Privacy Policy

Last updated: 26 November 2026

Contents

About this Policy
Definitions
How we collect and process personal information
Personal information we collect and why
When we share personal information
Platform access and client responsibilities
Third-party processing, analytics, marketing and payments
GDPR privacy
Social media pages
Information we do not intentionally collect
Cross-border transfers
Security
Your rights
Data retention
Links to other websites
Changes to this Policy
General
Governing law
Contact details

1. About this Policy

In2books Accounting (“in2books”, “we”, “us” or “our”) provides cloud-based practice-management software and related services to accounting, auditing and bookkeeping firms. Our platform helps firms manage workflows, tasks, audits, timekeeping, billing, statutory deadlines, share registers, certificates and reporting.

We take privacy seriously. This Privacy Policy explains how we collect, use, store, process, share and protect personal information when you visit our websites, use our platform, applications or services, or interact with us.

In this Policy, “personal information” means information that can identify a person, as defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”). It also includes “personal data” as used in the General Data Protection Regulation (“GDPR”), where GDPR applies.

Where we process personal information for our own purposes, we act as a responsible party under POPIA and a data controller under GDPR. Where we process personal information on behalf of a client firm through the in2books platform, we generally act as an operator under POPIA and a data processor under GDPR, and the client firm remains responsible for that information.

We comply with POPIA and other applicable privacy laws. Where consent is required, we will ask for it separately. Using our services does not by itself mean you consent to every optional processing activity described in this Policy.

2. Definitions

In this Policy:

Account means the unique account created for you to access in2books or parts of it.
Affiliate means an entity that controls, is controlled by, or is under common control with in2books, where “control” means ownership of 50% or more of the voting shares or similar interest.
Application means any in2books software program or app provided by us and used on a device.
Company means APP INA BOX (PTY) LTD. t/a In2books Accounting, 76 Beach Road, Strand, 7140, Cape Town, South Africa.
Country means South Africa.
Data Controller means, under GDPR, the person that determines the purposes and means of processing personal data. Where in2books acts for its own purposes, it is the Data Controller.
Data Processor means, under GDPR, a person that processes personal data on behalf of a Data Controller.
Device means any device that can access the services, such as a computer, laptop, mobile phone or tablet.
Operator means, under POPIA, a person that processes personal information on behalf of a responsible party.
Personal Information means information relating to an identifiable person, as defined in POPIA, and includes information such as name, contact details, email address, phone number, physical address, identity number, account details, IP address, cookies, job title, gender, age, marital status and language. It also includes Special Personal Information as defined in POPIA, such as race or ethnic origin, religious or philosophical beliefs, trade union membership, political persuasion, sexual orientation, health information, biometric information, criminal behaviour allegations and private correspondence.
Responsible Party means, under POPIA, the person that determines the purpose and means of processing personal information.
Service means the in2books platform, applications, websites and related services.
Service Provider means a third party that processes information on our behalf, such as hosting, analytics, payment, support or email providers. Under GDPR, these are Data Processors.
Third-Party Social Media Service means a social network or website through which a user may log in or create an account to use the Service.
Usage Data means information collected automatically through use of the Service, such as IP address, browser type, device type, operating system, pages visited and diagnostic data.
You means the person accessing or using the Service, or the firm or entity on whose behalf that person acts.

3. How we collect and process personal information

We collect and process personal information for lawful purposes connected with providing and improving in2books, managing our relationships, operating our business and complying with the law.

We will only process personal information in accordance with this Policy and applicable law. Please read this Policy before submitting personal information to us.

Where you provide personal information about another person, you confirm that you are authorised to do so and that the person understands how their information will be handled.

4. Personal information we collect and why

4.1 Information you provide

We may ask you for information such as:

first and last name;
identity number;
email address;
mobile number;
date of birth;
physical address;
firm name, role and business contact details;
bank account details for billing or payment purposes;
social media handles or profile information;
account login details;
support queries and correspondence;
information uploaded to the platform by you or your firm.

4.2 Information collected automatically

We may automatically collect Usage Data, including:

device IP address;
browser type and version;
device type and mobile operating system;
pages or features used;
time and duration of visits;
diagnostic and security logs.

4.3 Why we use personal information

We may use personal information to:

provide, operate and support the in2books platform;
create and manage user accounts;
verify identity and manage access;
provide information about products or services you request;
communicate service updates, security notices and administrative messages;
manage billing, payments and account administration;
respond to requests, queries and complaints;
monitor and analyse use of the Service;
improve our platform, products, services, marketing and user experience;
conduct data analysis and identify usage trends;
evaluate the effectiveness of campaigns;
send direct marketing where you have consented or where otherwise permitted by law;
comply with legal, tax, regulatory and contractual obligations;
detect, prevent and investigate fraud, misuse, security incidents or crime;
enforce or defend legal rights;
manage mergers, acquisitions, restructuring, financing or business transfers;
pursue any other purpose authorised by you or disclosed to you.

5. When we share personal information

We may share personal information in the following circumstances:

Service Providers: with hosting, analytics, payment, support, email, security and other providers that help us operate the Service.
Client firms: where a client firm uses in2books, information uploaded by that firm is accessible to authorised users of that firm and may be processed by us as operator on the firm’s instructions.
Affiliates: with affiliates that must respect this Policy.
Business partners: where relevant to offer products, services or promotions, subject to applicable law.
Professional advisers: with lawyers, auditors, accountants, insurers and other advisers where necessary.
Business transfers: in connection with a merger, sale, financing, acquisition, restructuring or transfer of assets.
Legal and regulatory authorities: where required by law, court order, regulator or to protect rights, safety or property.
With your consent: for other purposes where you have agreed.

We do not sell personal information.

