Global Privacy Policy
Unified data protection and POPIA compliance framework governing Sputnik Devs Studio (Pty) Ltd and all our software platforms — Shopnik™, Resnik™, Varsnik™, Sputnik Academy, and Custom Engineering.
Last updated: October 2026 · Effective across all Sputnik Devs platforms
Table of Contents
Introduction & POPIA Roles (Responsible Party vs. Operator)
Sputnik Devs Studio (Pty) Ltd ("Sputnik Devs", "we", "us", or "our") is committed to protecting personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and applicable international data protection standards.
Because Sputnik Devs operates both direct-to-client services and multi-tenant B2B/institutional SaaS platforms, our legal role under POPIA depends on the context in which personal information is processed:
We act as the Responsible Party (Data Controller) for personal information collected directly from our own website visitors (sputnikdevs.com), Shopnik™ merchant account holders, Resnik™ residence owners/administrators, Varsnik™ university contracting officers, Sputnik Academy WIL applicants, and custom software clients.
When a merchant uses Shopnik™ to process their shoppers' orders, or when a residence or university uses Resnik™ or Varsnik™ to manage students, leases, FICA documents, and NSFAS allowances, the Merchant, Residence, or University is the Responsible Party and Sputnik Devs acts strictly as their Operator (Data Processor) under written mandate.
Information We Collect Across Platforms
2.1 Account & Commercial Client Information
When you register an account, subscribe to a SaaS plan, or engage us for software services, we collect:
- Personal & Business Identifiers: Full name, email address, phone number, company/institution name, and billing address.
- Platform Configuration Data: Store name, subdomain/custom domain preferences (Shopnik™), or institutional/residence profile and bed capacity (Resnik™ & Varsnik™).
- Authentication Credentials: Passwords stored strictly as salted cryptographic hashes (never in plain text), plus OAuth/SSO tokens where enabled.
2.2 Payment & Billing Information
- Card Transactions via Paystack / PayFast: Processed directly by PCI-DSS Level 1 certified gateways. We store only non-sensitive metadata (last 4 digits, card brand, expiry month/year, and reusable authorisation token) and never store full card numbers or CVVs.
- Institutional Invoicing & EFT: Purchase orders, VAT registration numbers, and remittance references for Resnik™, Varsnik™, and Custom Engineering contracts.
2.3 Technical & Security Telemetry
- IP address, browser user-agent, device type, login timestamps, and role-based audit trail logs required for security monitoring and POPIA accountability.
Product-Specific Privacy Schedules
Shopnik™ Multi-Tenant E-Commerce Platform
- Tenant Isolation: Each Shopnik™ store operates in an isolated database and container environment on Oracle Cloud. Your product catalogue, customer database, and order history are never commingled with other merchants.
- White-Label Domain Broker: When you purchase or register a custom domain (
.co.za,.com,.store,.shop,.org.za) through Shopnik™, your registrant contact details are submitted to the accredited domain registrar strictly to register the domain in your ownership and provision automated SSL certificates. - Hybrid SMS Engine & Courier Fulfillment: Customer mobile numbers and delivery addresses entered at checkout in a merchant's store are used solely to dispatch transactional order SMS notifications and generate courier waybills (e.g., The Courier Guy / PUDO) on the merchant's behalf.
Resnik™ (Student Residence SaaS) & Varsnik™ (University Hub)
- Student & Applicant Records: On behalf of participating residences and universities, Resnik™ and Varsnik™ process student names, student numbers, SA ID/passport numbers, academic faculty/year, room allocations, digital lease agreements, maintenance tickets, catering/meal bookings, and laundry logs.
- FICA & KYC Verification Documents: Supporting documents uploaded by students or landlords (ID copies, proof of registration, NSFAS funding letters, lease addenda) are stored in encrypted object storage with strict role-based access control (RBAC) limited to authorised residence/university officers.
- Resnik™ ↔ Varsnik™ Ecosystem Bridge: Where a private residence using Resnik™ is accredited by a university using Varsnik™, occupancy, SLA turnaround metrics, and student placement statuses are synchronised over encrypted channels strictly as authorised by the institution and residence operator.
