Privacy Policy

1. Who is responsible for your information

Book A Tradie is operated by Book A Tradie (Pty) Ltd (registration number 2022/762404/07), a company registered in South Africa, of 13 Lionel Road, Walmer Downs, Gqeberha, Eastern Cape, 6070 ("we", "us", "our"). We are the responsible party for your personal information as that term is used in the Protection of Personal Information Act 4 of 2013 ("POPIA").

Information Officer: Jason Egerton
Email: info@bookatradie.co.za

2. What we collect, and why

Bank and card details

We only ask for bank details from a Tradesperson who chooses to be paid through the app: we keep the bank's name, the last 4 digits of the account number and the account holder's name, and the full number, with the account holder's ID or company registration number, is sent to our payment provider (Paystack) and your bank to check the account — we do not store them. Card and subscription payments are handled by our payment providers (see section 6) — we never see or store your full card number.

What we do not collect

We do not collect information about your race, religion, health, political opinions, sex life or trade-union membership, and you should not send us any.

3. Who your information is shared with

We share only what the job requires, and only when it is needed:

• With tradespeople: when you post a job, verified, subscribed tradespeople who work in that trade (for trades that legally need a certificate, only those whose certificate we have approved) can see the job description and the photographs, and those whose service area covers your property are shown the job with the city and an approximate location (to about 1 km). When a tradesperson takes your job to quote on it, they can also see your name, the exact address and map pin, your phone number and your email address, and you can message each other. Nothing is released between two people who have blocked each other.
• With clients: a tradesperson's business name, profile photograph, trade, accredited trades, ratings, reviews and work photographs are visible to clients. Once a tradesperson takes your job, you can also see their phone number and email address.
• With our service providers, who process information on our behalf under written agreements: Supabase (database and file hosting), Render (website hosting), Paystack (subscription payments, and payments to tradespeople made through the Platform), RevenueCat (subscription payments), Resend (sending our notification and account emails), and Expo (mobile app delivery and push notification delivery), Didit (automated identity verification — they receive the photograph of your identity document and the selfie taken during that check, and return the result to us), Google (the address you type into an address search in the app is sent to Google Places to suggest matches; the website loads its fonts from Google Fonts), Komoot's Photon service (the app's address search, when Google finds nothing), OpenStreetMap (map images, and address search on the website; your device asks their servers for the area being shown) and unpkg (it delivers the map software, so it sees your device's internet address).
• In a card dispute: with Paystack, the banks involved, our attorneys and registered debt collectors, and in the case of a dishonest dispute the police and the South African Banking Risk Information Centre, as set out in section 6.
• With regulators, professional bodies or law enforcement, where we are required to by law, or where it is necessary to investigate fraud, a safety incident or a serious dispute.

We do not sell your personal information, and we do not share it with advertisers.

4. Where your information is stored, and transfers outside South Africa

Section 72 of POPIA permits this transfer because Germany is subject to the European Union's General Data Protection Regulation, which upholds principles for the lawful processing of personal information that are substantially similar to POPIA's, and includes comparable provisions on onward transfer. The transfer is also necessary for the performance of our contract with you. Our hosting agreements require the provider to protect the information and to process it only on our instructions.

Our other providers are also outside South Africa. The service providers listed in section 3 — including those that send our email, deliver our mobile app, take subscription payments and run the automated identity check — process information on servers outside the Republic. Where a provider is in a country whose law upholds principles substantially similar to POPIA, section 72(1)(a) permits the transfer on that basis. Where it is not, we rely on the written agreement we hold with that provider, which binds it to protect the information and to process it only on our instructions, and on the fact that the transfer is necessary to perform our contract with you under section 72(1)(b). For the identity check specifically, we also rely on your express consent, as described in section 5.

If you would prefer your information not to be processed outside South Africa, we regrettably cannot provide the service to you, and you should not create an account.

5. Identity verification, and the biometric check

Before you can post a job or receive leads, we confirm that you are who you say you are. This is not administrative box-ticking: a tradesperson goes alone into a stranger's home, and a client lets a stranger into theirs. If something goes wrong, a verified identity is what gives either of you recourse.

You give us your full name and South African ID number, and you complete an automated check run by Didit. That check involves photographing your identity document and taking a selfie. The selfie is compared against the photograph on the document to confirm the document belongs to you, and a liveness check confirms a real person is present rather than a photograph of a photograph.

That comparison is biometric processing. Under section 26 of POPIA, biometric information is special personal information, which we may process only where an exception in section 27 applies. We rely on your express consent, which you give by choosing to start the check. You do not have to consent, and you are not required to use the automated route — you may instead upload your documents for a member of our staff to review by hand. If you do not wish to verify your identity at all, you can still browse the app, but you will not be able to post a job or receive leads.

Didit processes this information on our behalf under a written agreement, and returns to us the outcome of the check and the name and ID number printed on the document. We do not use your face for any other purpose. We do not use it to identify you elsewhere in the app, we do not use it for advertising or profiling, and we do not sell it or share it with anyone other than as described in section 3.

You may withdraw your consent at any time by emailing info@bookatradie.co.za. Withdrawing consent does not affect processing that already took place, and it may mean we can no longer keep your account verified.

If the name printed on your identity document does not match the name you gave us, the automated check does not verify you. Instead, a member of our staff reviews it by hand.

For tradespeople, the automated check confirms your identity only. Your public liability insurance and any trade certificates or registrations are reviewed by our staff, and your account is shown as verified only once your identity is confirmed and your insurance has been approved.

6. Payments

Tradesperson subscriptions are billed through Paystack (on the website) and through RevenueCat with your app store (in the mobile apps). These providers collect your payment details directly and are responsible for them. We receive only a record that a payment succeeded or failed, and the period it covers.

