Last updated
Privacy Policy
About us
ASDF Consulting (Pty) Ltd (trading as "Bill") is a private company registered and operating in accordance with the laws of the Republic of South Africa, and situated at Block 2 Blaauwklip Office Park, Webersvallei Road, Stellenbosch, Western Cape, 7600.
About this privacy policy
The purpose of this policy ("Privacy Policy") is to communicate how we process personal information relating to identifiable natural persons or existing juristic persons ("Personal Information"), and to share certain information required in terms of the Protection of Personal Information Act, 2013 ("POPIA").
This Privacy Policy describes how we process Personal Information in connection with our legal billing automation platform (the "Platform"), which assists legal practitioners (our "Users") in tracking billable time by importing email and calendar metadata and content for client-matter matching, receiving billing instructions via WhatsApp and in-app chat, and generating time entries and invoices. The Platform is accessible via our website at app.bill.co.za. This policy also covers our website and the company operations described below.
We may update this Privacy Policy from time to time by publishing a revised version on https://bill.co.za/privacy-policy, which shall take effect on the date of publication. Please be sure to keep yourself up to date with our latest Privacy Policy.
This Privacy Policy should be read with any agreements, terms, policies and the like published by us in relation to the Platform. To the extent that any other binding document may conflict with our Privacy Policy, the former shall prevail.
Should you have any questions about this Privacy Policy or how we process your Personal Information, you are welcome to contact us at privacy@bill.co.za (the "Privacy Mailbox").
The Platform is not intended for use by persons under the age of 18. We do not knowingly collect Personal Information from minors. If you become aware that a person under 18 has submitted Personal Information to us, please notify us at our Privacy Mailbox and we will take steps to delete such information promptly.
The types of Personal Information we process and how we obtain it
We process certain Personal Information as a responsible party in connection with the creation and management of user accounts on the Platform, the rendering of services to Users, the conduct of direct marketing to prospective Users, counting visits to our marketing website, and, with your consent, analytics cookies on our marketing website, as further detailed in Annexure A.
We also process certain Personal Information in our capacity as an operator on behalf of our Users, including Personal Information contained in communications processed through the Platform, such as emails, calendar events, and WhatsApp or in-app chat messages, which may relate to our Users' own clients and other third parties. In doing so, we act on our Users' instructions, and only to the extent necessary to provide the services through the Platform. We do not use this Personal Information for our own purposes, other than to measure how well features of the Platform perform (see section 8 below), and we treat all such information as confidential and subject to appropriate security safeguards, as further described under section 7 below.
Where you choose to connect an email inbox or a calendar to the Platform, we will request your authorisation to access that account. Once connected, the Platform will have ongoing access to emails and / or calendar events in that account for the purpose of importing and processing email and calendar data to identify billable work, generate suggested time entries, associate items with client matters, and assist you in preparing invoices and billing records. You may revoke this access at any time through your account settings on the Platform or through your email or calendar provider, although doing so will prevent the Platform from processing that data for billing purposes. Where you connect a Google account (Gmail or Google Calendar), the use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The Platform also allows you to record and send voice notes, which are transcribed and processed for the purpose of generating billing records and time entries. This feature requires access to your microphone, which the Platform will request permission to use. We will only access your microphone if you grant such permission, and you may revoke it at any time through your device or browser settings, although doing so will prevent you from using the voice note feature.
For our company operations, we process employees' and contractors' identity, contact, banking, tax and employment information, and suppliers' identity, contact, banking and tax information. We use it to manage those relationships, administer payroll, keep business and accounting records, and comply with legal obligations.
Use of cookies and similar technologies
We may use cookies and similar technologies, such as local storage and session storage in your browser, to keep you signed in, preserve any work in progress (for example, an active timer or a sign-up, payment, or account-connection flow), and help the Platform function correctly. These technologies may collect basic device or usage information which in some cases may constitute Personal Information. We do not use cookies or similar technologies on the Platform for advertising, marketing, or cross-site tracking.
Our marketing website uses Cloudflare Web Analytics, provided by Cloudflare, Inc. in the United States, to count visits and measure how quickly pages load. It does not place cookies on your device. Cloudflare receives your IP address when your browser loads a page, and processes it on our behalf only for those purposes; it does not use it to track or identify you. With your consent, our marketing website also uses analytics cookies, and a marketing cookie that records which of our Google advertisements brought you to it, as described in our Cookie Policy.
We also count some events on our marketing website and sign-up pages ourselves, such as which sign-up button was clicked, to monitor traffic. This sets no cookie and stores nothing that identifies you, but like every request it reaches us with your IP address, which our request logs keep for 30 days.
You can manage or clear cookies and browser storage at any time through your browser settings. Doing so may sign you out of the Platform, lose any work in progress, or otherwise affect how the Platform functions.
Your right to update, correct, or delete your information
You have the right to request access to the Personal Information we hold about you, to ask that any inaccurate, irrelevant, excessive, outdated, incomplete, or misleading Personal Information be corrected or updated, and to request deletion of Personal Information that you believe we are not permitted to retain.
