Privacy policy

1. Who we are

Oh8 Digital (Pty) Ltd ("we", "us") runs Crooh, a field service management platform. This policy explains what personal information we collect, why, who we share it with and what rights you have under the Protection of Personal Information Act 4 of 2013 (POPIA).

We play two different roles under POPIA:

• Responsible party for information about our own customers and their staff who use Crooh (account holders, technicians, drivers), website visitors and people who contact us or ask for a demo.
• Operator for information our customers put into Crooh about their own clients, such as client names, site addresses, delivery recipients and signatures. Our customer decides why and how that information is processed, and we process it only on their instructions. If you are one of their clients, contact that business first. We will help them answer your request.

2. Information we collect

• Account information: name, email address, phone number, organisation and role
• Work records: job cards, time entries, notes, photos, inspections, stock movements and invoices
• Client and delivery records: client contact details, site addresses, delivery recipients and signatures captured on delivery
• Location: a driver's current position while the mobile app shares it. We keep only the latest position, not a history of movements
• Billing: subscription and payment status. Card details go directly to Paystack and we never see or store them
• Technical information: IP address, browser and device type, and server logs
• Enquiries: what you send us through demo requests, market research forms and email

3. Why we use it and our legal basis

• To provide Crooh (accounts, job cards, deliveries, invoices, notifications): necessary to perform our contract with your organisation (section 11(1)(b))
• To send service emails such as verification, password resets, job completions, delivery updates and subscription notices: necessary for the contract
• To keep Crooh secure and prevent fraud: our legitimate interest (section 11(1)(f))
• To keep financial and tax records: required by law (section 11(1)(c))
• To answer demo requests and enquiries: you asked us to
• To measure website use with Google Analytics and to send marketing emails: only with your consent, which you can withdraw at any time

Using Crooh does not on its own count as consent to anything beyond what is needed to provide it.

4. Marketing

We only send marketing emails to people who opted in, or to existing customers about similar Crooh services. Every marketing email has an unsubscribe link, and unsubscribing takes effect immediately. Service emails about your account, jobs or deliveries are not marketing and do not have an unsubscribe link.

5. Who we share it with

We do not sell personal information. We share it only with the service providers below, who process it for us under contracts that require them to keep it secure and confidential, and with authorities when the law requires it.

Inside Crooh, your organisation's administrators can see the records your organisation holds. Delivery recipients can see their own delivery through a tracking link, which shows the driver's position only while that delivery is on its way.

6. Transfers outside South Africa

Most of the providers above store or process information outside South Africa, mainly in the United States. Under section 72 of POPIA we only transfer information where the recipient is bound by a contract or law that gives protection substantially similar to POPIA, or where the transfer is needed to perform our contract with you. Google Analytics data only leaves South Africa if you allow analytics cookies.

7. How long we keep it

• Account information: while the account is active. When an account closes or a deletion request is completed, we remove the login and anonymise the person's details
• Job cards, invoices and deliveries: 7 years, to meet the Companies Act and SARS requirements. If a person asks for deletion, we anonymise their details in these records rather than delete the records
• Driver location: only the latest position is stored, and each update overwrites the last
• Demo requests and enquiries: up to 2 years after our last contact
• Marketing list: until you unsubscribe
• Google Analytics: according to the retention period set in Google Analytics, at most 14 months

8. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Access inside Crooh is limited by organisation and role, and every server function checks who is calling it. If a breach affects your information, we will tell the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. Where we act as operator, we tell the affected customer immediately so they can notify their clients.

9. Your rights

You may:

• ask whether we hold information about you and get a copy of it
• ask us to correct or delete it
• object to processing based on our legitimate interest
• withdraw consent and unsubscribe from marketing at any time
• complain to the Information Regulator

Email info@crooh.co.za with the subject "POPIA request". Organisation administrators can also export their data and submit deletion requests from Settings, then Privacy. We acknowledge requests within 5 business days and answer within 30 days.

10. Cookies

We use cookies that are needed to sign you in and keep Crooh working. Google Analytics cookies are only set if you choose "Allow analytics" in the cookie banner. Vercel Analytics counts page views without cookies.

11. Children

Crooh is a business tool and is not meant for anyone under 18. If we learn we hold information about a child, we delete it.

12. Changes to this policy

When we make a material change, we update the date above and email account holders before it takes effect.