Privacy policy
The short version. We collect what we need to run EasyKwote and to keep in touch with businesses that ask us to. We don't sell personal information. The information you capture about your own clients belongs to you, and we only process it to provide the service. You can ask us to show, correct or delete your information at any time.
1. Who we are
EasyKwote is a quoting, job and invoicing service for South African businesses, run by EasyKwote (Pty) Ltd, a private company in South Africa ("EasyKwote", "we", "us"). This policy explains how we handle personal information under the Protection of Personal Information Act, 2013 (POPIA). It covers our website (easykwote.co.za), the EasyKwote app (app.easykwote.co.za) and our communications with you.
You can reach us, including our Information Officer, at [email protected].
2. Our two roles
When we are the responsible party. For information about website visitors, people who sign up for early access, and the owners and team members who use an EasyKwote account, we decide why and how the information is processed. We are the responsible party.
When we are an operator. Businesses use EasyKwote to store information about their own clients and staff, for example a client's name, address and phone number on a quote, or photos taken on a job. For that information, the business is the responsible party and we act as its operator. We process it only on the business's instructions to provide the service, and we keep it secure and confidential as POPIA requires. If you are a client of a business that uses EasyKwote, please contact that business about your information. We will help them respond.
3. What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Early access sign-ups | Name, business name, trade, team size, WhatsApp number, email, and the consent you gave | You, through the form on our website |
| Account details | Name, email address, sign-in records, your role in a business | You, when you sign up or are invited |
| Business details | Business name, trade, VAT status and number, company registration number, address, contact details, logo, banking details for your invoices | You, in your business settings |
| Your business content | Clients, quotes, invoices, jobs, notes, photos and sign-offs | You and your team (we process this as your operator) |
| Subscription billing | Plan, billing history, payment status | You and our payment provider. We do not see or store full card numbers. |
| Consent records | The exact wording you agreed to, when, and how | Created when you tick a consent box |
| Technical information | IP address, browser and device type, pages used, error logs | Your device, when you use the website or app |
| Messages with us | Emails and WhatsApp messages you send us, support requests | You |
4. How we use it
We only process personal information for a specific, lawful purpose, and only as much as we need. We rely on the grounds in section 11 of POPIA: your consent, the contract between us, our legal obligations, and our legitimate interests where these don't override yours.
- To provide EasyKwote: create and secure your account, store your business information, send quotes, invoices and messages on your behalf, and keep the app working when you're offline. (Contract)
- To bill your subscription and keep financial records. (Contract and legal obligation)
- To contact early access sign-ups about joining EasyKwote. (Consent)
- To send service messages such as sign-in codes, security alerts and important changes. (Contract and legitimate interest)
- To keep EasyKwote secure and prevent fraud and abuse, for example by limiting repeated sign-ups. (Legitimate interest)
- To improve EasyKwote, using information about how the service is used. (Legitimate interest)
- To meet legal requirements, for example tax and company law, or a lawful request from an authority. (Legal obligation)
We do not sell personal information, and we do not use your clients' information for our own marketing.
5. Marketing messages
We only send you marketing messages by email or WhatsApp if you have agreed to receive them, or if you are a customer and the messages are about similar EasyKwote services, as section 69 of POPIA allows. Every marketing message tells you how to stop receiving them, and you can opt out at any time by replying "STOP" or emailing us.
If you ask for a free Google visibility check inside EasyKwote, we share your business name, website and contact details with KlientRush, a digital marketing agency associated with EasyKwote, so that they can do the check and contact you about the results. We only do this when you ask for the check and agree to it.
6. Who we share it with
We use trusted service providers to run EasyKwote. They act as our operators, may only use the information to provide their service to us, and must keep it secure.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | United Kingdom (London) |
| Cloudflare | Website and app hosting, security and network | Global network, including South Africa |
| Resend | Sending emails, such as sign-in codes and quotes | Ireland (European Union) |
| Our subscription payment provider | Processing payments for your EasyKwote plan | South Africa |
| Meta (WhatsApp) | Sending WhatsApp messages, when you choose to use WhatsApp features | International |
Payments from your clients. If you connect your own Yoco account, your clients pay you through Yoco, under Yoco's terms and privacy policy. The money goes straight to your Yoco account. We don't receive it, and we don't see or store your clients' card details.
We may also disclose information when the law requires it, to protect our rights or someone's safety, or as part of a sale or restructuring of our business, in which case the new owner must protect it in the same way.
7. Storage outside South Africa
Some of our providers store or process information outside South Africa, mainly in the United Kingdom and the European Union. We only do this as section 72 of POPIA allows: the countries involved have data protection laws that give substantially similar protection to POPIA (the UK GDPR and the EU GDPR), and our agreements with these providers require them to protect the information.
8. How we protect it
We take reasonable technical and organisational measures to protect personal information, as section 19 of POPIA requires. These include encrypted connections, access controls that keep each business's information separate from every other business's, limited staff access, logging of important changes, and regular testing of these controls. Team members a business invites only see what their role allows. If we become aware of a security compromise that affects your information, we will notify you and the Information Regulator as POPIA requires.
9. How long we keep it
- Early access sign-ups: until 12 months after we launch publicly, or sooner if you ask us to delete them.
- Account and business information: while your account is active. After you close your account, you have 90 days to export your data, after which we delete it, unless the law requires us to keep it longer.
- Our financial records, such as subscription invoices: for at least 5 years, as tax law requires.
- Consent records: for as long as we rely on the consent, and for a reasonable period afterwards as proof.
- Technical logs: for a short period, usually no longer than 90 days.
Your own quotes and invoices may be tax records that you are required to keep. Export them before you close your account.
10. Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and for a copy of it;
- ask us to correct or delete information that is inaccurate, out of date, incomplete or that we may no longer keep;
- object to processing based on our legitimate interests, and to direct marketing;
- withdraw your consent at any time, without affecting processing that already took place;
- complain to the Information Regulator.
To use any of these rights, email [email protected]. We may need to confirm your identity first. We will respond within a reasonable time and, where the law requires, within 30 days. You can contact the Information Regulator through its website, inforegulator.org.za.
11. Cookies and similar technology
Our website does not use advertising or tracking cookies. The EasyKwote app uses a small number of essential cookies to keep you signed in, remember which business you're working in, and keep your sign-in secure. It also saves changes on your device when you have no signal, so they can be sent when you're back online. These are needed for the app to work, so they can't be switched off. If we add analytics in future, we will update this policy first.
12. Children
EasyKwote is for businesses and is not intended for anyone under 18. We do not knowingly collect information about children for our own purposes.
13. Changes to this policy
We may update this policy as EasyKwote develops. We will change the date at the top and, for significant changes, tell account holders by email or in the app before the change takes effect.
14. Contact us
For questions about this policy or your personal information, email [email protected].