Privacy policy for Timeslot Business

Version 1.0. Effective 21 October 2026

Timeslot Business is an app that helps small businesses, such as barbers, trainers and therapists, keep track of their clients and bookings. It is made by Correntum (Pty) Ltd.

This policy is for:

• Providers. The businesses that sign up for Timeslot Business.
• Clients. The people a provider books. Clients do not sign up for anything with us.
• Visitors to this website.

About this policy

This policy explains how we handle personal information. It is a notice, not a contract. Nothing in it takes away any right you have under the Protection of Personal Information Act (POPIA) or any other law.

What this policy covers

Timeslot Business is in its pilot. During the pilot, providers add their clients and bookings by hand in the app. The WhatsApp connection, the booking assistant and push notifications are switched off, so no WhatsApp messages reach us and the app sends nothing to an AI service.

Before we switch any of them on, we will update this policy and tell providers by email first.

This policy covers only what we do. It does not cover what a business does with its clients' information outside Timeslot Business, for example in its own phone, paper records, WhatsApp chats or other software. Each business is responsible for that, and should give its clients its own privacy notice.

Who we are

Timeslot Business is made by Correntum. "We" and "us" mean Correntum.

Who is responsible for what

We are responsible for providers' information, for emails anyone sends us, and for this website. Each provider is responsible for its own clients' information. We handle that information only on the provider's behalf. In the words of POPIA, we are the responsible party for providers' information, and the provider's operator for its clients' information.

We use clients' information only to provide Timeslot Business to the business that added them, on its instructions. Those instructions include keeping the service secure, making backups, keeping a record that an erasure happened, and dealing with complaints and legal claims about the service. We also disclose information where a law requires it. We do not use clients' information to market our own services, and we do not sell it. The app is built so that each provider can see only its own clients and bookings.

Each business decides what client information to add and why. It is responsible for having a lawful reason to do so, for telling its clients about it, and for getting any consent the law requires. We do not check this for each client. If we learn that a business may not have the right to give us information, we may restrict that information until the matter is resolved.

Providers: what we collect and why

Timeslot Business is for businesses. Anyone who opens an account must be 18 or older and must be allowed to act for the business. We do not knowingly open accounts for people under 18, and we close any we find.

You give us most of this yourself, in the app or by email. Our servers record the technical records automatically. You need a name, email address and password to open an account. Without your services and working hours, the app cannot manage bookings for you. A description and specialties are up to you. No law requires you to give us this information.

We may also use and disclose your information where we reasonably need to, to deal with a complaint, to enforce our agreement with you, or to bring or defend a legal claim. If Correntum, or the part of it that runs Timeslot Business, is sold or merged, your information may pass to the new owner, who must keep protecting it under POPIA. We will tell providers before that happens.

Clients: what we handle and why

If you are a client of a business that uses Timeslot Business, the business adds you in the app so that it can book you. You never create an account with us. We keep an internal record for you with no password, so no one can sign in as you.

Why. So the business can keep its clients and its calendar in one place and see who is booked for what. The business decides what it needs to book you. If you would rather it did not keep your details in the app, ask the business.

Health practices

Some health practices, such as occupational therapists, may use Timeslot Business. A booking with a health practice can show that a person is its client, and POPIA may treat that as information about their health.

During this pilot, health practices may not add real clients to Timeslot Business, because our current suppliers' terms do not allow health information. Before any health practice can add real clients, we will make sure that every supplier that would receive the information allows it and protects it, confirm this to the practice in writing, and update this policy first.

When that happens, we will treat the practice's clients' information as special personal information. We will use it only to run that practice's bookings, and only the people who run the service inside Correntum will be able to reach it.

We do not ask for details about anyone's health, and the app has no field for health notes. Please do not put health details in a client's name, a service name or emails to us. If health details are added anyway, we protect them like all other client information and help the business remove them.

Clients under 18

During this pilot, businesses may not add a child, or a booking for a child, to Timeslot Business. Before we allow this, we will update this policy and tell providers by email.

