Worklog Privacy Policy

1. Who we are (the Responsible Party)

1. Worklog is operated by Worklog Solutions (Pty) Ltd (registration number 2026/561415/07), a private company incorporated in the Republic of South Africa, with registered address 11 Lamprecht Street, George, Western Cape, 6529.
2. For personal information that we process about you (our account holder), Worklog Solutions (Pty) Ltd is the Responsible Party as defined in POPIA. This means we decide why and how that information is processed, and we are accountable for it. Our role is different for the personal information you upload about your own clients, suppliers and employees, which is explained in the section 'Your own contacts and employees'.
3. We have appointed an Information Officer who is responsible for our compliance with POPIA and for dealing with your privacy requests and questions. As POPIA requires, our Information Officer is registered with the Information Regulator (registration number 2026-063855), and you can check that on the Regulator’s eServices portal. You can reach the Information Officer using the details below.
4. If you have any question about this policy or about how we handle your personal information, please contact the Information Officer.

• Information Officer: Adriaan du Plessis
• Email: hello@worklogsolutions.co.za
• Registered address: 11 Lamprecht Street, George, Western Cape, 6529

2. Scope of this policy

1. This policy applies to personal information we process when you: (a) create and use a Worklog account; (b) use any feature of the Service, including our web app and installable Progressive Web App (PWA); (c) contact us for support; or (d) visit or interact with our website.
2. This policy also explains how we handle personal information about your clients, suppliers and employees that you choose to upload to the Service. Our role in relation to that information is different, and is explained in the section 'Your own contacts and employees'.
3. The Service may link to, or integrate with, third-party services (for example our payment gateway). This policy does not cover the independent privacy practices of those third parties, and we encourage you to read their own privacy notices.
4. This policy does not form part of any contract of employment or contract for services. It may be updated from time to time in accordance with the section 'Changes to this policy'.

3. The personal information we collect

3.1. We collect and process the following categories of personal information.

(a) Account information — your email address; your first name, if you give it, which we use only to greet you in the Service; and your password, which is never stored in readable form. It is stored only as a secure cryptographic hash by our authentication provider, Supabase (see the section 'Who we share your information with').

(b) Business profile information — business (trading) name; VAT registration number; PAYE, SDL and other tax reference numbers; physical and postal address; and contact phone number.

(c) Your own contacts (third-party personal information) — the names, email addresses, phone numbers and addresses of your clients and suppliers that you upload or capture in the Service. If you buy used goods from a private seller and claim notional input tax on them (VAT Act section 20(8)), it also includes that seller's name and the photographs or PDFs you attach of their signed VAT 264 declaration and of their identity document, which show their ID number and address: the name is kept in your records, the ID number and address only inside the photographs. This is personal information about other people that you provide to us. Your responsibilities for this information are set out in the section 'Your own contacts and employees'.

(d) Financial and transaction records — records of income and expenses; invoices, quotes and purchase orders; stock, time and mileage records; and tax estimate inputs and outputs (for example VAT201, EMP201 and provisional tax calculations).

(e) Bank statement contents — the contents of bank statements that you upload, decrypt and reconcile in the Service, including transaction lines, amounts, dates and counterparties.

(f) Documents and images you submit — photographs of receipts and slips, supplier invoices, and other images and PDFs that you upload or capture through Quick Log or send to Worklog's WhatsApp number; and the bank statements you import — the statement file itself, or, where the PDF is password-protected, a picture of each page that your own device makes after unlocking it, so that the password never leaves your phone. These are sent to our AI operator to be read (see the section 'AI-assisted features'). A photograph or PDF of a receipt, slip, supplier invoice or credit note that you save with an entry — in the app or by WhatsApp — is kept with that entry as your proof of purchase, for as long as the entry itself (section 13). A bank statement file is not kept — only the entries you confirm from it.

(g) Payroll information (where you use payroll) — the full names, identity (ID) numbers, tax numbers and salary details of your employees.

(h) Technical and usage information (collected automatically) — IP address; device and browser information; log data and usage data; authentication and session cookie data; and, on four public pages of our website while you are not signed in, what Google's and Meta's advertising tags collect about your visit (see the section 'Cookies').

(i) Invitations — when an owner invites someone to join their business in the Service, the email address the owner gives, kept with the invite. If the owner asks us to email the invite, we send it to that address, saying which business it is for, the sign-in email address of the owner who made it, the link and when it expires. We keep a scrambled (hashed) form of the address for no more than nine days, only to limit how often invites are emailed to it.

