Skip to content
Legal

Privacy Policy

Effective 1 May 2026

This Privacy Policy describes how UTD Holdings (Pty) Ltd ("Veymo Pay", "we", "us", "our") collects, uses, shares and protects personal information ("Personal Information") in connection with the website at veymopay.com(the "Site") and any related marketing communications. We process Personal Information in accordance with the Protection of Personal Information Act, 2013 (Act 4 of 2013) ("POPIA").

1. Information Officer

The Information Officer for Veymo Pay is the Chief Executive Officer of UTD Holdings (Pty) Ltd. Privacy queries and data-subject requests should be directed to privacy@veymopay.com.

2. What we collect

We collect only the Personal Information you provide and the minimum technical data needed to operate the Site:

  • Contact form submissions: full name, organisation, work email, role/title, sector, approximate disbursement volume, audit window, and any free-text notes you choose to share.
  • Server logs: IP address, browser user-agent and request timestamps, retained for 30 days for security and abuse-detection only.
  • Aggregate analytics: we use Plausible Analytics, a privacy-first analytics service that does not use cookies and does not collect personally identifiable information.

We do not use third-party advertising trackers, social pixels, or cross-site tracking technologies.

3. Why we process Personal Information

  • To respond to enquiries and arrange the 90-minute audits requested through the Site.
  • To send transactional acknowledgements after you submit the contact form.
  • To protect the Site against fraud, abuse and unauthorised access.
  • To comply with our legal obligations (including under the Financial Intelligence Centre Act and POPIA itself).

4. Lawful basis

We process your Personal Information under one or more of the following grounds set out in section 11 of POPIA: the Personal Information is necessary for steps taken at your request before entering into a contract; processing is necessary to pursue our legitimate business interests; or you have provided your consent on the contact form.

5. Who we share with

We share Personal Information only with the following categories of operator, each under a written processing agreement:

  • Resend (or equivalent transactional email provider) - to send acknowledgements and route messages to our team.
  • Cloudflare - for content delivery, DDoS protection and bot mitigation (Turnstile).
  • Vercel - for application hosting and edge runtime.
  • Upstash - for rate-limit counters; we store hashed IPs only, no Personal Information.

We do not sell, rent, or trade your Personal Information. We do not transfer Personal Information across borders beyond what is operationally necessary to deliver the email and hosting services above; where transfers occur, they are governed by standard contractual safeguards that meet POPIA section 72 requirements.

6. Retention

  • Contact form submissions: retained for a maximum of 24 months, then auto-purged.
  • Server logs: 30 days.
  • Aggregate analytics: indefinitely, in non-identifiable form only.

7. Your rights under POPIA

You have the right to:

  • Access the Personal Information we hold about you.
  • Request correction or deletion of inaccurate Personal Information.
  • Object to processing on legitimate grounds.
  • Withdraw consent at any time without affecting prior lawful processing.
  • Lodge a complaint with the Information Regulator (Republic of South Africa): inforegulator.org.za.

To exercise any of these rights, contact privacy@veymopay.com. We respond to verified requests within 30 days.

8. Security

We apply appropriate technical and organisational measures to protect Personal Information against unauthorised access, accidental loss and unlawful processing. The Site is served over HTTPS only; secrets and credentials are stored in encrypted secrets stores; contact form submissions are protected by multi-layer bot mitigation (honeypot, time-to-submit, Cloudflare Turnstile, rate-limit and server-side sanitisation).

9. Children

The Site is intended for senior decision-makers at South African organisations. We do not knowingly collect Personal Information from children under the age of 18.

10. Changes

We update this Privacy Policy when our practices change. The "Effective" date at the top reflects the latest version. We will notify you of material changes by updating the Site and, where appropriate, by email.

UTD Holdings (Pty) Ltd · Republic of South Africa
Information Officer queries: privacy@veymopay.com