Techware CRM is operated by Techware Outsourcing. This notice explains what the service stores and why, in line with the Protection of Personal Information Act, 2013 (POPIA).
The team that subscribes to Techware CRM is the responsible party for the lead information it captures. Techware Outsourcing acts as an operator on that team's behalf and processes the information only to provide the service.
Account information is processed to authenticate you and to apply your role's permissions. Lead information is processed on the legitimate interest of your employer in managing its own sales activity. Contact details of the people you record belong to your team: you are responsible for having a lawful basis to hold them, and for telling those people on request what you hold about them.
Where a team sends a client an onboarding form, Techware CRM stores what the client submits: company and registration details, the names, titles, email addresses and telephone numbers of the nominated contacts, environment details, the billing preference, and the authorisation confirmation with the name and date given.
Identity numbers. The form asks the authorised signatory for an ID or passport number so that the responsible party can verify who is contracting with them. This is the most sensitive information the service holds. It is stored in the team's database, is visible only to that team's managers and owner — never to sales reps, who do not need it — and is never used for any purpose beyond that verification. A client who would rather not provide it should leave it blank and arrange verification directly with the team.
Supporting documents are not stored. The form lists the documents a client should supply (identity document, registration certificate, proof of address and so on) and records only whether each was received. The documents themselves are sent by email and never uploaded to or held by this service.
The onboarding link is unguessable and specific to one client. It stops accepting information once the team marks the form verified. Anyone holding the link can complete the form, so it should be treated as confidential and sent only to the client.
A sales rep can see only the leads assigned to them. Managers and the team owner can see every lead in the team. Nobody outside your team can see any of it, and we do not sell, rent or share your data with anyone.
Data is stored in Cloudflare D1 and served from Cloudflare's edge network, which may process it outside South Africa. Cloudflare is contractually bound to protect it to a standard comparable to POPIA's requirements for transborder flows.
Lead records are kept until your team deletes them or closes the account. A deactivated user keeps their name on the leads and activities they created, so the team's history stays intact. Delete a lead and its activity trail goes with it, immediately and permanently.
You may ask what personal information we hold about you, have it corrected, or have it deleted. Contact your team owner first — they can do all three inside the app. For anything they cannot resolve, or to lodge a complaint, write to privacy@techware.tech. You may also complain to the Information Regulator of South Africa.
All traffic is encrypted in transit (HTTPS). Passwords are hashed with PBKDF2-SHA256 and an additional server-side pepper. Sessions are HMAC-signed and expire after 30 days.