POPIA Notice

1. Responsible party

DevCraft House (trading as The Trade Kit) is the responsible party for personal information processed through https://thetradekit.co.za.

Information Officer contact: privacy@thetradekit.co.za

For a broader description of our practices, see our Privacy Policy.

2. Purpose of processing

We process personal information for these purposes:

• Registering and authenticating users.
• Providing quote, invoice, customer, and job management functionality.
• Sending emails you request (documents, reminders, verification, team invites).
• Billing and subscription management via PayFast.
• Security, fraud prevention, and service improvement.
• Complying with legal and regulatory obligations.

3. Categories of data subjects

• Registered users (tradespeople and their team members).
• End customers whose details users store in the platform (we process on users' instructions).
• Website visitors (technical and, with consent, analytics data).

4. Categories of personal information

Identity and contact details; account credentials (hashed); business and financial information you choose to store (including bank details on invoices); correspondence; technical usage data; and payment transaction metadata.

5. Lawful grounds

Depending on the processing activity, we rely on:

• Contract — to provide the service you signed up for.
• Consent — e.g. optional analytics cookies, marketing if ever offered.
• Legitimate interest — securing and improving the platform, balanced against your rights.
• Legal obligation — tax, accounting, and law enforcement requests.

6. Your rights as a data subject

Under POPIA you may:

• Request confirmation of whether we hold personal information about you.
• Request access to your personal information.
• Request correction or deletion where appropriate.
• Object to processing based on legitimate interests in certain circumstances.
• Withdraw consent where processing is consent-based (without affecting prior lawful processing).
• Lodge a complaint with the Information Regulator of South Africa.

Submit requests to privacy@thetradekit.co.za. We may need to verify your identity. We will respond within a reasonable period as required by POPIA.

7. Operators and third parties

We use operators (processors) for hosting, email relay, payments, and analytics. Operators may only process personal information according to our instructions and appropriate agreements. A list of categories is in our Privacy Policy.

8. Cross-border transfers

Some operators may store or process data outside South Africa. Where required, we ensure adequate protection through contractual safeguards and POPIA-compliant mechanisms.

9. Security safeguards

We implement reasonable technical and organisational measures including access controls, encryption in transit, and secure development practices. Report suspected breaches to privacy@thetradekit.co.za.

10. Data breaches

If a compromise of personal information is likely to cause harm, we will notify affected data subjects and the Information Regulator as required by POPIA.

11. Retention

We retain personal information only as long as necessary for the purposes above, including legal retention periods for financial records. Users may export or request deletion of account data subject to exceptions.

12. Your customers' data

When you add customer details to The Trade Kit, you are responsible for complying with POPIA as it applies to your business — including having a lawful basis to collect that information and informing your customers. Our POPIA guide for small businesses may help; it is educational and not legal advice.

13. Updates

This notice may be updated. The "Last updated" date at the top of this page reflects the latest version.