3.2. Sensitive and confidential information. Some of the information above is not 'special personal information' under section 26 of POPIA (which covers a closed list — a person's religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour) but is nonetheless sensitive and confidential, and we treat it with heightened care as a matter of good practice. This includes: your employees' ID numbers, tax numbers and salary details (an ID number is a 'unique identifier' under POPIA), the signed VAT 264 declarations and identity documents of private sellers whose used goods you buy (their names, ID numbers and addresses; only the owner and logins with full access to Money Out who also hold the Proof of purchase permission can open them, and neither is ever sent to our AI provider), and the financial information in your transaction records and bank statements. For employee and contact information we act only as your Operator (processor) — the justification for processing that data rests with you as the Responsible Party, as explained in the section 'Your own contacts and employees'. We apply the safeguards described in the sections 'How we keep your information secure' and 'Sensitive information and children', restrict internal access, and do not use this information for any purpose other than providing the Service to you.

3.3. We do not knowingly collect information about children. The Service is intended only for use by businesses and adults aged 18 or older (see the section 'Sensitive information and children').

4. How we collect your information, and whether providing it is voluntary or mandatory

1. Directly from you. Most of the information we hold is provided directly by you when you register for an account, complete your business profile, capture or upload records, photograph a receipt or slip, upload a supplier invoice or other document, use payroll, upload bank statements, use our AI-assisted features, or contact us for support.
2. Automatically. When you use the Service, we automatically collect certain technical and usage information (see 3.1(h)) through your device, our servers and essential cookies. This helps us authenticate you, keep the Service secure, and keep it working reliably. On four public pages of our website, Google's and Meta's advertising tags also collect information about your visit while you are not signed in (see the section 'Cookies').
3. From our operators. We may receive limited information from the service providers that help us run Worklog (for example confirmation from our payment gateway that a subscription payment succeeded or failed). We do not receive or store your full card number.
4. We do not buy personal information about you from data brokers, and we do not build advertising profiles about you.

4.5. Voluntary or mandatory, and the consequences of not providing information (POPIA section 18(1)(d)-(e)). Providing your account information (email and password) and core business-profile information is voluntary, but it is necessary to create and operate your account — without it we cannot provide the Service to you. Other information is required only for particular features: for example, if you do not provide payroll data we cannot run payroll or produce payslips; if you do not upload a bank statement we cannot parse or reconcile it. Some information (such as your first name, optional profile fields or any future marketing preference) is entirely optional and you may choose not to provide it. In short, the consequence of not providing required information is that we may be unable to create your account or deliver the relevant feature or the Service.

4.6. Laws relevant to certain collection (POPIA section 18(1)(f)). Certain information is collected or retained because South African law requires or contemplates it. In particular, tax reference numbers and your financial and transaction records are relevant to obligations under the Tax Administration Act 28 of 2011 and the Income Tax Act 58 of 1962 (under which you, as the taxpayer, are required to keep your business records for five years — a duty that rests with you rather than with us), and payroll data relates to your obligations under employment and tax legislation. We explain retention in the section 'How long we keep your information'.

5. Why we process your information, and our lawful basis

5.1. POPIA requires that we process personal information lawfully and reasonably, and that each processing activity has a proper justification. Most of our processing is necessary to provide the Service you have asked for. The purposes and the lawful basis under POPIA on which we rely are set out below. Your first name, if you give it, is the exception: we use it only to greet you in the Service, and for none of the purposes below.

• (a) Create and administer your account; authenticate you and keep your account secure — using account and technical information — necessary for the performance of our contract with you (our Terms of Service).
• (b) Provide the core Service (record income and expenses, manage contacts, create quotes, invoices and purchase orders, track stock, log time and mileage, and generate documents) — using business profile, your contacts and financial and transaction records — performance of our contract with you.
• (c) Upload, decrypt, parse and reconcile bank statements — using bank statement contents and financial records — performance of our contract with you.
• (d) Run basic payroll and produce payslips (PAYE / UIF / SDL) — using payroll information — performance of our contract with you and compliance with a legal obligation; and, in respect of your employees' information specifically, we act only as your Operator on your documented instruction (see the section 'Your own contacts and employees'). We do not rely on the section 27 'special personal information' employment-law exception for this data, because it is not special personal information under POPIA.
• (e) Produce tax estimates using SARS rates (VAT201 / EMP201 / provisional tax) for your convenience — using business profile and financial records — performance of our contract with you. These figures are estimates only and must be independently verified (see 5.4).
• (f) Provide AI-assisted features — 'Quick Log' natural-language capture, the help assistant (Loggy), including its 'My books' answers about your own records, bank-statement parsing, and the short note at the top of the monthly summary email — using the text, photographs, documents and PDFs you submit to those features, totals worked out from your records, and your account's settings — performance of our contract with you (see the section 'AI-assisted features').
• (g) Take payment and manage your subscription, free trial, renewals, downgrades and suspension — using account and business information and payment status data — performance of our contract with you.
• (h) Send service and transactional communications (verification emails, receipts, security and billing notices, and — unless an owner turns it off — a monthly summary of the business's own figures, see the section 'Direct marketing communications') — using account information and, for the monthly summary, your financial records — performance of our contract and our legitimate interest in operating the Service. When an owner asks us to email an invite to someone they invite (3.1(i)), we send it at that owner's request, using only what the invite needs — our legitimate interest in letting the person invited join the business they were invited to (POPIA section 11(1)(f)).
• (i) Keep the Service secure, prevent and detect fraud and abuse, and diagnose and fix technical problems — using technical and usage information — our legitimate interests in protecting our Service and our users.
• (j) Comply with our own legal, tax and regulatory obligations, and retain records for the periods the law requires — using information relevant to the obligation — compliance with a legal obligation imposed on us.
• (k) Establish, exercise or defend legal claims, and enforce our Terms of Service — using information as relevant — our legitimate interests and the protection of a legitimate interest.
• (l) Any optional processing you specifically opt in to (for example optional marketing, if we ever offer it) — using information as relevant — your consent, which you may withdraw at any time (see the section 'Direct marketing communications').
• (m) Measure our advertising — whether someone who saw or clicked one of our adverts visited our website and tapped the button to hear when sign-ups open — using what Google's and Meta's advertising tags collect on four public pages while you are not signed in (see the section 'Cookies') — our legitimate interest in knowing which of our adverts work, limited to those four pages and to visitors who are not signed in.

