Privacy notice

Controller and contact

Host Flowhub is the responsible party (data controller) for personal information handled through this site and our review engagements. Privacy questions and rights requests may be sent to info@host-flowhub.digital or delivered to Level 8, 24 Adderley Street, Cape Town 8001.

Information we collect

An enquiry may include your name, email, phone number, selected review, deadline and message. Once an engagement is agreed, review records can include bank statements, account-holder identifiers, transaction information, sponsor letters and related financial evidence. We ask you not to send login credentials, PINs, full card numbers or original identity documents.

We may also receive basic security logs, such as IP address, browser type and request time, from our hosting provider. Cookie choices are described in our cookie notice.

Purpose and lawful basis

We use information to answer enquiries, assess scope, perform the requested contract, invoice, secure our service, meet legal duties and manage complaints. Where South African law requires consent for a particular use, we request it separately. We do not sell personal information or use financial records for advertising.

Sharing and international transfers

Information is limited to authorised reviewers and service providers needed for secure hosting, communications, file transfer and professional administration. A provider may process information outside South Africa. Before such a transfer, we use contractual or legal safeguards intended to provide protection comparable to the Protection of Personal Information Act (POPIA). We disclose information to public authorities only where lawfully required.

Retention and security

Unaccepted enquiry details are normally deleted after six months. Review copies and working notes are deleted within 30 days after final delivery, unless a dispute or law requires longer retention. Invoices and transaction records are retained for the statutory period. Final reports may be retained for 12 months to answer service questions, then deleted or anonymised.

We use access controls, restricted reviewer permissions and approved transfer methods. No internet transmission is risk-free; contact us promptly if you believe information was sent to the wrong recipient.

Your rights

Subject to legal limits, you may ask to access, correct or delete personal information, object to or restrict processing, withdraw consent where consent applies, or obtain information about cross-border safeguards. We verify identity before acting and normally respond within a reasonable legal period. You may complain to South Africa’s Information Regulator if a concern is not resolved.

Other people’s information and updates

If you provide sponsor or joint-holder information, tell that person and ensure you have authority to share it. Material changes to this notice will be posted here with a revised effective date.