Privacy Policy
Effective Date: January 2026
Introduction
OnboardMe ("we", "our", "us") is committed to protecting the privacy and security of our users and their clients. This Privacy Policy sets out how we collect, use, disclose, store, and safeguard personal data.
As a professional services platform, we recognise the sensitive nature of the information we process — including tax numbers, bank account details, identity documentation, and confidential business information. Protecting this data is a legal obligation and a core part of our mission.
Sensitive Information We Handle
In addition to standard personal data (name, email, phone), OnboardMe may process:
- Tax Numbers and tax-related data
- Bank account and payment details
- Identity verification documents and compliance records
- Engagement letters, contracts, and legal agreements
- Professional service records and onboarding information
These categories of information are subject to enhanced security, encryption, and compliance measures as described in this Policy.
Data Storage, Security, and Retention
All data is stored in the Rackzar in Cape Town, ensuring compliance with South African data protection and sovereignty laws.
- Encryption: All sensitive data (including tax numbers and banking details) is encrypted at rest using AES-256, and in transit using TLS 1.2+.
- Access Controls: Role-based access control (RBAC), MFA, and strict authentication policies restrict data access to authorised personnel only.
- Monitoring: All access to sensitive data is logged, monitored, and audited. Alerts are generated for suspicious activity and sent to our security team at security@onboardme.app.
- Backups: Encrypted backups are maintained exclusively in Cape Town.
- Retention: Data is retained only for as long as required by law or business need, then securely deleted or anonymised.
Monitoring and Logging
OnboardMe employs extensive monitoring and logging for security, compliance, and product enhancement purposes.
- User Activity: Pages visited, time spent, and feature usage, to improve UX and product design.
- System Logs: Session data, IP addresses, login attempts, and error logs, to ensure platform stability and detect threats.
- Performance Metrics: API response times, latency, and reliability statistics.
- Diagnostic Data: Automatically collected during errors/crashes to improve stability.
Monitoring data is encrypted, stored in Cape Town, and subject to the same access controls as personal data. Wherever possible, monitoring data is aggregated or pseudonymised.
Data Breach Response and Notification
In the unlikely event of a data breach, OnboardMe follows a strict incident response plan in line with the POPIA breach notification requirements.
- Breaches are detected through continuous monitoring and alert systems.
- Incidents are immediately investigated and contained.
- If the breach is likely to result in serious harm, affected individuals and the Information Regulator will be notified without undue delay.
- Notifications will include the nature of the data affected, likely consequences, and steps individuals can take to mitigate risks.
We regularly test and update our incident response processes to ensure rapid and effective response capability.
Compliance with South African Law
OnboardMe complies with the Protection of Personal Information Act (POPIA), as well as relevant financial record-keeping obligations.
We review our data handling practices regularly to ensure compliance with changing laws and industry standards.
Your Rights
You have rights to access, correct, and request deletion of your data, subject to legal obligations. You may also request portability of your data or object to certain processing activities. Requests can be submitted via our contact details below.
International Data Transfers
All personal data is stored in South Africa (Rackzar in Cape Town). We do not transfer or store data outside South Africa unless explicitly agreed and legally compliant.
Children’s Privacy
Our App is not directed to children under 13 (or the relevant local age). We do not knowingly collect data from children. If discovered, such data will be deleted.
Changes to This Privacy Policy
We may update this policy to reflect legal, regulatory, or operational changes. Updates will be published here with a new effective date.
Contact Us
For privacy enquiries, please contact us:
- Email: info@onboardme.app
We respond to all enquiries within 30 days.