Privacy Policy

In terms of POPIA, the Responsible Party for the processing of your personal information is:

Information Officer

The Information Officer is responsible for encouraging compliance with POPIA, dealing with requests made to the Responsible Party, and working with the Information Regulator in relation to investigations.

This policy applies to tradejournal.co.za and all other websites, applications, and digital services operated by Tapnet Solutions (Pty) Ltd.

By accessing or using our services, you acknowledge that you have read, understood, and agree to the collection and processing of your personal information as described in this policy.

We collect and process the following categories of personal information, as defined in Section 1 of POPIA:

3.1 Account Data

• Full name
• Email address
• Phone number (optional)
• Account credentials (passwords are hashed and never stored in plain text)

3.2 Trading Journal Data

• Journal entries (trade details, notes, observations)
• Trade screenshots and attachments
• Custom tags, categories, and labels
• Trading performance metrics

3.3 Subscription and Payment Data

• Subscription plan and status
• Payment history and billing records
• Note: Full payment card details are processed by our payment provider and are never stored on our servers

3.4 Tool Usage and Disclaimer Acceptance Data

• Disclaimer acceptance records (including timestamp)
• IP address at time of acceptance
• User agent (browser and device information)
• Timezone
• Browser language
• Referrer URL

This data is collected to maintain a verifiable legal record of your acceptance of tool disclaimers.

3.5 Automatically Collected Data

• IP address
• Browser type and version
• Device type and operating system
• Usage patterns (pages visited, features used, session duration)
• Referring website

3.6 Communication Data

• Contact form submissions (name, email, message content)
• Support correspondence

In accordance with POPIA Section 13 (purpose specification), we process your personal information for the following specific, explicitly defined, and lawful purposes:

We will not process your personal information for any purpose incompatible with those listed above, unless required by law or with your explicit consent.

In terms of POPIA Section 11, we process your personal information on one or more of the following legal grounds:

5.1 Consent (Section 11(1)(a))

You have given us your voluntary, specific, and informed consent to process your personal information for one or more specific purposes. You provide this consent when you register an account, accept our terms, or opt in to optional features. You may withdraw your consent at any time, although this may affect your ability to use certain services.

5.2 Contractual Necessity (Section 11(1)(b))

Processing is necessary to fulfil our contractual obligations to you — specifically, to provide the trading journal service, manage your account, and process your subscription. Without this processing, we would be unable to deliver the services you have signed up for.

5.3 Legal Obligation (Section 11(1)(c))

Processing is necessary to comply with a legal obligation to which we are subject. This includes financial record-keeping requirements under the South African Income Tax Act (No. 58 of 1962), the Companies Act (No. 71 of 2008), and other applicable legislation.

5.4 Legitimate Interest (Section 11(1)(f))

Processing is necessary for the purposes of our legitimate interests or those of a third party, provided that your rights and freedoms do not override those interests. Our legitimate interests include maintaining platform security, preventing fraud, improving our services, and maintaining verifiable records of disclaimer acceptances.

In terms of POPIA Section 1, an Operator is a person who processes personal information on behalf of the Responsible Party. We use the following third-party operators to deliver our services:

In accordance with POPIA Section 21, we have written agreements with each operator ensuring that they process personal information only on our instructions and that they implement appropriate security measures.

In terms of POPIA Section 72, personal information may only be transferred outside of the Republic of South Africa under specific conditions. We transfer personal information to the following jurisdictions:

7.1 Frankfurt, Germany (European Union)

Our database provider (Neon) and hosting provider (Vercel) are hosted in Frankfurt, Germany. The European Union provides an adequate level of protection for personal information through the General Data Protection Regulation (GDPR), which is recognised as meeting the requirements of POPIA Section 72(1)(a).

7.2 United States

Our economic calendar data provider (RapidAPI / OHLC.dev) is located in the United States. However, no personal data is transferred to this provider. The service is used solely to fetch publicly available economic event data for display in our economic calendar tool.

Legal Basis for Cross-Border Transfers

Our cross-border transfers are lawful under POPIA Section 72 on the following grounds:

• Adequate level of protection (Section 72(1)(a)): The EU, through the GDPR, provides an adequate level of data protection comparable to POPIA.
• Binding agreements (Section 72(1)(b)): We have entered into binding contractual agreements (Data Processing Agreements / Addendums) with our operators that impose obligations equivalent to POPIA's conditions for lawful processing.
• Consent (Section 72(1)(c)): At registration, you consent to the transfer of your personal information to our service providers as described in this policy.