When we allow it, a business will first need prior consent from a parent, a guardian or another person who has the legal right to decide for the child. A health practice will also need the consent the law requires for health information. The adult will usually be the booking contact, but the booking will still hold information about the child. We will protect it like all client information, and like health information if the business is a health practice.

If you have a question about a child's information, ask the business. If you write to us at privacy@timeslotbusiness.com, we pass your request to the business promptly, normally within 2 business days.

Visitors to this website

This website, timeslotbusiness.com, does not use cookies for tracking or analytics and has no forms. It loads no scripts, fonts or images from any company other than Vercel, which hosts it. Vercel records each request to the site, including your network address, to deliver and protect it. Vercel's terms also let it use these records for its own business, as its own privacy policy explains. If this changes, we will update this policy first. If you email us from a link on the site, we keep your email to answer you.

Who else handles the information

These companies handle personal information for us, to run the service. Each one handles it to do its job for us, under the terms shown in the table. The last column says what protects the information with each one.

When you choose a password, we check it against a public list of passwords that have leaked in data breaches (the Pwned Passwords service of Have I Been Pwned). We send only the first 5 characters of a scrambled form of the password, never the password itself, and nothing that identifies you.

When you download the app, Apple handles information about that under its own privacy policy, not this one. Our suppliers also have their own privacy policies for information they collect for their own purposes.

A client's information is shown to the business that added them. We may also give information to a court, the police or a regulator when a law requires it.

Information leaves South Africa

Your information is sent outside South Africa. Our servers and database are in London, in the United Kingdom. The companies in the table can also reach it from other countries:

• Vercel is a United States company. It delivers this website from its network around the world.
• Supabase contracts with us through Supabase Pte. Ltd., a Singapore company. Its terms allow some access from other countries, for example for support.
• Postmark is a United States company and sends our emails from the United States.
• Zoho stores our mailboxes in the United States. Zoho's group companies in India also process this information.

The United Kingdom has a data protection law similar to POPIA. The United States has no general national law like POPIA. Singapore and India have data protection laws, but they are not the same as POPIA. So we rely on each company's binding terms, not only on the law of its country.

POPIA allows information to be sent outside South Africa when the company that receives it is bound by a law, binding corporate rules or a binding agreement that gives it protection substantially similar to POPIA, including when it passes the information on (section 72(1)(a)). For providers' information, we are responsible for these transfers. We rely on the data processing terms shown in the table for Supabase and Postmark. Vercel and Zoho are not yet bound by such terms. We have asked Zoho for its terms, and we will move to a Vercel plan that includes them before the app is released on the App Store. Until then, we rely on section 72(1)(c) of POPIA, because sending the information is needed to provide the service or to answer the email you sent us.

For clients' information, the business is responsible under POPIA for deciding whether it may be sent outside South Africa. The table shows where each company is and what protects the information, so that the business can decide. Before a business adds real clients, it must agree in writing that we may use these companies.

How long we keep it

• Providers. While your account is open. When you delete your account, it is erased about 30 days later (see Deleting your account).
• Clients. While the business uses Timeslot Business. It is erased with the business's account, about 30 days after the business deletes it. We cannot yet delete one client's information on its own (see Your rights).
• Our invoices. If you pay us, we keep our invoices and payment records for as long as tax and company law require.
• Proof of deletion. When we erase an account, we keep a note that it was erased, with internal ID numbers and dates and no name or contact details. Those ID numbers can still be linked to a person, so we protect the note like any other personal information. We keep it for 5 years after the erasure, so that we can show the erasure happened, and use it for nothing else.
• Emails we send you. We keep our copy of each email we send you until your account is erased. Postmark keeps the email itself for 45 days. If an email to you bounces or is marked as spam, Postmark keeps your address on a list so that it does not send to it again. Postmark keeps this list with no end date. We can remove your address from it if you ask.
• Emails you send us. We keep emails sent to support@timeslotbusiness.com and privacy@timeslotbusiness.com, and our replies, for 3 years after we last deal with the matter. We keep them longer only if we need them for a complaint or a legal claim.
• Sign-in limits. The scrambled network address and email address are kept for at least a day after the time limit they belong to ends, and are removed the next time someone signs in. When few people sign in, this can take longer.
• Backups. We make encrypted backups of the database by hand every week and store them in South Africa. Access to the backup key is limited to authorised people at Correntum. We keep the 4 most recent backups and delete older ones. So after your information is erased, it stays in our backups until 4 newer backups have replaced the last one that holds it: normally about 28 days, and longer if a weekly backup is missed. If we restore a backup, information erased after that backup was made could come back. We check restored data by hand to find and erase it again, but until we keep our erasure records outside the database, this check could miss some information.
• Server logs. The logs of requests to our servers, which include network addresses, are kept for up to 1 day. Vercel and Supabase may also keep their own records under their own terms.