5.2. We apply POPIA's eight conditions for the lawful processing of personal information across everything we do, namely: (1) accountability; (2) processing limitation (lawfulness, minimality and consent or justification); (3) purpose specification; (4) further-processing limitation; (5) information quality; (6) openness; (7) security safeguards; and (8) data subject participation. This policy is part of how we meet the 'openness' condition.

5.3. Where we rely on consent, you are free to refuse or to withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms.

5.4. Estimates and generated documents are not professional advice. Worklog is a software record-keeping tool. It is not a registered accountant, auditor, tax practitioner, or financial or legal adviser, and it provides no professional advice. All tax figures, SARS rates, calculations and generated documents (including invoices, quotes and payslips) are provided for convenience and estimation only. They may be incomplete, incorrect or out of date, and you must independently verify them. You remain solely responsible for your own SARS, CIPC and other statutory compliance and for every decision you make using the Service. AI-assisted features can produce errors and must be checked by you.

6. Your own contacts and employees (you are the Responsible Party)

1. When you upload or capture personal information about other people — your clients, your suppliers, the private sellers you buy used goods from, and your employees — you are the Responsible Party for that information, and Worklog acts as your Operator (processor). We process it only on your documented instruction and to provide the Service to you. We do not use your contacts' or employees' personal information for our own purposes, and we do not carry our own separate lawful-processing justification for it — that justification rests with you.
2. By uploading or capturing that information, you warrant that: (a) you have a lawful basis under POPIA (for example consent, contractual necessity, or a legal obligation) to collect it and to give it to us to process on your behalf; (b) where required, you have given the necessary notices to, and obtained any necessary consents from, those individuals; (c) you have a lawful basis to process your employees' information (including ID numbers, tax numbers and salaries) for payroll purposes; (d) you have a lawful basis under section 72 of POPIA to permit that information to be transferred to and processed by our operators outside South Africa (see the section 'Cross-border transfers of information'); and (e) your instructions to us will not cause us or you to breach POPIA or any other law.
3. As your Operator, we will: process this information only for the purposes of providing the Service and on your instruction; apply appropriate security safeguards; treat it as confidential; and notify you immediately, and in any event within 24 (twenty-four) hours, if we have a reasonable belief that it has been accessed or acquired by an unauthorised person. We will tell you by email to your account address and by a notice inside the Service, and we will describe what we know of the compromise, so that you can start your own notifications to the Information Regulator and to the people affected. We will also tell you within 5 (five) business days if one of your own clients, suppliers or employees approaches us directly about their information — we will refer them to you rather than answer for you.
4. You are responsible for responding to any request or complaint that your own clients, suppliers or employees make to you about their personal information (for example a request to access, correct or delete it). We will give you reasonable assistance to do so, and you can also correct or delete this information yourself using the Service.

7. Who we share your information with (our Operators)

1. We do not sell your personal information, and we do not share your records or your account information for advertising. The only information that reaches advertisers is what Google's and Meta's advertising tags collect on four public pages of our website while you are not signed in (see the section 'Cookies').
2. We share personal information with a small number of trusted service providers ('Operators' under POPIA) who process it on our behalf, under written contracts that require them to keep it confidential and secure and to process it only on our instructions. Each is listed below with its purpose and the country in which it processes the data.