In accordance with POPIA Section 14 (retention limitation), we retain personal information only for as long as is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by law.

Upon expiration of the applicable retention period, personal information will be securely deleted or de-identified so that it can no longer be associated with you.

Under POPIA Sections 23 to 25, you have the following rights regarding your personal information:

• Right of Access (Section 23): You have the right to request confirmation of whether we hold personal information about you, and to request access to that information. We will respond to your request within 30 days.
• Right to Correction (Section 24): You have the right to request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
• Right to Deletion (Section 24): You have the right to request the deletion of your personal information where it is no longer necessary for the purpose for which it was collected, or where you withdraw your consent. Please note that certain information may need to be retained to comply with legal obligations (see Section 8 above).
• Right to Object (Section 11(3)(a)): You have the right to object to the processing of your personal information on reasonable grounds relating to your particular situation, unless legislation provides for such processing.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to Complain to the Information Regulator (Section 74): If you believe that your personal information has been processed in violation of POPIA, you have the right to lodge a complaint with the Information Regulator (see Section 15 below).

To exercise any of these rights, please contact our Information Officer at wynand@tapnet.co.za. We will verify your identity before processing your request and respond within 30 days.

Our website uses cookies and similar technologies to provide and improve our services. We categorise cookies as follows:

10.1 Essential Cookies (Always Active)

These cookies are strictly necessary for the operation of our website and cannot be disabled:

• Authentication session cookies: Required to keep you logged in and maintain your session securely.
• Consent preference cookies: Required to remember your cookie consent choices.

10.2 Optional Cookies (Consent Required)

These cookies are only set with your explicit consent:

• Analytics cookies: Used to understand how visitors interact with our website, helping us improve the user experience. These are only activated if you consent via our cookie consent banner.

You can manage your cookie preferences at any time through the cookie consent banner on our website, or through your browser settings. For more detail, please see our Cookie Policy.

Our services are not directed at, nor intended for, children under the age of 18. We do not knowingly collect personal information from children under 18.

In terms of POPIA Section 35, we will not process the personal information of a child unless it is done with the prior consent of a competent person (parent or guardian) and the processing is in the child's best interest.

If we discover that we have inadvertently collected personal information from a child under 18 without appropriate consent, we will take immediate steps to delete that information. If you believe that a child under 18 has provided us with personal information, please contact us at wynand@tapnet.co.za.

In terms of POPIA Section 69, we will only send you direct marketing communications if you have given us your explicit opt-in consent to receive such communications.

We will never sell, rent, or share your personal information with third parties for their own marketing purposes.

You may withdraw your consent to receive direct marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your communication preferences in your account settings
• Emailing wynand@tapnet.co.za

Withdrawal of marketing consent will be processed promptly, and in any event within a reasonable time. Please note that you may still receive transactional communications (such as account notifications and service updates) that are necessary for the operation of your account.

In terms of POPIA Section 22, where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorised person, we will:

• Notify the Information Regulator as soon as reasonably possible after the discovery of the breach, providing all relevant details as required by Section 22(3).
• Notify affected data subjects as soon as reasonably possible after the discovery of the breach, unless the identity of the data subjects cannot be established.

The notification will include:

• A description of the possible consequences of the security compromise
• A description of the measures taken or to be taken to address the security compromise
• A recommendation of measures that affected data subjects can take to mitigate the possible adverse effects of the breach

We maintain appropriate technical and organisational security measures to protect personal information against unauthorised access, loss, destruction, or damage, in accordance with POPIA Section 19.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will:

• Update the "Last Updated" date at the top of this policy
• Update the policy version number
• Notify registered users via email of any material changes
• Where required, seek your renewed consent for any significant changes to how we process your personal information

Your continued use of our services after being notified of changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you should discontinue use of our services and contact us to request deletion of your personal information.

If you are not satisfied with how we have handled your personal information, or if you believe we have violated your rights under POPIA, you have the right to lodge a complaint with the Information Regulator:

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal information, please contact our Information Officer:

We will acknowledge receipt of your request within 5 business days and provide a substantive response within 30 days, as required by POPIA.