Privacy Policy

Last updated: 14 October 2026

This policy explains how Groworx (Pty) Ltd ("Groworx", "we", "us") collects, uses, shares and protects personal information when you visit groworx.com, contact us, or use our apps and integrations, including the POSibolt ERP Integration app for Shopify. It also explains your rights and how to use them.

1. Who we are

Groworx (Pty) Ltd is a private company registered in South Africa. We build, sell, implement and support software for retailers and distributors, including the POSibolt platform and the apps that connect it to other systems.

• Address 51 Church Street, Amalgam, Johannesburg 2092, South Africa
• Email legal@groworx.com
• Phone +27 10 595 1080

For personal information we decide how to use, such as website enquiries and the contact details of our customers, we are the responsible party under South Africa's Protection of Personal Information Act, 2013 (POPIA) and the controller under the EU and UK General Data Protection Regulation (GDPR).

When we process personal information on behalf of a business customer, such as a merchant using the POSibolt ERP Integration app, the merchant is the responsible party or controller and we act as its operator or processor. We process that information only on the merchant's instructions, which are to provide and support the App as this policy describes.

2. What this policy covers

This policy applies to:

• groworx.com and the forms on it;
• the POSibolt ERP Integration app for Shopify (the "App");
• other Groworx apps and integrations that link to this policy; and
• your dealings with us by email, phone, video call or in person.

Some Groworx products have their own privacy policy, which applies to that product instead. For example, Groworx Finance is covered by the policy at finance.groworx.com/legal/privacy. Where we provide the POSibolt platform under a signed agreement, that agreement also governs how we handle the data in it.

This policy does not cover third-party websites and services, including Shopify itself. Their own privacy policies apply.

3. POSibolt ERP Integration for Shopify

The App connects a merchant's Shopify store to the merchant's POSibolt ERP. It keeps products, prices, stock levels and order fulfilment in step between the two systems, and every few minutes it sends new and updated Shopify orders to POSibolt so the merchant can fulfil and account for them. The App is used by businesses. We call the business that installs it the "merchant", and the merchant's buyers its "customers".

Information the App accesses from Shopify

When a merchant installs the App, the merchant grants it access to parts of the store through Shopify's APIs. The App uses that access as follows.

The App never receives full payment card details. Shopify does not share them with apps.

Information the merchant gives us

To connect the App to POSibolt, the merchant enters settings in the App: the POSibolt server address, user names and passwords, the POS terminal to use, the email addresses that should receive sync reports and alerts, and how payment methods, stores and stock locations map to each other. We also keep the messages a merchant sends us when asking for support.

Sync records and logs

The App keeps records of each sync and error logs so the merchant and our support team can see what happened and fix failed syncs. When an order fails to sync, these records can include the customer's name, email address or phone number.

What the App does not do

• It does not add scripts, tracking pixels or cookies to the merchant's online store, and it does not track shoppers.
• It does not use store or customer data for advertising, profiling or marketing.
• It does not sell store or customer data, or share it with anyone except as described in section 7.

Where App data goes

Order, customer, product and stock data passes between Shopify, the App's servers and the merchant's POSibolt ERP. Records created in POSibolt, such as sales orders and customer records, become part of the merchant's own business records and are governed by the merchant's POSibolt agreement. The service providers that host the App are listed in section 7.

Retention, deletion and Shopify privacy requests

The App keeps store data only while it is installed, plus the short periods below. Shopify sends us privacy requests on behalf of merchants and their customers, and we respond to them as follows.

Shopify may hold back a customer's erasure request for up to six months if the customer ordered recently, so the merchant can complete the order.

Deleting data from the App does not delete records already created in the merchant's POSibolt ERP. The merchant controls those records and can ask us for help to correct or delete them.

If you shop with a store that uses the App

The store you bought from decides how your information is used and is responsible for answering your privacy requests, so please contact the store first. If you contact us instead, we will pass your request to the store and help it respond.

