Data & Privacy Rights — CorVali

Last updated: May 2026

1. Governing law

CorVali processes personal information in accordance with the Protection of Personal Information Act (POPIA), Act 4 of 2013 of the Republic of South Africa. This page describes what we collect, why we collect it, where it is processed, and how you can exercise your rights as a data subject.

2. What we collect & why (lawful basis)

  • Name, phone number, email address — to fulfil your booking contract with us.
  • Appointment history — legitimate interest (service delivery and scheduling).
  • Payment records — legal obligation (tax and financial record-keeping).
  • WhatsApp conversation history — legitimate interest (booking management and customer support).

3. Cross-border transfers

To deliver the service, CorVali uses the following third-party processors located outside South Africa:

  • Supabase — database hosting (United States / European Union).
  • Anthropic — AI assistant processing (United States).
  • Meta Platforms — WhatsApp messaging (United States).

These transfers are made under appropriate safeguards. By using the service, you consent to these cross-border transfers as required to deliver the platform to you.

4. Your rights under POPIA

As a data subject you have the right to:

  • Access your personal information (request a copy of what we hold).
  • Correct personal information that is inaccurate or out of date.
  • Delete your information, subject to legal retention requirements (see section 6).
  • Object to processing carried out on the basis of legitimate interest.
  • Lodge a complaint with the Information Regulator of South Africa.

5. How to exercise your rights

Send an email to philip.vantonder@gmail.com with a subject line matching the right you wish to exercise — for example “Data Access Request” or “Data Deletion Request”. We will confirm receipt within 48 hours and respond substantively within 30 days.

6. Retention periods

  • Financial and invoice records — retained for 5 years as required by South African tax law.
  • Appointment and personal contact data — deleted after 3 years of account inactivity, or sooner on request.
  • WhatsApp conversation logs — retained for 12 months, then deleted automatically.

7. Information Regulator contact

Complaints may be lodged with the Information Regulator of South Africa:

Last updated: May 2026.