Privacy Policy

Who is responsible

Epicore processes personal information for its website, customer portal, trial, licensing, subscription, billing, support and administration services. This policy covers that account and website processing; it does not transfer ownership of your business database to Epicore.

Information we collect

We may collect names, work contact details, company and branch details, billing information, trial and subscription records, licence entitlements and device registrations.

Support information includes messages, screenshots, diagnostics and files you choose to provide. Security records may include login events, IP addresses, browser/device details and administrative audit logs.

Billing records include payment status, references, amounts, currency and invoice or receipt details. Epicore should not store full card numbers, card PINs or online-banking passwords. Do not send these details, or banking one-time passwords, to Epicore.

We also process sales enquiries, quotations, trial invitations, service communications and marketing preferences.

Why we use the information

Create and secure Epicore accounts.

Provide trials, quotations, subscriptions, protected downloads and Sign In & Activate.

Register licensed devices and enforce agreed plan limits.

Provide support, updates and security assistance.

Process and reconcile payments and issue invoices/receipts.

Prevent fraud, abuse and unauthorised access.

Keep business, tax, audit and contractual records.

Improve Epicore using appropriately controlled support and operational information.

Send service messages and, where permitted, marketing communications.

Comply with law and respond to lawful requests.

Legal basis

Epicore will process personal information only where a lawful basis under POPIA applies, for example consent, performance of a contract, a legal obligation, or a legitimate interest recognised by POPIA that is not overridden in the circumstances.

Customer business databases

The normal Epicore Business architecture keeps the Customer's operational database at the Customer installation. Epicore does not automatically copy the full customer database into Epicore HQ or expose it directly to the public Internet.

If a Customer asks Epicore to process business data for support, migration, hosting or another service, the Data Processing Addendum and the agreed support scope apply.

Sharing and service providers

Epicore may use carefully selected service providers for hosting, email, protected downloads, security, support, payment processing and related business services. They should receive only the information needed for their role and be subject to appropriate confidentiality/security arrangements.

Cross-border processing

Some service providers or hosting systems may operate outside South Africa. Where personal information is transferred across borders, Epicore will use a transfer basis and safeguards permitted by POPIA and will review the relevant provider arrangements.

Security

We use access restrictions and reasonable technical and organisational safeguards appropriate to the information and foreseeable risks. Account access, protected downloads, device controls and administrative records help protect services.

No system can be guaranteed completely secure. Customers must also protect their own devices, passwords and backups.

Security incidents

Epicore will investigate suspected personal-information compromises and will cooperate with Customers and the Information Regulator where POPIA requires notification or other action. Where Epicore is acting only as an operator for a Customer, Epicore will notify the Customer in accordance with the Data Processing Addendum.

Retention

Epicore keeps personal information only as long as reasonably needed for the purpose for which it was collected, legal/tax requirements, dispute handling, fraud/security controls and legitimate recordkeeping. Information that no longer needs to be retained will be deleted, destroyed or de-identified as appropriate.

Your rights

Ask whether Epicore holds personal information about you.

Request access to personal information, subject to lawful limits.

Ask for inaccurate, incomplete, misleading or outdated information to be corrected.

Ask for deletion/destruction where Epicore is no longer authorised to retain the information.

Object to certain processing where POPIA permits.

Withdraw consent where processing depends on consent, without affecting lawful processing already completed.

Complain to Epicore or to the Information Regulator.

Marketing

Epicore will provide a practical way to opt out of direct electronic marketing. Service, security, billing and contractual messages are not marketing and may still be sent when needed to run the account.

Cookies and browser storage

The website and portal may use cookies or browser storage needed for account access, security and operation. If non-essential analytics or marketing storage is introduced, its purpose and available choices must be explained separately.

Children

Epicore business services are not designed for children. Epicore should not intentionally collect children's personal information through normal commercial account registration.

Privacy requests and complaints

For access, correction, deletion or privacy concerns, use our contact page and mark your message “Privacy”. We may need to verify your identity before disclosing or changing information.

You can also contact the Information Regulator South Africa through its official website.

Changes

We may update this policy when services, suppliers or requirements change. Keep a copy of the version that applies to your transaction. Material changes will be communicated where required.