• Supabase — database, authentication and file storage (this is where your records and files are stored, and where your password is held as a secure hash). Hosted in the European Union, on Amazon Web Services in eu-west-1, Ireland.
• Vercel Inc. — application hosting and content delivery. The application, and its processing of your records, runs in Vercel's Dublin region in Ireland, in the European Union, beside our database. Vercel is a United States company and may process operational data, such as request logs, in the United States. The app's static files may be delivered from an edge location closer to you, but that delivery does not involve your records.
• Anthropic PBC — provides the Claude AI that powers our AI-assisted features. It receives the text, photographs, documents and PDFs you submit to those features — the transaction details and questions you type, the receipts and supplier invoices you photograph or upload through Quick Log, and any bank statement you import (the statement file itself, or a picture of each page where your device had to unlock a password-protected PDF first). For 'My books' answers and the monthly summary note it also receives totals worked out from your records, and with each help question the screen you are on and your account's plan, permission and tax settings — never the names of your clients, suppliers or employees. United States. See the section 'AI-assisted features' for the limits on how Anthropic may use this content.
• Payfast (Pty) Ltd — payment gateway that processes your subscription payments. Your card details are handled by Payfast; Worklog does not store your full card number. South Africa.
• Resend — delivery of transactional emails (for example verification and billing emails, the monthly summary of your own figures, which names no client, supplier or employee, and an invite to join a business, sent to the person invited when an owner asks us to email it). United States, on Amazon Web Services.
• Meta — WhatsApp LLC and Meta Platforms Ireland Limited, which provide the WhatsApp Business Platform that Worklog's own WhatsApp number runs on. It carries the messages, photographs and PDFs exchanged with that number, only for a business whose owner has linked a phone to it (see 7.5). Processed outside South Africa, including in the United States.

7.3. Sub-operators. Our Operators may engage their own sub-operators (sub-processors) to help deliver their services — for example, underlying cloud infrastructure such as Amazon Web Services. We require each Operator to bind any sub-operator to written terms providing a level of protection consistent with this policy and POPIA, and each Operator remains responsible to us for its sub-operators.

7.4. Other disclosures. We may also disclose personal information: (a) where required by law, court order, or a valid request from a competent authority; (b) to establish, exercise or defend legal claims; (c) to protect the rights, safety or property of Worklog, our users or the public; or (d) in connection with a merger, acquisition or sale of all or part of our business, in which case we will require the recipient to protect your information in a manner consistent with this policy.

7.5. WhatsApp. Using Worklog by WhatsApp is optional. Nothing is sent through WhatsApp for a business until an owner links their own phone number to Worklog's WhatsApp number, and an owner can disconnect it at any time from the WhatsApp card in the app, which deletes the link. Once a number is linked: (a) what you send that number — your words, and any photograph or PDF of a receipt, slip or supplier invoice — reaches us through Meta, and an entry to log is read by our AI operator exactly as a Quick Log entry is (section 8); (b) our replies go back to that number through Meta, and they can contain what you asked for from your records — an entry for you to confirm, your balance, or who owes you and which supplier invoices are due, with the names and amounts involved; (c) if an owner switches on the WhatsApp monthly summary in Business details, the summary's headline — the business's name, the month, income, costs and the profit or loss — goes through Meta to that owner's own linked number, and to no one else. We keep the linked number while it stays linked, and a short record of each message's handling (the kind of entry, its amount and date, and whether it was saved) for no more than thirty (30) days; the AI's reading of a message is deleted after a day. WhatsApp is also Meta's own service, and your use of the WhatsApp app is governed by WhatsApp's terms and privacy policy as well as this policy.

