrator or on request to us. |
| 6. Openness | The privacy policy says what is collected, why, who receives it and where it is kept, including that our service providers' systems are outside South Africa. |
| 7. Security safeguards | Individual accounts, a second sign-in step for people who can change a customer's data, each customer's data kept apart from every other's, encrypted connections, encryption of the Capture app's working data on the phone, and a record of actions that change access or remove data. |
| 8. Data subject participation | You can ask to see, correct or delete your information and object to its use, as described below. |
3. Special cases the Act names
- People in store photos. Stores are photographed to record shelving and layout. People in the photos are detected automatically, left out of the reconstruction and blurred in the images shown on the platform, and we do not try to identify anyone.
- Special personal information and children. Shelveo does not set out to collect special personal information (such as health, religion, race or biometric information) or the information of children, and the service is not meant for anyone under 18.
- Automated decisions. Shelbi, our assistant, suggests which product category a shelf holds. It makes no decisions about people.
- Direct marketing. We send no unsolicited marketing.
- Transfers outside South Africa. Our service providers (Google and Cloudflare) keep data on systems outside South Africa, mainly in the United States, under agreements that require them to protect it.
4. Your requests
You do not need a lawyer and there is no charge for asking. Write to the Information Officer at admin@shelveo.co.za, say who you are and what you want, and we will answer within 30 days. We may ask you to confirm your identity first, so that nobody else can get at your information.
| You want to | How |
|---|---|
| Know whether we hold information about you, and see it | Email us. A formal request for access to records is made under the Promotion of Access to Information Act (PAIA), as our PAIA manual explains. |
| Have it corrected or deleted | Email us, or use the Information Regulator's Form 2. |
| Object to our using it | Email us, or use the Information Regulator's Form 1. |
| Have your account and its data deleted | Email us from the address on the account, or ask your administrator. |
| Have an image blurred or removed because you can be recognised in it | Email us with the store and, if you can, when you were there. |
The forms are on the Information Regulator's website: inforegulator.org.za/popia-forms. If your account was created by your employer or by a retailer we work for, we may need to involve them in answering.
5. If something goes wrong
If personal information is accessed or taken by someone who should not have it, we will tell the Information Regulator and the people affected as soon as reasonably possible, say what happened and what we are doing about it, as section 22 of the Act requires.
6. Complaints
Please tell us first, so that we can put it right. If you are not satisfied, you may complain to the Information Regulator:
- Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- 010 023 5200 · toll free 0800 017 160
- enquiries@inforegulator.org.za · inforegulator.org.za