LogiGrid Privacy Policy

1. Who we are

LogiGrid is an online tool that helps freight operators in South Africa manage quotes, jobs, proof of delivery and Invoice Packs. It is available at https://www.logigrid.co.za.

• Registered company name: [TO FILL]
• Registration number: [TO FILL]
• Physical address: [TO FILL]
• Information Officer: [TO FILL: name]
• Privacy contact email: [TO FILL]

This policy explains how we handle personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Our two roles

When we are the responsible party. We decide why and how we process information about the people who sign up for and use LogiGrid on behalf of a freight business (operators and their team members), and about visitors to our website.

When we are an operator (processor). Operators load information about their own clients, client contacts, receivers and drivers into LogiGrid. For that information the operator is the responsible party and LogiGrid processes it only on the operator's instructions, to provide the service. If you are a client, receiver or driver of an operator, please contact that operator first about your information. We will help them respond to you.

3. Information we collect

3.1 Operators and their team members

• Account details: name, email address, password (stored in hashed form by our authentication provider), role in the organisation (for example Owner, Admin or member).
• Company details: company name, logo, contact details, address, banking or invoicing details you choose to show on documents.
• Business records you create: clients, rate cards, quotes and quote versions, jobs, delivery details, Invoice Packs, invoices and payments you record.
• Notification settings and the email addresses you ask us to notify.
• Technical information: log data such as IP address, browser and device type, and times of access, used for security.

3.2 Operators' clients and client contacts

• Names, company names, email addresses, phone numbers and addresses that the operator enters.
• Activity on links the operator sends you: when a quote or Invoice Pack is opened, viewed again or downloaded, and questions or responses you submit.
• Quote acceptance evidence: when you accept a quote we record your name or details as entered, the time of acceptance, your IP address and your device or browser information (user agent). This is kept as evidence in case of a dispute. Operators normally see only a masked version of the IP address. Only an Owner or Admin of the operator's account can reveal the full IP address, and every reveal is logged.
• Client portal access: your email address, used to send you a sign in link (magic link).

3.3 Drivers and receivers

• Driver name and contact details entered by the operator, and use of the driver link sent for a job.
• Proof of delivery captured on the driver link: receiver's name, receiver's signature, photos, the time of delivery and the GPS location of the device at capture.
• Technical information about the device used, such as IP address and browser type, for security.

3.4 Website visitors and demo requests

• Information you give us through the demo or contact form (for example name, company, email, phone, message).
• Basic technical log data.

We do not intentionally collect special personal information (such as health or biometric data) or information about children. A handwritten signature image is captured only as proof of delivery.

4. Why we use it and our lawful basis

We will not use your information for direct marketing by electronic communication unless you have agreed to it or you are an existing customer, as allowed by section 69 of POPIA, and you can opt out at any time. We do not sell personal information.

5. Who we share it with

We share information only as needed to run the service:

• The operator and its team, and the operator's clients, who see the quotes, packs, proof of delivery and documents meant for them.
• Sub-processors that host or deliver parts of the service:

• Authorities or advisers where the law requires it, or to protect our rights or the safety of others.
• A buyer or successor if our business is sold or restructured, under the same protections.

We require sub-processors to keep information confidential and secure, as required by section 21 of POPIA.

6. Transfers outside South Africa

Some of our sub-processors store or process information outside South Africa. We transfer information only where section 72 of POPIA allows it, for example where the recipient is bound by law, binding corporate rules or a contract that gives protection substantially similar to POPIA, or where the transfer is needed to perform the contract with you. Details of locations are in section 5.

7. How long we keep it

• Account and business records: while your account is active, and then for as long as needed for legal, tax and dispute purposes (generally up to 5 years after the record is created or the account closes, [TO CONFIRM]).
• Quote acceptance evidence and proof of delivery: as long as the related job or invoice record exists, and for the dispute and legal period above.
• Logs and IP reveal records: [TO FILL: period, for example 12 months].
• Demo and support requests: up to [TO FILL] after we last dealt with you.

Operators can delete their own records in the service where that function is available, or ask us to delete them. When information is no longer needed, we delete it or make it de-identified.

8. Security

We use reasonable technical and organisational measures, including:

• Encrypted connections (HTTPS) for all traffic.
• Separation of each operator's data at database level (row level security), so one organisation cannot see another's data.
• Unique, hard to guess links for quotes, packs and driver pages, with controlled access to stored files.
• Role based access, masking of IP addresses, and logging of full IP reveals.

No system is perfectly secure. If we become aware of a security compromise affecting personal information, we will notify the Information Regulator and affected people (or the responsible operator) as required by section 22 of POPIA.

9. Your rights

Under POPIA you may:

• ask whether we hold your personal information and request a copy of it;
• ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
• object to processing based on legitimate interest, and to direct marketing;
• withdraw consent where we rely on consent;
• lodge a complaint with the Information Regulator.

Send requests to [TO FILL: privacy email]. We may need to confirm your identity. If your information was loaded by an operator, we will pass your request to that operator or help them answer it. Requests for records may also be dealt with under our PAIA manual [TO FILL: link].

10. Information Regulator

The Information Regulator (South Africa)

• Website: https://inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

[TO CONFIRM these contact details at the time of publishing.]

11. Cookies and similar technology

We use cookies and browser storage that are needed to sign you in, keep your session secure and remember basic settings. We do not use advertising cookies. If we add analytics or other non essential cookies, we will update this policy and ask for consent where required. [TO CONFIRM: check whether any analytics are enabled on the live site.]

12. Changes

We may update this policy. We will post the new version on this page and, for material changes, notify account holders by email.

13. Contact

Questions: [TO FILL: privacy email], or write to the Information Officer at [TO FILL: address].