Deleting information from Timeslot Business does not delete anything the business keeps elsewhere, such as in its own phone.

How we protect it

We take appropriate, reasonable steps to protect personal information, as section 19 of POPIA requires, and we review them as risks change. Information travels over encrypted connections. Passwords are stored only as hashes. Backups are encrypted. Access to the database is restricted. No system is completely secure, so we cannot promise that information will never be lost or accessed without permission.

If we have reasonable grounds to believe that someone without permission has accessed or acquired a provider's information, we will tell the Information Regulator and the provider affected as soon as reasonably possible, as section 22 of POPIA requires. If it is client information that we hold for a business, we will tell that business immediately, as section 21(2) requires. The business must then notify the Regulator and its clients as POPIA requires, and we help it.

Deleting your account

Providers can delete their account in the app. You need to have signed in within the last 10 minutes. Your account is hidden straight away and erased about 30 days later, together with your clients' information. You can cancel the deletion in the app until then. When it is done, we email you to say so.

The app will not delete an account while the business still has bookings in the future. Cancel them first. If you cannot, or you cannot use the app, email support@timeslotbusiness.com and we will help. We will ask you to show that the account is yours, normally by writing from the email address on the account.

Your rights

You can ask us:

• whether we hold information about you, and for a copy of it;
• to correct information that is wrong;
• to delete information about you;
• to stop using information about you (to object).

To ask, email privacy@timeslotbusiness.com or write to us at our address above. You do not have to use a form. If you want to, you can use Form 1 (to object) or Form 2 (to correct or delete), which are on the Information Regulator's website. If you cannot email or write, phone us on +27 72 388 0408 and we will write down your request, read it back to you and send you a copy. We do not charge for these requests. We may ask you to show who you are first. We will do what you ask where the law gives you that right, and if we cannot, we will tell you why.

If your request is about a provider's account, or anything else we hold as the responsible party, our Information Officer deals with it as soon as reasonably possible. If you ask for a copy of your information, we tell you our decision within 30 days. The law lets us extend this once, by up to 30 more days, and if we do, we will tell you why. For other requests, we tell you in writing within 30 days what we have done. If you object and your objection is valid, we stop using that information straight away.

If you are a client, the business that added you is responsible for your information, so it answers your request. You can ask the business directly. If you write to us, we pass your request to the business promptly, normally within 2 business days, and help it answer. We can give the business a copy of your information or correct it on its instructions. We cannot yet delete one client's information on its own. It is erased with the business's account, about 30 days after the business deletes it.

You can also complain to the Information Regulator (see How to complain), and you can go to court about a breach of POPIA. We do not send marketing, and we do not make decisions about anyone by automated means alone.

Information Officer

Our Information Officer is Daniel Volschenk, a director and our chief executive officer. Write to them at privacy@timeslotbusiness.com, with "Information Officer" in the subject line.

How to complain

Tell us first and we will try to put it right. You can also complain to the Information Regulator at any time.

Changes to this policy

If we change this policy, we will put the new version on this page with a new version number and effective date. If a change is material, we will tell providers by email before it applies. We keep earlier versions of this policy and will send you one on request.