If you wish to exercise any of these rights, please contact us at our Privacy Mailbox. For a formal request for access to a record, follow the procedure in our PAIA manual.
To delete your User Account and request erasure of your associated Personal Information, you may use the account deletion function within the Platform, or submit a written request to our Privacy Mailbox. We will action your request within 30 days of receipt, subject to any retention obligations imposed by applicable law.
Your right to object to the processing of your Personal Information
You have the right to object to the processing of your Personal Information where such processing is based on our legitimate interests, your legitimate interests, or those of a third party, and there are reasonable grounds in your particular circumstances which justify the objection.
If you wish to object to the processing of your Personal Information as described under this heading, kindly contact us at our Privacy Mailbox.
We count visits to our marketing website on the basis of our legitimate interest. Because we hold nothing that identifies you as a visitor, we cannot stop that processing for you alone; you can stop it by using a browser setting or extension that blocks scripts from static.cloudflareinsights.com.
Storage and security of your Personal Information
We implement technical and organisational measures, in compliance with the requirements of applicable law, to ensure that the Personal Information in our possession remains confidential and secure against unauthorised or unlawful processing, and against accidental loss, destruction, or damage. For the Platform, these measures include:
encrypting Personal Information during transmission over public networks, and encrypting Personal Information at rest at the storage layer;
implementing strict authentication controls and access restrictions, limiting access to Personal Information to authorised personnel and systems on a least-privilege basis;
the use of reputable third-party hosting and infrastructure providers who implement industry-standard security controls;
automated daily backups, with point-in-time recovery capability, to prevent data loss;
logging and monitoring of system activity to detect and respond to security events; and
subjecting personnel with access to Personal Information or production systems to contractual confidentiality obligations.
You acknowledge and agree however that there are inherent risks to the security of data in the use of electronic services. We accordingly do not guarantee that your Personal Information cannot ever be compromised, and you accept this risk by engaging with us.
We retain Personal Information associated with your User Account for as long as that account exists, whether or not you have an active subscription. Cancelling a subscription is not termination of your User Account and does not start any retention or deletion period. Following termination or deletion of your User Account, we retain Personal Information for a further period of 30 days, after which such information will be deleted or anonymised unless a longer retention period is required by applicable law or necessary for the resolution of disputes. You may download a copy of your Personal Information using the data export function within the Platform at any time while your User Account is active and may further request a copy thereof within 30 days following termination of your User Account by writing to our Privacy Mailbox.
How we share your Personal Information
Subject to compliance with POPIA, we may disclose your Personal Information as requested by you or as strictly necessary, including disclosure to:
cloud hosting and infrastructure providers who support the operation of the Platform, including the storage and processing of account data;
artificial intelligence and machine-learning providers used to provide a chat interface, process billing instructions, generate billing suggestions and measure how well the chat assistant performs;
payment processing services for subscription billing;
banks, payroll services, professional advisers, insurers and regulatory authorities where needed for our company operations or required by law;
web analytics providers for our marketing website: a cookieless visit counter for every visitor, and analytics cookies only where you accept them;
advertising platforms, such as Google Ads, which receive information from our marketing website analytics to measure advertisement performance and use it under their own terms rather than on our behalf;
messaging and communication service providers, including WhatsApp messaging gateway and transactional email delivery services;
accounting platforms that you choose to connect to the Platform (optional and initiated by you);
identity providers that you choose to sign in with, such as Google and Microsoft;
professional advisers, consultants, or auditors who assist us in fulfilling our governance and compliance obligations; and
other third parties where disclosure is required or permitted by law.
Some recipients of Personal Information are located outside of South Africa, and accordingly certain Personal Information provided to us will be transferred outside of South Africa. We will only do so in accordance with the requirements for the lawful transfer of Personal Information outside of South Africa, as set out in section 72 of POPIA.
Direct marketing
We may, with your express consent, send you direct marketing communications about the Bill platform and our services.
We only send direct marketing to prospective Users who have expressly consented under section 69(1)(a) of POPIA. Before sending any marketing material, we first send a consent-request communication that:
asks you to give express consent to receive marketing from us;
describes the services about which we intend to communicate; and
allows you to specify your preferred method of communication.
If you do not respond affirmatively to our consent request, we will not contact you again.
You may withdraw your consent to receive direct marketing at any time by contacting us at our Privacy Mailbox or by following the unsubscribe instructions in any marketing communication you receive. Withdrawal of consent will not affect the lawfulness of any marketing sent prior to withdrawal.
How to contact the Information Regulator
Section 74(1) of POPIA provides that any person may submit a complaint to the Regulator in the prescribed manner and form alleging interference with the protection of the Personal Information of a data subject.
Contact information of the Information Regulator:
| Postal address | Woodmead North Office Park, 54 Maxwell Drive, Sandton, 2191, South Africa |
| Toll-free number | (+27) 80 001 7160 |
| Landline | (+27) 10 023 5200 |
| Email address | enquiries@inforegulator.org.za |
| Website | https://inforegulator.org.za/ |
Annexure A: Categories of Personal Information and processing purposes