8. AI-assisted features and how your content is used

1. Worklog's AI-assisted features — 'Quick Log' natural-language capture, the help assistant, and bank-statement parsing — are powered by Claude, provided by Anthropic PBC in the United States. To provide these features, what you submit to them is sent to Anthropic to generate the requested output. This is not only text. It includes the photographs you take of receipts and slips, the supplier invoices and other PDFs you upload through Quick Log, and the bank statements you import — the statement file itself, or, where the PDF is password-protected, a picture of every page, made on your device after it is unlocked so that the password itself never leaves your phone. It also includes transaction details, your questions, the full contents of bank statements, and any contact or employee information captured through Quick Log.
2. Two features send figures from your records rather than something you typed or uploaded. 'My books' in Loggy sends your question with the totals that answer it (for example income, costs and profit for a month, or how much is owed and how much of it is overdue), and the short note at the top of the monthly summary email is written from that month's totals. Both send totals and category names only — never the names of your clients, suppliers or employees, which are shown to you from your records and do not leave them. The monthly note is written only for a business that has the AI-assisted features switched on.
3. So that its answers fit you, Loggy also receives, with each help question, the screen you are on and how your account is set up: your plan and which tools are not on it, whether you are an owner and which tools you may open or only view, whether the business is read-only, and your VAT, PAYE and legal-form settings. It receives no figures, names or business name with a help question.
4. Anthropic acts as our Operator for this content. Under our agreement with Anthropic, this content is processed only to return the output you requested and to check it against Anthropic's Usage Policy; it is not used to train or improve Anthropic's general AI models. Anthropic deletes this content from its systems within 30 days of receiving or generating it, except where it must keep it longer to comply with the law or to enforce its usage policy; content its safety systems flag may be kept for up to two years, and the safety scores for up to seven years. This is Anthropic's published position, set out on its Privacy Center page "How long do you store my organization's data?", and we rely on it; our attorney's review of this wording is still owed. If this position ever changes, we will update this policy and tell you before the change takes effect.
5. To see how often the AI gets things right, when a Quick Log entry is saved, changed or thrown away we record what happened to it: the kind of entry, whether the AI said it was sure, which AI model read it, whether you kept it, changed it or discarded it, and the names of the settings you changed (for example the VAT treatment or the category). We never record the words, amounts, names, dates, photographs or documents themselves. This record stays with Worklog, is not sent to Anthropic or anyone else, and is deleted with the business's other records.
6. Because some of this content is financial and sensitive, and may include third-party personal information, you should submit only what is necessary and should not include information you are not permitted to share. The cross-border safeguards for this transfer are described in the section 'Cross-border transfers of information'.
7. AI outputs are suggestions and estimates. Everything the AI produces — Quick Log entries, parsed statements, categorisations and tax estimates — is a draft that you review, edit and confirm. It may contain errors and must be checked by you (see 5.4). You can choose not to use the AI-assisted features and still use the rest of the Service: an owner can switch them off for the business at any time under Business details → 'Use AI features', after which nothing more is sent to Anthropic for that business, and the monthly summary is sent without its note. You can also contact us at hello@worklogsolutions.co.za.

9. Cross-border transfers of information

1. Because some of our Operators are located outside South Africa, personal information processed through the Service — including your own information and, where you upload it, information about your clients, suppliers and employees — is processed in the European Union (Supabase and Vercel, in Ireland) and in the United States (Anthropic and Resend, Vercel's operational logs, and, where an owner links a phone to Worklog's WhatsApp number, Meta). This is a cross-border transfer of personal information under section 72 of POPIA.
2. Primary basis for all transfers — contractual protection (section 72(1)(a)). The primary safeguard we rely on for every category of personal information and every Operator (including information about your contacts and employees) is that each Operator is bound by a written agreement — including data-processing terms and, where relevant, standard contractual clauses — that requires it to provide an adequate level of protection substantially similar to POPIA's conditions and to process the information only for the agreed purposes.
3. Additional bases for your own information. For your own personal information as the account holder, we also rely, where applicable, on: (a) the transfer being necessary for the performance of our contract with you, or for pre-contractual steps taken at your request (section 72(1)(c)); and/or (b) your consent (section 72(1)(b)).
4. Where Worklog processes personal information about your clients, suppliers and employees, it does so as your Operator, and the cross-border transfer of that information relies on the contractual-protection safeguard in section 72(1)(a) above. As the Responsible Party for that information (see the section 'Your own contacts and employees'), you remain responsible for having a lawful basis under section 72 to permit the transfer of your data subjects' information abroad; our operator agreements provide the contractual safeguard that enables it.
5. We take reasonable steps to satisfy ourselves that our Operators protect your information to a standard that meets POPIA's requirements.
6. Separately, the advertising tags on four public pages of our website (see the section 'Cookies') send information about a visit by someone who is not signed in to Google and to Meta, which process it outside South Africa, including in the United States. They receive it under the data-protection terms each of them sets for the businesses that use its tags. It never includes your records. Blocking those cookies limits it; blocking the tags themselves (for example with your browser's tracking protection or an ad blocker) stops it.

10. Automated decision-making

10.1. We do not make decisions about you based solely on automated processing (including profiling) that have legal or similarly significant effects on you, as contemplated by section 71 of POPIA.

10.2. The Service's automated features — AI-generated tax estimates, bank-statement parsing and categorisation, and 'Quick Log' auto-capture — produce suggestions and estimates that you review, edit and control. You remain the decision-maker: there is always a 'human in the loop' (you), and no output is treated as a final decision until you confirm it. Your related right is described in the section 'Your rights under POPIA'.

11. Sensitive information and children

11.1. Sensitive and confidential information. As noted in 3.2, the payroll data you enter about your employees (ID numbers, tax numbers and salaries) and the financial information in your records and bank statements are sensitive and confidential, even though they are not 'special personal information' under section 26 of POPIA. We process this information only to provide the Service, and for employee data only as your Operator on your instruction. We apply the security measures in the section 'How we keep your information secure', restrict internal access, and do not use it for any purpose other than providing the Service to you.