4. Our website and enquiries

Enquiry forms

When you ask us to call you back, we collect your name, email address, mobile number, country and whether you want to receive product updates from us. The form is delivered to our inbox by our form provider, Web3Forms, and we may add your details to our customer relationship management system, Zoho CRM, so we can follow up.

To pre-fill your dialling code, the form asks an IP lookup service, ipwho.is, which country your internet connection is in. Your browser sends your IP address to that service, and we only receive the country.

Analytics

We use Google Analytics to understand how people use our website. It records the pages you visit, how you arrived, your approximate location (city and country), and your device, browser and screen size. Google Analytics 4 does not store IP addresses. We do not use Google's advertising features.

Campaign tracking

If you arrive from one of our campaigns, the link may carry campaign tags (UTM parameters) such as the source and campaign name. We store these in a cookie so we can tell which campaigns bring enquiries.

Server logs

Our website host, Vercel, processes technical information such as your IP address, browser type, the page requested and the time, to deliver the site and protect it from abuse.

When you contact us

If you email, phone or meet us, we keep the information you share, such as your name, job title, company and the content of your messages, so we can respond and keep a record of our dealings with you.

5. Cookies and similar technologies

Cookies are small files a website stores in your browser. groworx.com uses the following cookies and similar technologies.

We do not use advertising or retargeting cookies. You can block or delete cookies in your browser settings, and you can stop Google Analytics collecting data about you with Google's opt-out browser add-on. The website works without these cookies.

The App runs inside the Shopify admin. It uses Shopify's session tokens to confirm requests come from the signed-in merchant, and a few strictly necessary cookies to complete installation and protect its forms against cross-site request forgery. It does not set analytics or advertising cookies.

6. How we use personal information

We only use personal information when the law allows it. The table shows what we use it for and the legal ground we rely on under POPIA and, where it applies, the GDPR.

You do not have to give us personal information. But without your contact details we cannot reply to your enquiry, and without store access and POSibolt connection details the App cannot sync.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

7. Who we share it with

We do not sell personal information, and we do not share it for targeted or cross-context behavioural advertising. We share it only with the following people and organisations.

Service providers

These providers process personal information to provide their services to us, under their business terms and, where they offer one, a data processing agreement.

Others

• Shopify. It gives the App store data on the merchant's instructions and sends us privacy requests.
• The merchant's POSibolt ERP. The App sends order, customer, product and stock data to the POSibolt ERP the merchant connects it to.
• Our staff and contracted developers. People who need access to build, run and support our services, under confidentiality obligations.
• Professional advisers. Lawyers, auditors and insurers, where needed.
• Legal requests and safety. Authorities or others where the law requires it, or where needed to protect the rights, property or safety of Groworx, our customers or others.
• Business transfers. A buyer or successor if we are involved in a merger, acquisition or sale of assets, who must protect the information as this policy describes.
• With your consent. Anyone else you ask us to share it with.

8. International transfers

Groworx is based in South Africa. Some of our service providers and contracted developers are in other countries, including the United States and India, so your personal information may be processed outside South Africa and outside the country where you live.

When we transfer personal information across borders, we make sure it stays protected as section 72 of POPIA and, where it applies, the GDPR require. We rely on safeguards such as binding agreements with data protection terms, including the European Commission's Standard Contractual Clauses where needed, or on the recipient being subject to laws that protect personal information to a similar standard. You can ask for a copy of the safeguards we rely on by emailing legal@groworx.com.

9. How long we keep it

We keep personal information only for as long as we need it for the purposes in this policy.

If you ask us to delete personal information we control, we will do so within 30 days, unless we must keep it by law or to establish, exercise or defend a legal claim. For App data, we act on the merchant's instructions and Shopify's privacy requests, as section 3 explains.