6. Platform access and client responsibilities

Access to the in2books platform is restricted to authorised users. Client firms and end users are responsible for how they use the Service, including ensuring that information uploaded to the platform is collected and processed lawfully.

in2books provides the platform and related support on a non-exclusive, non-transferable basis, subject to the applicable agreement and terms. We are not responsible for misuse of the Service by a client firm, its employees, representatives or end users.

Where a client firm uploads personal information of its own clients, employees or other persons into in2books, the client firm is responsible for ensuring it has a lawful basis to do so and for providing any required privacy notices.

7. Third-party processing, analytics, marketing and payments

Third-party providers may access or process personal information to help us deliver the Service. They do so under their own privacy policies and our agreements with them.

7.1 Analytics

We may use analytics providers, such as Google Analytics, to understand how the Service is used. Google Analytics may collect information through cookies and similar technologies, subject to your cookie choices. Google may use the information for its own advertising and analytics purposes. You can manage Google Analytics through device settings or Google’s privacy controls: https://policies.google.com/privacy.

7.2 Email marketing

We may use personal information to send newsletters, product updates, marketing or promotional material where permitted by law. You may unsubscribe at any time using the link in the email or by contacting us. We may use email service providers to manage these communications.

7.3 Payments

We may offer paid products or services. Payment card details are generally provided directly to third-party payment processors and are not stored by us. Payment processors may include providers such as PayFast or Netcash where used. These providers are responsible for their own privacy and security practices. Payment processors may adhere to PCI-DSS standards.

8. GDPR privacy

Where GDPR applies, we process personal data on one or more of the following legal bases:

Consent: you have consented to processing for one or more specific purposes.
Contract: processing is necessary to perform an agreement with you or take pre-contractual steps.
Legal obligation: processing is necessary to comply with a legal obligation.
Vital interests: processing is necessary to protect your vital interests or those of another person.
Public interest: processing is related to a task carried out in the public interest or in the exercise of official authority.
Legitimate interests: processing is necessary for our legitimate interests or those of a third party, provided your rights are not overridden.

If you have questions about the legal basis for processing, contact us.

Your GDPR rights

Where GDPR applies, you may have the right to:

request access to personal data we hold about you;
request correction of incomplete or inaccurate data;
object to processing based on legitimate interests or for direct marketing;
request erasure of personal data where there is no good reason for continued processing;
request transfer of personal data in a structured, commonly used, machine-readable format, where the right applies;
withdraw consent where processing is based on consent;
complain to a data protection authority.

To exercise these rights, contact us. We may ask you to verify your identity before responding. If you are in the European Economic Area, you may also contact your local data protection authority.

9. Social media pages

Where we operate social media pages, including a Facebook page, the social media platform and in2books may act as joint controllers for certain information collected through the page.

We may use platform insights tools, such as Facebook Insights, to receive anonymised or aggregated statistics about visitors. The social media platform may place cookies on your device and process information in accordance with its own privacy policy. For more information, review the relevant platform’s privacy policy.

10. Information we do not intentionally collect

in2books does not intentionally collect Special Personal Information for its own purposes, such as race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data or sexual orientation.

However, client firms may choose to upload or process such information through the platform. Where that happens, the client firm is responsible for ensuring that the processing is lawful and that appropriate safeguards are in place.

The Service is intended for business and professional use. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will take reasonable steps to remove it.

11. Cross-border transfers

We may process or store personal information in South Africa and in other countries where we, our service providers or affiliates operate. This means personal information may be transferred to jurisdictions with different data protection laws.

We will only transfer personal information across borders where:

the destination provides adequate protection;
you consent;
the transfer is necessary for a contract with you;
the transfer is necessary for a contract with a third party in your interest;
the transfer benefits you and consent cannot reasonably be obtained; or
another lawful basis applies.

We take reasonable steps to ensure that cross-border transfers are protected by appropriate safeguards and that personal information remains secure.

12. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or interference. We require service providers to apply appropriate security and confidentiality standards.

No system is completely secure. While we cannot guarantee that a security incident will never occur, we regularly review our security and privacy practices and take reasonable steps to prevent and respond to incidents.

13. Your rights

Subject to applicable law and our lawful retention obligations, you may:

request access to personal information we hold about you;
withdraw consent where processing is based on consent;
request correction of inaccurate or outdated personal information;
request restriction of processing, sharing or transfer;
request deletion of personal information;
object to certain processing, including direct marketing;
lodge a complaint with us;
lodge a complaint with the Information Regulator if you are not satisfied with how we handle your complaint.

To exercise your rights, contact us using the details below. We may need to verify your identity before acting on a request.

14. Data retention

We may retain personal information for as long as:

required or permitted by law or contract;
reasonably needed for lawful purposes connected with our functions and activities;
reasonably needed for evidence or dispute resolution;
you have agreed to a longer retention period.

Usage Data is generally retained for shorter periods, unless needed for security, service improvement or legal compliance.

15. Links to other websites

The Service may contain links to third-party websites. We do not control those websites and are not responsible for their content, privacy policies or practices. Review the privacy policy of any third-party site you visit.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page and update the “Last updated” date. Where changes are material, we may notify you by email or through the Service. Please review this Policy periodically.

17. General

If any provision of this Policy is found to be illegal, void or unenforceable, that provision will be treated as severed and the remaining provisions will continue in full force.

If we do not enforce a right under this Policy, that does not mean we waive that right.

18. Governing law

This Policy is governed by the laws of South Africa. Any dispute or claim arising from this Policy is subject to South African law.

19. Contact details

For questions, requests or complaints about personal information or this Policy, contact:

in2books Accounting
76 Beach Road
Strand, 7140
Cape Town
South Africa

Email: legal@in2books.co.za
Phone: +27 78 066 9126

You may also complain to the Information Regulator South Africa if you are not satisfied with how we handle your personal information.