11.2. Children. The Service is intended for use by businesses and by adults aged 18 or older. We do not knowingly collect personal information about children (persons under 18) as our own account holders, and the Service is not directed at children. If you use payroll to process information about an employee who is a minor, you are responsible for ensuring that you have the competent person's consent and any other authorisation the law requires. If we learn that we have inadvertently collected personal information from a child as an account holder without proper authorisation, we will take reasonable steps to delete it.

12. How we keep your information secure

12.1. We take the security of your information seriously and maintain appropriate, reasonable technical and organisational measures to protect it against loss, damage, unauthorised access and unauthorised processing, as required by POPIA. These measures include:

• Encryption in transit — information exchanged between your device and the Service is encrypted using industry-standard transport encryption (TLS/HTTPS).
• Access controls and row-level security — our database (Supabase) enforces row-level security so that you can access only your own data, and internal access by our personnel is limited to those who need it to operate and support the Service.
• Password protection — passwords are stored only as secure hashes by our authentication provider, Supabase, never in readable form.
• Reputable hosted infrastructure — we host with established providers (see the section 'Who we share your information with') who maintain their own strong physical and network security.
• Ongoing measures — we monitor for vulnerabilities and apply updates and other safeguards as appropriate.

12.2. No system is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security. You also play an important part: keep your password confidential, use a strong and unique password, and notify us promptly if you suspect any unauthorised use of your account.

12.3. Security compromises (POPIA section 22). If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after becoming aware of the compromise. Our notification to you will be in writing and communicated in one of the ways permitted by section 22(4), and will provide sufficient information to allow you to take protective measures, including, if known: (a) a description of the possible consequences of the compromise; (b) the measures we intend to take or have taken to address it; (c) a recommendation on the steps you should take to reduce any potential harm; and (d) the identity of the unauthorised person, if known. Where we act as your Operator for your contacts' or employees' data (see the section 'Your own contacts and employees'), we will notify you so that you can meet your own notification obligations.

13. How long we keep your information (retention)

1. We keep your personal information for as long as your account is active and you are using the Service.
2. When your account closes — because you cancel it, or because the subscription lapses and is not renewed — a retention clock starts. We do not keep your records indefinitely. What happens next depends on how sensitive the information is.
3. About three (3) months after your account closes, we permanently delete the details that would do the most harm if they were ever exposed: your employees’ identity numbers, tax numbers, dates of birth, home addresses and contact numbers; your employees’ and your contacts’ bank account details and addresses; and your own saved banking details. We delete these early because keeping them for an account nobody is using creates a risk for the people they describe without serving any purpose.
4. About twelve (12) months after your account closes, we delete the remaining records you created in the Service — income and expenses, invoices, quotes, credit notes, purchase orders and supplier invoices, contacts, staff records, pay runs and payslips, leave, advances and loans, time entries, travel and mileage, bookings, items and stock, cost calculations and recorded filings — together with any documents we stored for you, such as the invoices, quotes and payslips saved as PDFs and the receipts, slips and supplier invoices kept as proof of purchase, and we remove the identifying details from your business profile. At the same time we delete the first name each person on the account gave us to be greeted by, unless they also belong to another business whose records we still keep. At the same time we empty each login that then belongs to no business whose records we still keep: its email address is replaced with a placeholder, and its password and sign-in sessions are removed, so it can no longer be used to sign in (the logins of Worklog's own administrators are not emptied). Only the empty shell of the login stays, so that the record of what you paid us, which we must keep for seven years (see below), is not broken. Our attorney's review of this paragraph is still owed.
5. We will email the owner of the account, at the address the owner uses to sign in, before each of those steps — roughly fourteen (14) days before the first and thirty (30) days before the second — so that there is a fair chance to download a copy first. If that email goes out late, we still wait at least seven (7) days after sending it before we delete. If it cannot be sent at all, or there is no address to send it to, we delete no later than thirty (30) days after the date of that step, because POPIA section 14 does not let us keep information longer than we need it, and we record in our own log that no warning went. The email before the twelve-month step also tells the owner that any login left in no business with records is about to be emptied. We do not email each of those logins separately before it is emptied. Our attorney's review of this paragraph is still owed.
6. If you start a paid plan again before those dates, the clock stops and nothing is deleted.
7. You do not have to wait. If you are the owner of the business account you can delete your records yourself at any time from ‘Your data’ in the Business Hub; anyone else can ask our Information Officer at hello@worklogsolutions.co.za. Deletion is immediate and cannot be undone, and it takes the first names described above with it. Your subscription is stopped at the same time. If it was still running, the account stays open until it ends and the usual warnings follow when it closes; if it was not, we send no further email. Your login is not emptied at that moment: if it then belongs to no business whose records we still keep, we empty it about twelve (12) months after your account closes, as described above. You can also clear your own first name at any time on ‘Sign-in & security’.
8. What we keep afterwards, and why. We keep our own record of what you paid us for Worklog — the subscription, the amounts, the dates, and the confirmations from our payment gateway. Those are our own company accounting records, and the Companies Act 71 of 2008 (sections 24 and 28) requires us, as a company, to keep them for seven (7) years. They do not contain details of your customers, your staff or your jobs.
9. Your five-year duty is your own. South African tax legislation requires you, as the taxpayer, to keep your business records for five (5) years. That duty rests with you and not with us: Worklog is where you record and work with your information, not your statutory archive. Please download and keep your own copy of your records, and do so before you close your account.
10. Short-lived operational logs. Our hosting provider keeps ordinary server logs of requests to the Service — things like timing, error codes and the address a request came from. They are held in the United States, are used only to keep the Service working and secure, and are kept briefly before being overwritten. We do not use them to build a profile of you.
11. We may keep aggregated or de-identified information for longer, to understand and improve the Service — for example, how many businesses used a feature in a month. De-identified means stripped of anything that could identify you, your business or your clients, and we do not attempt to re-identify it.

