How RateMate helps you stay POPIA compliant

POPIA is South Africa's law on how personal information is handled. RateMate does some of the record-keeping for you. This article lists what it does and what it does not do. It is not legal advice, and some duties stay with you: see Your responsibilities.

Consent is recorded when a customer is added

RateMate logs how consent was given for every customer. How it is captured depends on how the customer got onto your list:

• Adding one customer, or adding someone new from the Request button: you tick "I confirm this is my customer and I have a lawful basis to contact them about their service (logged for POPIA)."
• Importing a spreadsheet: you tick "I confirm everyone in this file is my customer and I have a lawful basis to contact them about their service (logged for POPIA)."
• Walk-in link and QR code: customers type their own name and number and tick their own consent box. If they tap Rate on WhatsApp instead, their reply in the chat is the consent.
• Adding a customer over WhatsApp: there is no tick box. When you tap to confirm the send, RateMate records that you, the owner, confirmed consent.

Sending to a customer who is already on your list does not ask again, because their consent is already on record.

Opt-outs are checked again at send time

If a customer is opted out, RateMate sends them nothing. It checks again at the moment a message is due to go, so a request waiting in the queue is stopped if the customer opted out in the meantime. See Opt a customer out or back in.

The audit trail

RateMate keeps an append-only record of what happened to your customers' data: customers added, consent recorded, requests sent, opt-outs, exports and deletions. There is no way in the portal to edit or remove a line. You can read a customer's trail on their page and download it as a CSV. See See a customer's history.

How long data is kept

• Rating links expire 14 days after the request is made. A request nobody answered is then marked No reply · expired. The customer stays on your list.
• Comments customers wrote are cleared 24 months after they were submitted. The score stays. There is no setting for this in the portal, so you cannot shorten or lengthen it yourself.
• Customers, scores and job notes stay until you delete a customer's data or close your account. Even then, scores stay as anonymous scores, and the audit trail stays. Notes you wrote when resolving an alert are cleared with the customer.

Each night RateMate also removes some short-lived data, such as unconfirmed WhatsApp commands.

Erased data can remain in RateMate's backups for up to 90 days, after which those backups are deleted. Copies outside RateMate are not reached by any of this: see Handle a customer's data request.

Analytics and cookies

The pages customers use to rate you, the walk-in page and the app itself do not load RateMate's website analytics. Analytics (Cloudflare Web Analytics, no cookies) loads on RateMate's own public pages and on businesses' public profile pages, if you publish one. RateMate's public pages also set a first-party cookie that lasts 90 days, to learn which marketing works. Both are described in the privacy policy.

What RateMate does not do

RateMate does not check that you really have a lawful reason to contact someone. The tick is your word, and it is on record. It also does not handle requests a customer makes outside RateMate: see Handle a customer's data request.