- Built-In AI Assistants: AI agents within Resnik™ and Varsnik™ assist authorised staff and students with operational queries, maintenance triage, and allocation insights using tenant-scoped context. Student personal data is never used to train public foundation models.
Sputnik Academy (WIL) & Custom Software / AI Engineering
- Sputnik Academy (Work-Integrated Learning): For students and partner universities participating in our WIL programme, we process academic transcripts, CVs, Git/sprint assessment metrics, and logbook evaluations to report practical competency outcomes back to the student's university department.
- Custom Software & AI Projects: All client source code, proprietary datasets, and project documentation shared with Sputnik Devs during custom engineering engagements are governed by strict confidentiality and non-disclosure obligations.
How We Use Your Information & Legal Basis Under POPIA
In accordance with Section 11 of POPIA, we only process personal information where a lawful justification exists:
| Purpose of Processing | Data Categories | POPIA Legal Basis |
|---|---|---|
| Provisioning and operating your Shopnik™, Resnik™, or Varsnik™ environment | Account, tenant config, domain & user roles | Contractual performance — s11(1)(b) |
| Processing recurring subscriptions, SMS bundles, and institutional invoices | Billing details, payment tokens, VAT/invoice records | Contractual performance — s11(1)(b) & Legal obligation — s11(1)(c) |
| Processing student housing, digital leases, FICA verification & NSFAS reconciliation | Student records, ID/FICA uploads, lease & allowance logs | Operator mandate on behalf of Responsible Party — ss20–21 |
| Transactional notifications (order alerts, grace period warnings, SLA alerts) | Email address, mobile number, account status | Contractual performance & legitimate interest — s11(1)(b), (f) |
| Infrastructure security, intrusion prevention, and audit logging | IP address, session logs, authentication events | Legitimate interest & Section 19 security safeguards |
Payment Data & PCI-DSS Security
PCI-DSS Level 1 Payment Processing
All online card payments across Sputnik Devs and Shopnik™ are processed through Paystack (a Stripe company) and/or PayFast, both certified PCI-DSS Level 1 service providers. Your full card number, CVV, and PIN never touch Sputnik Devs servers.
- Tokenised Recurring Billing: When you subscribe to a recurring plan, Paystack generates an encrypted authorisation token that allows automated monthly or annual renewals and one-click card updates without exposing raw card data.
- Zero Checkout Commission on Shopnik™: For Shopnik™ merchants, customer payments flow directly through the merchant's configured payment gateway (PayFast, Paystack, or Cash on Delivery/In-Store Collection) with 0% platform commission from Sputnik Devs.
Cloud Infrastructure, Isolation & Security Controls
In compliance with Section 19 of POPIA, we implement rigorous technical and organisational security measures across all platforms:
- Enterprise Cloud Hosting: Our SaaS platforms (Shopnik™, Resnik™, and Varsnik™) are deployed on enterprise Oracle Cloud infrastructure in South Africa (with additional international deployment options where requested by the client), ensuring low-latency local data residency.
- Encryption in Transit & at Rest: All web traffic, API calls, and inter-portal webhooks are encrypted via HTTPS/TLS 1.2+ with automated SSL certificates. Databases and document storage volumes are encrypted at rest.
- Strict Multi-Tenant Isolation: Each Shopnik™ merchant store and each Resnik™/Varsnik™ institutional deployment enforces logical and/or container-level isolation so no tenant can access another tenant's records.
- Role-Based Access Control (RBAC) & Audit Trails: Administrative actions, FICA document reviews, and student allocation changes are logged with user identity and timestamp.
Security Incident Notification (Section 22 of POPIA): In the event of any unauthorised access or data breach affecting personal information, Sputnik Devs will notify the affected Responsible Party / data subjects and the Information Regulator (South Africa) as soon as reasonably possible.