14. Closing your account, deletion and data export

1. You may close your account at any time. To do so, use the account-closure option in the Service where available, or email our Information Officer at hello@worklogsolutions.co.za. You may also cancel your subscription separately in line with our Terms of Service.
2. If you are the owner of the business account, you can download a complete copy of your information at any time, without asking us first, from ‘Your data’ in the Business Hub. If you were invited to someone else’s business account, that business holds the records and you should ask its owner — or contact our Information Officer, who will help. You will get a single file containing spreadsheets of everything you have recorded, which opens in Excel, Google Sheets or any accounting package. This remains available while your account is closed and read-only, so that closing your account never traps your records inside it. If you have any difficulty, contact us at hello@worklogsolutions.co.za and we will assist you.
3. When your account is closed, your access to the Service ends and the retention clock described in the section ‘How long we keep your information’ begins. Your records are deleted in stages after that, and we will email you before each stage.
4. You can also ask us to delete personal information we are no longer authorised to keep, as described in the section 'Your rights under POPIA'.

15. Your rights under POPIA

15.1. POPIA gives you important rights over your personal information. Subject to the conditions and exceptions in the Act, you have the right to:

• (a) be told what personal information we hold about you, to request access to it, and to be told the identity of (or the categories of) all third parties who have, or have had, access to it (section 23);
• (b) request correction of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• (c) request deletion or destruction of personal information we are no longer authorised to keep;
• (d) object, on reasonable grounds, to the processing of your personal information;
• (e) withdraw your consent where we rely on consent, at any time (this will not affect processing that already took place, and may affect our ability to provide certain features);
• (f) not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, other than as permitted by POPIA (see the section 'Automated decision-making'); and
• (g) complain to the Information Regulator (see the section 'Complaining to the Information Regulator').

15.2. How to exercise your rights. You can update much of your information yourself inside the Service. For anything else, contact our Information Officer at hello@worklogsolutions.co.za. To protect your information, we may need to verify your identity before acting on a request.

15.3. Prescribed forms. POPIA ties two rights to prescribed forms, and we will supply them proactively. To object to the processing of your information (POPIA Form 1) or to request correction or deletion of your information (POPIA Form 2), email hello@worklogsolutions.co.za and we will send you the correct form, or you can download it from the Information Regulator's website at https://inforegulator.org.za. You may also make the request in a plain email and we will help you complete any required form. Formal requests for access to records are made under the Promotion of Access to Information Act 2 of 2000 (PAIA) using the prescribed PAIA request form (Form 2) and our PAIA manual (see the section 'PAIA manual').

15.4. Timeframes and fees. We will acknowledge your request promptly and respond within a reasonable time, and in any event within the periods required by POPIA and PAIA — for access requests, generally 30 days, extendable where the law allows, in which case we will tell you why. A request for access may, where the law allows, be subject to a prescribed fee, which we will tell you about in advance.

