Privacy policy

TurfOps (Pty) Ltd, registration number [Registration number to be confirmed], of [Registered address to be confirmed], is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the personal information described in this policy.

Our information officer is [Information officer name to be confirmed]. You can reach them at info@turfops.co.za or on [Phone number to be confirmed].

There is one important difference. When a business uses TurfOps to run its operation, the records it keeps about its own staff belong to that business. For those records the business is the responsible party and TurfOps is its operator, acting only on its instructions. If you work for one of our customers and have a question about your records, ask your employer first. We will help them answer you.

• Account details: names, email addresses, phone numbers, roles and the company you work for, for admins and other full users, and the billing contact.
• Staff names and PIN logins: the names and roles of field staff, and the six digit PIN they use to sign in.
• Location: the position of the phone or Apple Watch when staff use the field app or the watch app to capture records or use features that need a location. Your device asks for permission before sharing location.
• Photos: fuel slip and meter photos, and any other photos staff attach to records. These can show names, signatures or vehicle details.
• Work records: what was done, where, when and by whom, such as machine hours, fuel, spray records, readings, tasks and notes.
• Device data: device type, operating system, app and browser version, IP address, and logs of sign ins and errors.
• Payment details: PayFast handles card details and we never see them. We receive the payment reference, amount, date and whether it succeeded.
• Messages: what you send us when you sign up, email us or ask for support.

• to provide TurfOps: sign in, show the right data to the right people, and keep your operation's records
• to bill you and keep financial records
• to send service emails, such as account verification, invitations, billing notices and price change notices
• to give support and fix problems
• to keep the service and your data secure, and to prevent misuse
• to meet our legal duties

We do not sell personal information and we do not use it for advertising.

Under section 11 of POPIA we process personal information because:

• it is needed to carry out our contract with your business
• the law requires it, for example tax and accounting records
• it is in our legitimate interest, or our customer's, such as keeping the service secure
• you have given consent, for example when your device asks to share location

Where we rely on consent, you can withdraw it at any time.

We share personal information only with the operators that run parts of the service for us, and only what each one needs:

• Supabase: our database and sign in provider. The database is hosted in London, in the United Kingdom.
• Vercel: hosts the TurfOps website and application.
• Resend: sends our emails.
• PayFast: takes subscription payments.

Because our database is in the United Kingdom, your information is transferred outside South Africa. Section 72 of POPIA allows this when the recipient is bound by law or a binding agreement that gives protection substantially similar to POPIA. The United Kingdom has its own data protection law, and our operators are bound by contract to protect the information. Where another operator processes information outside South Africa, the same rules apply.

We may also share information when the law requires it, for example with the South African Revenue Service or a court.

We keep personal information for as long as your business has a TurfOps account. When an account closes, it becomes read only so the records can be exported. We delete or de-identify the information [Retention period to be confirmed] after the account closes, or sooner if you ask us to.

We keep billing and payment records for as long as tax and company law requires, even after an account closes.

• all traffic is encrypted over HTTPS, and the database is encrypted at rest and backed up
• each organisation's data is kept apart by rules in the database itself, so one customer cannot see another's records
• people see only what their role allows
• field staff sign in with a PIN against a signed, secure session, and hold no email account or password
• keys for connected services stay on our servers and never reach a browser

If we believe personal information has been accessed without permission, we will tell the Information Regulator and the people affected as section 22 of POPIA requires. More detail is on our security page.

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it
• ask us to correct information that is wrong or out of date
• ask us to delete information we no longer have a right to keep
• object to us processing your information, on reasonable grounds
• withdraw consent you have given
• not receive direct marketing you have not agreed to
• complain to the Information Regulator

To use any of these rights, email info@turfops.co.za. We may need to confirm who you are before we act. If your request is about records your employer keeps in TurfOps, we will pass it to them and help them respond.

If you are unhappy with how we handle your personal information, please tell us first at info@turfops.co.za so we can try to put it right.

You can also complain to the Information Regulator of South Africa at any time. Its website, inforegulator.org.za, explains how to lodge a complaint.

We use only strictly necessary cookies. They keep you signed in, whether with a full account or a field PIN, and remember which organisation or division you are working in. TurfOps does not work without them, so there is nothing to switch off.

We do not use analytics, advertising or tracking cookies.

We may update this policy. The date at the top of this page shows when it last changed. If a change matters to you, we will email your admins before it takes effect.

• Information officer: [Information officer name to be confirmed]
• Email: info@turfops.co.za
• Phone: [Phone number to be confirmed]
• Address: TurfOps (Pty) Ltd, [Registered address to be confirmed]