10. How we protect it

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, as POPIA requires. These include:

• encrypting data in transit with HTTPS (TLS) on our website and the App, and on the App's connections to Shopify and to its database;
• checking that webhooks Shopify sends to the App really come from Shopify; and
• limiting access to personal information to the people who need it, using individual accounts and multi-factor authentication where available.

If a security breach affects personal information we control, we will tell the Information Regulator and the people affected as soon as reasonably possible, as section 22 of POPIA requires, and other regulators where the law requires. If a breach affects App data, we will tell the merchant immediately, and Shopify where its terms require, and help the merchant meet its own duties.

11. Your rights

Depending on where you live, you have some or all of these rights over your personal information:

• to know whether we hold personal information about you, and to get a copy of it;
• to have it corrected if it is wrong or incomplete;
• to have it deleted;
• to object to how we use it, including for direct marketing, and to ask us to restrict its use;
• to receive it in a portable format;
• to withdraw your consent at any time, where we rely on consent; and
• to complain to a data protection regulator.

South Africa (POPIA)

You can ask us to confirm whether we hold your personal information and for a description of it, to correct or delete it, and to stop using it for direct marketing. You can object to us using it on the ground of legitimate interests, and you have the right not to be subject to decisions based solely on automated processing. You can complain to the Information Regulator, whose details are in section 15. Requests for records under the Promotion of Access to Information Act, 2000 (PAIA) can also be sent to legal@groworx.com.

European Union, European Economic Area and United Kingdom (GDPR)

You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. You can complain to the data protection authority in the country where you live or work, or where you think the law was broken.

United States

If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose, and to ask us to delete or correct it. We do not sell or share personal information for targeted advertising, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using your rights. An authorised agent can make a request for you if we can verify their authority.

In the last 12 months we have collected these categories of personal information: identifiers (such as name, email address, phone number and IP address), commercial information (orders processed through the App), internet activity (website analytics), approximate location (country and city), and professional information (company and job title). We collect them from you, from merchants through Shopify, and automatically when you use our website, for the purposes in section 6. We disclose them only to the service providers and others in section 7.

Other countries

If you live in another country with a data protection law, such as the United Arab Emirates, Saudi Arabia, Kenya or Nigeria, you have the rights that law gives you, and we will honour them.

How to make a request

Email legal@groworx.com. We may ask you to confirm your identity before we act on a request, and we will reply within 30 days. If we need more time, we will tell you why. We do not charge for most requests. If you are a customer of a store that uses the App, please contact the store first, as explained in section 3.

12. Marketing messages

We send product updates and company news only if you opt in, for example by ticking the box on our enquiry form, or, if you are a customer, about products and services similar to those you bought from us. We give customers the chance to say no when we collect their details. Every message includes a way to unsubscribe, and you can also email legal@groworx.com. We never use data from the App to market to a merchant's customers.

13. Children

Our website and apps are made for businesses and are not directed at children under 18. We do not knowingly collect personal information from children. If you think a child has given us personal information, contact us and we will delete it. Order data the App processes for a merchant may relate to customers of any age. The merchant is responsible for that information.

14. Changes to this policy

We may update this policy when our services, our service providers or the law change. We will change the "last updated" date at the top of this page. If we make a significant change, we will tell merchants who use the App and our customers by email or in the App before the change takes effect. Earlier versions are available on request.

15. Contact us and complaints

For questions about this policy or your personal information, or to make a request, contact our Information Officer:

• Post Information Officer, Groworx (Pty) Ltd, 51 Church Street, Amalgam, Johannesburg 2092, South Africa
• Email legal@groworx.com
• Phone +27 10 595 1080

We would like the chance to resolve your concern first. If you are not satisfied, you can complain to the Information Regulator of South Africa:

• Address Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Phone 010 023 5200
• Complaints POPIAComplaints@inforegulator.org.za
• Website inforegulator.org.za

If you are in the European Union, European Economic Area or United Kingdom, you can also complain to your local data protection authority.