16. Direct marketing communications

1. Service and transactional messages. We send you service and transactional communications (for example verification emails, receipts, and security and billing notices) as a necessary part of providing the Service. These are not marketing and continue for as long as you have an account. They include a monthly summary of your own business's figures, emailed to its owners at the start of each month: it is about your records, not our products, and an owner can turn it off at any time under Business details → 'Monthly summary email' (every summary says so and links there). A month with nothing recorded and nothing owed is not sent. When an owner invites someone to their business and asks us to email the invite, we send that person the invite and nothing more: it is not marketing, and we send no other email to that address unless they make an account.
2. Telling you when sign-ups open. While new accounts are closed, the public site lets you message us on WhatsApp and ask us to tell you when sign-ups open. That is the only purpose for which we use your WhatsApp number and your message (POPIA section 18(1)(c)): we send you one message when sign-ups open. It is direct marketing, which section 69 of POPIA allows because you asked for it; it says it is from Worklog and tells you how to stop. We delete your request once we have sent that message, or sooner if you ask us to (POPIA section 14), and we send nothing else to that number unless you make an account.
3. Other marketing messages. Apart from that one message, we do not currently send marketing, but if we ever do, any electronic direct marketing will comply with section 69 of POPIA and section 45 of the Electronic Communications and Transactions Act 25 of 2002 (ECTA). We will send electronic marketing only where you have given your prior opt-in consent (for people who are not existing customers, consent will be requested only once, in the manner prescribed by POPIA), or where you are an existing customer and the marketing relates to our own similar products or services and you were given a clear opportunity to opt out when we collected your details.
4. Unsubscribe. Every marketing message will identify us and include a free and easy way to opt out. You can also unsubscribe at any time by emailing hello@worklogsolutions.co.za. Opting out of marketing will not stop the service and transactional messages described above.

17. Complaining to the Information Regulator

17.1. If you are not satisfied with how we have handled your personal information or your privacy request, you have the right to lodge a complaint with the Information Regulator (South Africa). We would appreciate the chance to address your concern first, but you may approach the Regulator at any time. Its details are:

• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017
• Complaints email: complaints.IR@justice.gov.za
• General enquiries email: enquiries.IR@justice.gov.za
• Website: https://inforegulator.org.za

18. PAIA manual (access to information)

18.1. As a private body and Responsible Party, Worklog Solutions (Pty) Ltd maintains a manual under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA). The PAIA manual explains the records we hold and how to request access to them.

18.2. Our PAIA manual is published, free of charge, at https://worklog.co.za/paia. It lists the records we hold, explains how to ask for access to them and what that costs, and sets out what you can do if we refuse. Formal access requests should follow the procedure in it. If you would rather have a copy by email or post, ask our Information Officer at hello@worklogsolutions.co.za.

19. Cookies

1. Inside the Service. Worklog uses only essential authentication and session cookies. These are necessary to sign you in, keep you signed in, keep your session secure, and make the Service work. Without them, the Service cannot function properly. Because these cookies are strictly necessary to provide a service you have requested, they do not require separate consent. You can block or delete cookies in your browser settings, but if you do, parts of the Service may stop working (for example, you may not be able to stay signed in).
2. On four public pages of our website. The home page, the pricing page, the sign-up page and the Help Centre's front page at https://worklog.co.za load advertising tags from Google (Google Ads and Google Analytics) and from Meta (the Meta Pixel), and load them only while you are not signed in. They tell us whether someone who saw or clicked one of our adverts visited those pages and tapped the button to hear when sign-ups open. To do that, the tags set cookies in your browser and send Google and Meta information about the visit: your IP address, your browser and device, which of those pages you open and the page or advert that brought you there (if any), the time, how far down a page you scroll, which links to other sites you tap (such as WhatsApp), and whether you tapped the button to hear when sign-ups open. They do not collect what you type, they do not run on any other page, and they never run inside the app once you are signed in, so they never see your records.
3. Google and Meta receive this information as businesses in their own right. Each handles it under its own terms and privacy policy, which may include using it to deliver and measure adverts, and processes it outside South Africa, including in the United States (see the section 'Cross-border transfers of information'). We do not give them your name, email address, phone number or records.
4. Your choices. You can block or delete these cookies in your browser settings, or block the tags themselves with your browser's tracking protection or an ad blocker; the public pages work the same either way. You can also limit how Google uses information for advertising at myadcenter.google.com, install Google's Analytics opt-out browser add-on from tools.google.com/dlpage/gaoptout, and change your ad preferences in Meta's Accounts Centre. A short notice about these cookies shows the first time you open one of those pages, until you tap OK.
5. Apart from those four pages, Worklog uses no advertising cookies.

20. Changes to this policy

1. We may update this policy from time to time — for example if we add features, change our Operators, or if the law changes.
2. When we make changes, we will update the effective date at the top of this policy and publish the updated version in the Service. If the changes are material, we will take reasonable steps to bring them to your attention, for example by email or by an in-app notice.
3. Your continued use of the Service after an updated policy takes effect means that you have read and understood the changes. If you do not agree with a change, you may stop using the Service and close your account.

21. Contact us

21.1. If you have any questions, requests or concerns about this policy or about how we handle your personal information, please contact our Information Officer:

• Worklog Solutions (Pty) Ltd (registration number 2026/561415/07)
• Information Officer: Adriaan du Plessis
• Email: hello@worklogsolutions.co.za
• Registered address: 11 Lamprecht Street, George, Western Cape, 6529

21.2. This Privacy Policy is governed by the laws of the Republic of South Africa and should be read together with our Terms of Service. Any dispute relating to it is subject to the jurisdiction of the courts of Western Cape.