This notice explains how Eleven27 Software Solutions (Pty) Ltd ("Eleven27", "we", "us"), the company that develops and operates Quotier, collects and processes personal information in line with South Africa's Protection of Personal Information Act (POPIA). It is the §18 notification given to the people whose information we process.

1. Responsible party & information officer

Eleven27 Software Solutions (Pty) Ltd is the responsible party for the personal information we collect about you and your users to run Quotier. For personal information about other people that you enter or upload — your customers', suppliers' and staff's details — you are the responsible party and we act as your operator, processing it on your instructions and under the safeguards in this notice. Our information officer can be reached at privacy@quotier.io, and our registered address is available on request.

2. What we collect

Account & profile: your name, email address, role, and your organisation's details (name, address, registration/VAT numbers, logo).
Operational data you enter: customers, jobs, quotes, invoices and related line items, and documents you upload (for example a supplier's quote or price list), which may carry other people's business contact details.
Billing: subscription tier, billing status, and a tokenised card reference plus the card brand and last four digits. We never see or store full card numbers. Card details are handled by Paystack.
Technical: a strictly-necessary session cookie, server logs, error/performance diagnostics, and first-party, cookieless website analytics (page views and referrer, with your IP address masked).

3. Why we process it (purpose & lawful basis)

To provide the quoting/invoicing service and your account, to take subscription payments and issue tax invoices, to secure the service, and to meet legal obligations (e.g. SARS record-keeping). Processing is on the basis of performing our contract with you, our legitimate interests in running the service, and legal compliance.

4. Who we share it with (operators)

We use trusted operators who process information on our behalf under contract: Paystack (payments), Amazon Web Services (hosting and file storage in the Cape Town region, and — only when you choose to have a supplier's document read automatically — its Amazon Bedrock service, see section 5), our email provider (transactional email), and Sentry (error monitoring). We do not sell personal information.

5. Cross-border transfers

Your data and the files you upload are stored in Amazon Web Services' Cape Town region (af-south-1), in South Africa. Personal information leaves South Africa in two cases:

Payments, email and error monitoring. Paystack, our email provider and Sentry may process limited information on servers outside South Africa.
Automatic document reading. When you choose "Read the document" on a supplier's quote or price list, Quotier sends the content of that document to Amazon Bedrock, an Amazon Web Services service, so that the supplier's details, the figures and the lines can be read for you to check. Amazon Bedrock may process that content on secure AWS servers outside South Africa. The content can include personal information about other people, such as the names, email addresses and telephone numbers of a supplier's staff. AWS processes it only to provide the service: it does not use the content to train models or share it with anyone else, and holds a copy only for as long as its abuse-detection controls require. No one other than AWS receives it. The feature is optional — every document can be captured by hand instead, in which case nothing in it leaves South Africa — and the document itself and what was read from it are stored in the Cape Town region like everything else.

In both cases we rely on section 72(1)(a) of POPIA: each recipient is bound by an agreement with us that provides an adequate level of protection, upholding principles substantially similar to POPIA's conditions for lawful processing and restricting any further transfer. For automatic document reading you also decide, document by document, whether the transfer happens.

6. Retention

We keep your data while your account is active. Tax invoices and related financial records are retained for the period SARS requires (generally five years) even after an account is closed. Other personal information is deleted or anonymised on request, subject to those legal-retention obligations.

7. Your rights

You may access, correct, or request deletion of your personal information, and object to certain processing. Account owners can export their organisation's data and request account deletion from the billing area, or contact us at privacy@quotier.io. You may also lodge a complaint with the Information Regulator (South Africa).

8. Cookies & analytics

We set only a strictly-necessary, encrypted session cookie to keep you signed in. We do not use advertising or third-party tracking cookies. Our website analytics are first-party and cookieless: we measure page views and where visitors arrived from using our own servers, with visitor IP addresses masked and nothing shared with a third-party analytics provider, so no cookie-consent banner is required. Anonymous analytics records are automatically deleted after 24 months.

9. Security

We protect information with encryption in transit, scoped access controls, tenant isolation, and rate limiting. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the data.

10. Changes

We may update this notice; product changes will be communicated through the service. Continued use after an update means you accept the revised notice.

Privacy Policy