Privacy Policy

01Who we are

Just ERP is operated by Just Corporation (Pty) Ltd, of 194 Bancor Avenue, Park Lane West Building, Waterkloof Glen, Pretoria, 0181. For POPIA we are the responsible party for the personal information described in sections 3 and 4, and an operator for the information your company puts into its books (section 5). Our Information Officer, our Information Officer (name to be confirmed), is registered with the Information Regulator and can be reached at info@just-corporation.com.

02Who this policy covers

It covers everyone whose personal information passes through Just ERP: people who create or are invited into a company account; accountants and bookkeepers who list in the directory; the customers, suppliers and employees whose details a company records in its books; and visitors to this website.

Where a company records information about its own customers or staff, that company is the responsible party and we process on its instructions. Section 5 explains the split.

03What we collect about account holders

To run your account: name, work email, mobile number if you add one, password hash, the secrets behind an authenticator app and backup codes if you set them up, the companies you belong to and the areas you are allowed to see. To bill you: company registration and VAT numbers, billing address, and a tokenised card reference held by our payment provider (we never store full card numbers). To keep the system safe: IP address, device and browser, sign-in times, and an audit trail of what you changed in the ledger and when.

We collect this directly from you, from the person who invited you, or automatically when you use the service.

04What we collect about accountants in the directory

Name, practice, contact details, area, the services you offer, a few words about the practice, your professional body and membership number, and whether you are verified. The directory is public by design, and only while you choose to be listed: your name, practice, services, area, contact details and verified status are visible to anyone on this website, and your membership number once verified. It never shows your clients, nor how many you have.

You can edit or unpublish your listing at any time from your account. When a company asks us for an introduction to you, we keep their company name, email address and what they need, and pass these to you only once they have confirmed the request by email; a request nobody confirms is deleted after seven days.

05Information inside a company’s books

Invoices, bills, bank statements, customer and supplier records, payroll and similar contain personal information about third parties. The company that enters it is the responsible party. We process it only to provide the service, on the company’s written instructions (these terms), and we do not use it for our own purposes, sell it, or build profiles from it. Where a listed accountant is granted access to a company, that access is the company’s decision and is recorded in the audit trail.

Bank statements you upload are read by software to extract transactions. They are stored encrypted, visible only to people with Accounting access in that company, and are not used to train any model.

06Why we process it and on what basis

To perform our contract with you: creating accounts, keeping the ledger, generating tax invoices and VAT returns, running payroll, billing you. To meet legal obligations: the Companies Act, the Tax Administration Act, the VAT Act and FICA require certain records to be kept for prescribed periods. For our legitimate interests: preventing fraud and securing the platform. With your consent, which you can withdraw: publishing an accountant profile, and sending product news by email.

07Who we share it with

Operators who help us run the service, each under a written agreement that binds them to this policy: our hosting and database provider, our payment processor and our email provider. Listed accountants, only for the companies that granted them access. SARS and other authorities, where the law requires it. A buyer of the business, if Just Corporation is sold, on the same terms. We never sell personal information and we do not share it with advertisers.

08Where it is stored and cross-border transfers

Records, sign-ins and uploaded files are held by Supabase in its Ireland region; the application runs on Vercel’s servers in Dublin; transactional email goes through Resend. Each is bound by contract to a standard of protection at least equal to POPIA, as section 72 requires. We will tell you before the region changes. No analytics or advertising services receive any personal information.

09How long we keep it

Ledger records, tax invoices and supporting documents: five years from the end of the financial year to which they relate, or longer if a dispute or audit is open, because the Companies Act and the Tax Administration Act require it. Account and billing records: for the life of the account and three years after. Audit trail: the life of the organisation. Security logs: twelve months. Accountant profiles: until you unlist or close your account. When an owner closes an organisation, nobody can sign in to it again; people’s names and contact details, and customers’, suppliers’ and leads’ contact details, are removed at once; invoices, bills and journals stay, unchanged, for five years from the closing date, after which the platform deletes everything the organisation held. An owner can export everything the organisation holds, as one file, at any time before closing.

10How we protect it

Encryption in transit and at rest. Every sign-in, by everyone, passes a second step: a code emailed to the person, or their authenticator app or a backup code when the email does not arrive, and a sign-in idle for twelve hours ends. Access inside the product is per company and per area, enforced in the database, not only in the interface. Journals cannot be edited or deleted, only reversed, and every change is logged with who made it. Our staff have no standing access to your organisation: a support session is reasoned, limited to eight hours, read-only, written to your audit log and endable by your owner. If a breach puts your information at risk we will notify the Information Regulator and affected organisations as soon as reasonably possible, as section 22 requires, and they notify their own data subjects where the law requires.

11Your rights

You may ask what personal information we hold about you, ask us to correct or delete it, object to processing based on our legitimate interests, withdraw consent, and ask us not to send you marketing. Write to privacy@just-queue.co.za; we respond within 30 days and may ask you to confirm your identity first. If you are unhappy with our answer you may complain to the Information Regulator at complaints.IR@justice.gov.za. If your request concerns information inside a company’s books, we will pass it to that company, who is the responsible party, and help them answer.

12Cookies and analytics

This website sets no cookies. The product uses strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We run no analytics or error-tracking services and use no advertising cookies or third-party trackers, here or in the product.

13Children

Just ERP is a business tool and is not directed at anyone under 18. We do not knowingly collect personal information from children.

14Changes to this policy

If we make a material change we will email account holders at least 30 days before it takes effect and show the new version in the product. The version and effective date appear at the top of this page.