Paying or being paid through the Platform (see our Payment Terms):

• Paystack processes the card payment and pays the Tradesperson out. For a payout account we keep only what section 2 describes.
• We keep payment records, including who paid whom, how much and when, for at least 5 years as tax and financial laws require, even if an account is deleted. With each card payment we keep the payer's verified name, ID number and login email at the time of payment, so that we can answer a card dispute and recover money owed even if the account is later closed.
• When a Client confirms work is done, we record the date, time and device used.
• We keep a copy of the job behind each payment (its details and location, photos, and the quotes and messages between the client and the tradesperson who was paid) for 5 years, even after an account is deleted (see section 7).
• If a Client disputes a card payment with their bank, we may give Paystack and the banks involved the quote, the messages between the Client and the Tradesperson, the job photos, the Client's confirmation (with its date, time and device) and the payment record for that job. If the Client owes us money because of the dispute, we may give the same information, and the Client's name and contact details, to our attorneys and to a registered debt collector, to recover it.
• If we believe a card dispute was made dishonestly, we will give that information to the South African Police Service, the bank and the South African Banking Risk Information Centre (SABRIC). If a court gives judgment against a Client for a debt to us, that judgment may be recorded with credit bureaus.
• If an account is suspended for an unpaid card dispute, we keep the account holder's verified name and ID number to stop them opening a new account while the debt is unpaid, and for as long as the law allows us to keep records of the debt.

7. How long we keep it

• Your account, profile, contact details, properties, service area, identity and accreditation records, uploaded documents and photos, notifications and settings: for as long as your account is open. They are deleted when you delete your account.
• Chats: a chat is deleted when you or the other person deletes their account (but see paid jobs, below).
• Jobs, quotes and reviews: when you delete your account, the jobs you posted are deleted with their quotes, photos and reviews, and so are the quotes you sent and the reviews about you. A review you wrote on someone else's job stays on their profile, shown as from a deleted account.
• Jobs paid through the Platform: if money was paid through the Platform for a job, we keep a copy of that job (its details and location, its photos, and the quotes and messages between the client and the tradesperson who was paid) for 5 years, even if you or the other person deletes their account, so that we can answer a dispute or a card chargeback and keep the records the law requires. The photos are moved to private storage. Only our support and administration staff can see any of it.
• Invoices and payment records, including the payer details kept with each card payment (section 6): for at least 5 years, as the Companies Act and tax legislation require, even if you delete your account.
• Records of which version of our terms you accepted: while your account is open, and for 5 years after it is closed, as evidence of what you agreed to.
• An account suspended for an unpaid card dispute: the verified name and ID number, while the debt is unpaid and for as long as the law allows us to keep records of the debt.
• Error reports: 90 days, after which they are deleted automatically.
• Internal record checks: we run automatic checks on our records to find mistakes (for example, a job booked twice). The results may include a short extract such as your name and the problem found, and are kept for up to 180 days.

When a period ends, we delete the information or de-identify it so it can no longer be linked to you.

You cannot delete your account while money is held for you, owed to you or owed by you through the Platform, or while a job is in progress. The app and the website tell you what needs to be settled first. Earnings smaller than the payout fee plus R1 cannot be paid out, and are given up if you delete your account.

8. Your rights under POPIA

You have the right to:

• ask what personal information we hold about you, and be given a copy of it;
• ask us to correct or update information that is wrong or incomplete;
• ask us to delete information we no longer have a lawful reason to keep;
• object to processing that we carry out on the ground of legitimate interest;
• withdraw a consent you gave us, at any time (this does not affect anything done before you withdrew it);
• not receive direct marketing by electronic means unless you agreed to it, and to opt out at any time; and
• complain to the Information Regulator.

To exercise any of these, email info@bookatradie.co.za. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not hand your information to someone else. Requests for access to records are dealt with under our PAIA manual (bookatradie.co.za/paia).

What we cannot delete: if you have paid or been paid through the Platform, we must keep the payment records, and the record of the job they were for, for the periods in section 7. We will close your account and remove your profile from public view, but those records remain.

9. How we protect your information

• All traffic between your device and our servers is encrypted (HTTPS/TLS), and information is encrypted at rest.
• Access to your records is enforced at the database level, so one user cannot read another user's properties, contact details, jobs or messages. Photos added to a job, a chat or a profile are stored so that anyone with the photo's link can open it; we only show those links to people who can see the job, chat or profile.
• Exact addresses and contact details are released only to a tradesperson who takes the job, and never between people who have blocked each other.
• Identity and accreditation documents are stored in restricted storage that ordinary users cannot browse, and are visible only to staff carrying out verification.
• Administrative access is limited to staff who need it, and is protected by multi-factor authentication.

No system is perfectly secure. If a breach occurs that creates a real risk of harm to you, we will notify you and the Information Regulator as soon as reasonably possible, as section 22 of POPIA requires.

10. Children

Book A Tradie is not for children. You must be 18 or older to create an account. We do not knowingly collect information about anyone under 18, and if we learn that we have, we will delete it.

11. Cookies and similar technologies

We use only the storage that is strictly necessary to keep you signed in and to remember your preferences on your own device. We do not use advertising cookies and we do not track you across other websites.

12. Changes to this policy

If we change this policy in a way that materially affects you, we will tell you in the app or by email before the change takes effect. The "last updated" date above always reflects the current version, and we keep a record of which version you accepted.

13. How to complain

Please raise it with us first at info@bookatradie.co.za — most issues are quickly resolved. If you are not satisfied, you may complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za