PRIVACY POLICY

Who we are. sorted is a WhatsApp-based record-keeping and accounting service built for the micro enterprise sector. We help you keep track of your money by turning photos of receipts and invoices into organised financial records.

sorted is operated by Sorted Mobi (Pty) Ltd.

This privacy policy explains how Sorted Mobi (Pty) Ltd ("we", "us", "sorted") collects, uses, stores, and shares your personal information when you use our WhatsApp-based bookkeeping and accounting service.

We are committed to complying with the Protection of Personal Information Act, No. 4 of 2013 (POPIA), which governs the processing of personal information in South Africa.

We have appointed a Data Protection Officer (DPO) to oversee compliance with this privacy policy and POPIA. If you have any questions about this policy or our data protection practices, please contact our DPO at sunesh@sorted.mobi.

Information you give us directly

• Your name and WhatsApp phone number
• Photos of receipts, invoices, and financial documents you send us
• Your business name, type, and location (if you share them)
• Messages you send to us on WhatsApp

Information we create from your data

• Categorised transaction records
• Financial summaries
• Business performance insights

Information we may collect for credit readiness assessment

• Payment behaviour patterns
• Business activity signals
• Mobile behaviour signals
• Community and social capital signals

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

Your information, including Personal Data, may be transferred to - and maintained on - computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to United States and process it there.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Sorted will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information.

We may disclose personal information that we collect, or you provide:

Disclosure for Law Enforcement. Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities.

Business Transaction. If we or our subsidiaries are involved in a merger, acquisition or asset sale, your Personal Data may be transferred.

Other cases. We may disclose your information also:

• to our subsidiaries and affiliates;
• to contractors, service providers, and other third parties we use to support our business;
• to fulfil the purpose for which you provide it;
• for the purpose of including your company's logo on our website;
• for any other purpose disclosed by us when you provide the information;
• with your consent in any other cases;
• if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others.

Our Service may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

You have the right to:

• Access: Ask us what personal information we hold about you
• Correction: Ask us to fix any incorrect information
• Deletion: Ask us to delete your personal information (subject to legal retention requirements)
• Object: Object to us processing your information for certain purposes
• Withdraw consent: Take back your consent at any time (this won't affect anything we've already done lawfully)
• Not be subject to automated decisions: Request human review of any automated credit scoring decision that affects you

To exercise any of these rights, just send a WhatsApp message to us or email info@sorted.mobi.

We will respond within 30 days. If we can't help, we'll explain why.

If you opt in to our credit readiness features, we use automated processes to generate a credit readiness score based on the signals described in section 2. This score is designed to help you understand your credit readiness and may be shared with lenders (only with your explicit consent).

Your right to human review. You can request that a human reviews any automated credit scoring decision. Just send us a WhatsApp message saying "I want a human to review my score" and we'll arrange it within 10 business days.

We will only send you marketing messages if you've given us explicit consent. You can withdraw this consent at any time by sending "STOP" on WhatsApp. We will never share your information with other companies for their marketing.

sorted is designed for business owners aged 18 and older.

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you become aware that a child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

What happens if there's a data breach. In the event of a data breach that compromises your personal information, we will notify you and the relevant supervisory authority as required by POPIA. We will provide details of the breach, the data affected, and the measures we are taking to address it.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update "effective date" at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

If you have any questions about this Privacy Policy, please contact us:

• By email: info@sorted.mobi
• By visiting this page on our website: www.sorted.mobi