Privacy Policy

Tradekit is a WhatsApp-native field service management platform operated by Tatlacas (Pty) Ltd ("Tradekit", "we", "us", or "our"). We are committed to protecting your personal information and your right to privacy in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African legislation.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web dashboard, mobile application, API, and related services (collectively, the "Service"). It applies to all users of Tradekit, including business owners, team members, and any person whose information is processed through our platform.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein.

We collect information that you provide directly to us, information generated through your use of the Service, and information from third-party services integrated with our platform.

Account Information

When you create an account, we collect your full name, email address, phone number, and company name. If you register additional team members, we collect their names, email addresses, and phone numbers.

Business Data

As you use the Service, you store business information including customer records (names, addresses, phone numbers, email addresses), job details, quotes, invoices, and related documentation.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, and timestamps. This helps us understand usage patterns and improve the platform.

Payment Information

Subscription payments are processed by PayFast. Invoice payments from your customers are processed by Yoco. We do not store credit card numbers or bank account details on our servers. We receive transaction confirmations, payment amounts, and subscription status from these payment providers.

WhatsApp Data

When you use the WhatsApp integration, we process message content sent and received through the Tradekit platform. This includes text messages, media files, and delivery status information exchanged between your business and your customers via the Meta WhatsApp Business API.

Device and Technical Data

We collect technical information including your IP address, browser type and version, operating system, device type, screen resolution, and referring URLs. On the mobile app, we may collect device identifiers and GPS location data (with your consent) for job check-in/check-out functionality.

In accordance with POPIA's purpose limitation principle, we use your personal information only for the specific purposes outlined below:

• Provide and maintain the Service: To operate the Tradekit platform, including job management, quoting, invoicing, scheduling, and CRM functionality.
• Process payments and manage subscriptions: To handle subscription billing through PayFast and facilitate invoice payments through Yoco on your behalf.
• Send transactional messages: To deliver job updates, invoice notifications, quote requests, and appointment reminders to your customers via WhatsApp on your behalf.
• Improve the platform: To analyse usage patterns, identify issues, and develop new features that better serve South African tradespeople.
• Provide customer support: To respond to your enquiries, troubleshoot problems, and offer assistance with the Service.
• Comply with legal obligations: To meet our obligations under South African law, including tax record-keeping requirements set by SARS and data protection requirements under POPIA.

Under Section 11 of POPIA, we process your personal information based on one or more of the following lawful grounds:

• Consent: You provide consent when you create an account, enable WhatsApp messaging, and agree to this Privacy Policy. You may withdraw consent at any time, though this may affect your ability to use certain features of the Service.
• Contract performance: Processing is necessary to fulfil our contractual obligations to you under the Terms of Service, including providing the Tradekit platform and processing your subscription.
• Legitimate interest: We process certain information to pursue our legitimate business interests, such as improving the platform, preventing fraud, and ensuring the security of the Service. We balance these interests against your rights and ensure our processing does not unduly impact your privacy.
• Legal obligation: We process information where required by South African law, including maintaining financial records for tax purposes as required by SARS and responding to lawful requests from authorities.

We do not sell your personal information. We share your information only in the following limited circumstances:

Third-Party Service Providers

We use trusted third-party services to operate and improve the platform. These providers process your data only on our behalf and in accordance with our instructions:

• Meta (WhatsApp Business API): To send and receive WhatsApp messages on your behalf.
• PayFast: To process subscription payments.
• Yoco: To process invoice card payments from your customers.
• Firebase (Google): For user authentication services.
• Cloud hosting provider: To host the Tradekit platform and store data securely.

Legal Requirements

We may disclose your information if required to do so by law, court order, or regulatory request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, in accordance with POPIA's retention limitation principle:

• Active accounts: Your data is retained for the duration of your subscription and active use of the Service.
• Cancelled accounts: After you cancel your subscription, your data is retained for 90 days to allow for reactivation or data export. After 90 days, your data is permanently deleted from our systems.
• Financial records: Transaction records, invoices, and payment history are retained for 5 years as required by the South African Revenue Service (SARS) for tax compliance purposes.
• Deletion requests: You may request deletion of your personal information at any time (see Your Rights Under POPIA). We will process your request within 30 days, subject to any legal obligations that require us to retain certain records.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction:

• Encryption in transit: All data transmitted between your browser or device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Sensitive data stored in our databases is encrypted at rest.
• Access controls: Access to personal information is restricted to authorised personnel who require it to perform their duties. We use role-based access controls and multi-factor authentication.
• Regular security assessments: We conduct regular security reviews and vulnerability assessments of our infrastructure and application code.
• Incident response: We maintain incident response procedures to detect, investigate, and respond to security breaches promptly. In the event of a breach that affects your personal information, we will notify you and the Information Regulator as required by POPIA.

As a data subject under POPIA, you have the following rights regarding your personal information:

• Right to access: You may request confirmation of whether we hold personal information about you and request a copy of that information.
• Right to correction: You may request that we correct or update any inaccurate or incomplete personal information we hold about you.
• Right to deletion: You may request that we delete your personal information, subject to any legal obligations that require us to retain certain records.
• Right to object: You may object to the processing of your personal information on grounds relating to your particular situation.
• Right to data portability: You may request an export of your data in a structured, commonly used, and machine-readable format.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact our Information Officer at privacy@tradekit.co.za. We will respond to your request within 30 days as required by POPIA.

We use cookies and similar tracking technologies as follows:

• Essential cookies: Required for the Service to function, including authentication tokens, session management, and security features. These cookies cannot be disabled without breaking the Service.
• Analytics cookies: Used to understand how users interact with the Service, identify popular features, and improve the user experience. These cookies are only set with your consent.
• No advertising cookies: We do not use third-party advertising or remarketing cookies. We do not sell your browsing data to advertisers.

The Tradekit Service is designed for trade businesses and is not directed at persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@tradekit.co.za.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by email to the address associated with your account or by displaying a prominent notice within the Service at least 30 days before the changes take effect.

Your continued use of the Service after the updated Privacy Policy becomes effective constitutes your acceptance of the changes. If you do not agree with the revised policy, you should stop using the Service and may request deletion of your account and personal information.

If you have any questions about this Privacy Policy, wish to exercise your rights under POPIA, or have concerns about how we handle your personal information, please contact us:

• Information Officer: privacy@tradekit.co.za
• General enquiries: hello@tradekit.co.za

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator (South Africa):

• Website: https://inforegulator.org.za
• Email: enquiries@inforegulator.org.za
• Phone: 012 406 4818