Third-Party Sub-Processors & Cross-Border Transfers
We do not sell, rent, or trade personal information to any third party. We only share limited data with vetted infrastructure sub-processors necessary to deliver our services:
| Service Category | Purpose | Safeguards |
|---|---|---|
| Oracle Cloud & DigitalOcean | Cloud compute, isolated databases, and encrypted object storage | ISO 27001 / SOC 2 certified data centres |
| Paystack & PayFast | Subscription billing and merchant checkout payment processing | PCI-DSS Level 1 certified |
| Domain Registrars & Let's Encrypt | Custom domain registration and automated SSL/TLS provisioning | ICANN / ZACR registry standards |
| Transactional Email & SMS Gateways | Order confirmations, OTPs, billing alerts, and residence notifications | Encrypted TLS/HTTPS API transmission |
| Courier APIs (PUDO / The Courier Guy) | Automated shipping quotes, waybills, and parcel tracking for Shopnik™ | Scoped strictly to shipping fulfilment |
Cross-Border Data Transfers (Section 72 of POPIA): Where a client selects an international server region or where a sub-processor processes data outside South Africa, transfers occur strictly subject to Section 72(1) of POPIA (adequate statutory protection or binding corporate/contractual safeguards).
Data Retention & Deletion Schedules
- Shopnik™ Subscriptions (37-Day Lifecycle): While your subscription is active (and during the 7-day payment grace period), your store and all data remain live. If a subscription is suspended after Day 7 or voluntarily cancelled at the end of a billing cycle, all store data is preserved in a secure 30-day retention window for one-click reactivation. On Day 37 after an unresolved payment failure (or 30 days after voluntary cancellation), your store container, database, and uploaded files are permanently and irreversibly deleted.
- Resnik™ & Varsnik™ Institutional Deployments: Student housing, lease, FICA, and financial reconciliation records are retained for the duration of the residence or university's active agreement. Upon contract termination, the institution is provided a 30-day data export window (CSV/JSON/PDF archive) before tenant environments are decommissioned, unless longer statutory retention is mandated.
- Financial & Tax Records: Statutory invoices and payment ledger entries are retained for 5 years as required by the South African Revenue Service (SARS) Tax Administration Act.
Your Rights Under POPIA
Under the Protection of Personal Information Act (POPIA), you have the right to:
Request confirmation of whether we hold your personal information and request a copy of that record.
Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, or outdated.
Object on reasonable grounds to the processing of your personal information or withdraw prior consent.
Export your store catalogue, orders, or student residence records in standard machine-readable formats.
Note for End-Users of Shopnik™ Stores or Resnik™/Varsnik™ Institutions: If you are a shopper on a Shopnik™ merchant store or a student at a Resnik™/Varsnik™ institution, please direct requests regarding your order or student record primarily to that Merchant, Residence, or University (the Responsible Party), or contact our Information Officer and we will coordinate with the relevant tenant.
Children's & Student Privacy
Commercial SaaS subscriptions on Shopnik™ require the subscriber to be at least 18 years old. Where a minor under 18 is enrolled at a tertiary institution or student residence using Resnik™ or Varsnik™, their accommodation and lease records are processed strictly with the consent of their parent/legal guardian and the contracting educational institution in compliance with Sections 34–35 of POPIA.
Designated Information Officer & Regulator Contact
If you have questions about this Global Privacy Policy or wish to exercise your POPIA rights, please contact our designated Information Officer:
Designated Information Officer (POPIA Section 55)
Kenneth Takudzwa Katsande
Designated Information Officer for Sputnik Devs Studio (Pty) Ltd across all platforms (Shopnik™, Resnik™, Varsnik™, Sputnik Academy, and Custom Engineering).
REGISTERED OFFICE
292 Surrey Ave, Ferndale, Randburg, Johannesburg, 2194
Information Regulator (South Africa)
You also have the right to lodge a complaint with the Information Regulator if you believe your personal information has been mishandled:
Woodmead North Office Park, 54 Maxwell Dr, Woodmead, Johannesburg, 2191
010 023 5200 · Toll Free: 0800 017 160
Master Terms of Service
Review our complete Master Terms of Service & Product Schedules governing subscriptions, approved annual discounts, SLAs, and platform usage across Shopnik™, Resnik™, and Varsnik™.
Read Master Terms of Service