RunIT — Privacy Policy (POPIA)

Effective date: 10 September 2026 · Version: 2

This Privacy Policy explains how RunIT (Pty) Ltd (registration number 2026/475840/07) ("RunIT", "we", "us") collects, uses, shares and protects your personal information when you use the RunIT apps and services (the "Platform"), in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

It is written to give you the information POPIA section 18 requires us to give you, and it forms part of our Terms of Service.

By using the Platform you acknowledge this Policy. Where the law requires your consent — for special personal information (section 27) and for direct marketing (section 69) — we ask for it separately, and you may withdraw it at any time.

1. Who is responsible for your information

RunIT is the responsible party for the personal information described here.

Our Information Officer is registered with the Information Regulator as POPIA section 55(2) requires. If you want written confirmation of that registration, ask us at support@runitt.co.za and we will send it to you.

2. What personal information we collect

From all users

• Identity & contact: name, mobile number, email, profile photo, preferred language.
• Account & security: login identifiers, device identifiers, OTP verification records.
• Location: the address(es) you save, and the GPS location you provide when creating a booking or (for Workers) when available for jobs and during an active job. Live location is used only for an active booking and is not stored as a continuous history.
• Bookings & communications: your bookings, in-app chat messages, ratings and reviews.
• Payments: transaction records, amounts and references. Your card number, banking login credentials, PIN and one-time passwords are collected and processed by our Payment Partner, never by RunIT — see clause 4.
• Device & diagnostic data: device identifiers, device type, operating system, and crash reports. Crash reports are automatically stripped of email addresses, ID numbers, phone numbers, street addresses and access tokens before they are sent, and carry only your account's internal identifier.
• We do not collect app-usage analytics. RunIT does not track how you move around the apps and does not build a behavioural profile of you.

From Workers (additional)

• Verification (KYC): your South African ID number, a photograph of your government-issued ID, and a selfie. Proof of address may be requested.
• Police clearance certificate and your verification status, including when your certificate expires.
• A referral's name and contact number, which you provide about somebody else. You must have that person's permission before you give us their details.
• Payout information: the bank account holder name, bank, branch code and account number you give us so that we can pay you, and any tax-related information you provide.
• Portfolio images you choose to upload, which are shown publicly on your profile.

2.1 Special personal information (POPIA sections 26, 27 and 33)

Two things we collect from Workers are special personal information, which POPIA section 26 prohibits us from processing unless a specific authorisation applies:

We also rely on section 27(1)(b) — processing necessary for the establishment, exercise or defence of a right or obligation in law — because we owe Customers a duty of care in who we send into their homes.

This processing is voluntary, but it is a condition of working through RunIT. If you do not consent, we cannot verify you and you cannot be activated as a Worker; nothing else on the Platform is affected. You may withdraw your consent at any time by contacting us — we will then deactivate your Worker profile and delete the verification records we are not legally required to keep.

We do not use your face for recognition, surveillance or matching against any other person. The selfie is compared once against your own ID photograph to confirm you are who you say you are.

Children. The Platform is for users 18 and older. We do not knowingly collect the personal information of children (POPIA section 34). If we learn that we have, we delete it.

3. Why we process your information, and our lawful basis

We process personal information for the purposes below, on the section 11 grounds shown. Supply of the information is mandatory where it is marked as such — meaning we cannot provide that part of the service without it — and voluntary otherwise.

What happens if you do not supply it. Where supply is mandatory we cannot create your account, match you, take your payment or pay you out, as the case may be. Declining optional marketing has no effect on your use of the Platform.

We process information only for the purpose it was collected for, or a purpose compatible with it (section 15), and we keep it adequate, relevant and not excessive (section 10).

4. Who we share your information with

We share personal information only as necessary, and every provider below processes it for us as an operator under a written contract requiring the security measures POPIA sections 20, 21 and 19 demand.

• Between Customers and Workers: we share only what each side needs, and only when they need it. A booking may be offered to several Workers at once, so before anyone accepts, those Workers see only the Customer's first name and the suburb — not the surname, street address or phone number. Only the Worker who accepts receives the full service address and booking details. The Customer sees the Worker's name, photo, rating, reviews, portfolio and — during an active job — their live location. Phone numbers are not exchanged; contact happens through in-app chat.
• Our Payment Partner, Ozow (Pty) Ltd — to take payments and process refunds. We share your name, contact details, the amount, the booking reference, and your device and IP information. Ozow, its sponsor banks and its verification providers may also check that the bank account or card you are paying from belongs to you, and may screen the transaction for fraud. Ozow processes this under its own privacy policy at https://ozow.com/privacy-policy/, and processes personal information in South Africa and Ireland. Worker payouts are made by ordinary bank transfer and do not go through the Payment Partner.
• SMS provider — to deliver OTPs and notifications.
• Google / Firebase (FCM) — to deliver push notifications; Google/Apple if you use social sign-in. Firebase Crashlytics also receives crash reports, stripped as described in clause 2.
• Hosting & infrastructure — Supabase (on Amazon Web Services) — to store and process data securely (see clause 5).
• Identity and background-check providers — for Worker vetting, where used.
• Banks, fraud-prevention agencies, regulators and law enforcement — where required by law, or reasonably necessary to prevent, detect or investigate fraud or other crime.
• Professional advisers — where required to establish, exercise or defend a legal right.

We do not sell your personal information, and we do not share it for anyone else's marketing.

5. Cross-border transfer of information (POPIA section 72)

Your personal information — including the biometric verification data and police clearance information described in clause 2.1 — is stored and processed on servers located outside South Africa, in the United Kingdom and the European Union (Amazon Web Services, London and Ireland regions), through our infrastructure provider Supabase. Our Payment Partner processes payment information in South Africa and Ireland.

We rely on section 72(1)(a): each recipient is subject to a binding written agreement that upholds principles for reasonable processing substantially similar to the POPIA conditions, and that restricts onward transfer on substantially similar terms. In practice these agreements enforce UK GDPR and EU GDPR standards — purpose limitation, security safeguards, breach notification, sub-processor control and onward-transfer restrictions — and the UK and EU are themselves subject to data-protection law providing substantially similar protection.

We also rely, where applicable, on section 72(1)(c): the transfer is necessary for the performance of our contract with you.

We do not rely on your consent alone for these transfers, so you do not lose protection by using the Platform. Where consent is additionally required — as for the special personal information in clause 2.1 — we ask for it separately.

6. How long we keep your information

We keep personal information only for as long as necessary for the purposes above, or as required by law (section 14):

• Account and profile: while your account is active, and for a reasonable period afterwards.
• Financial and transaction records: a minimum of seven (7) years, in line with section 24 of the Companies Act 71 of 2008 and SARS record-keeping requirements.
• KYC/verification records: for as long as you are an active Worker, and afterwards only for as long as needed for fraud-prevention and legal compliance.
• Audit and fraud logs: retained for security and legal accountability; the immutable audit log is retained as a permanent record of privileged actions.
• Chat messages and booking history: retained to support disputes and service history, then archived or deleted.

When information is no longer needed we delete or de-identify it, in a way that prevents it being reconstructed (section 14(4)–(5)).

7. How we protect your information (POPIA section 19)

We identify the risks to your information, put safeguards in place against them, check that those safeguards work, and update them as new risks appear. In practice:

• Row-Level Security in the database, so users can only reach their own data;
• encryption in transit and at rest;
• payments handled off-platform — card numbers and banking credentials are entered on the Payment Partner's own PCI DSS systems and never reach RunIT;
• restricted access to banking details, limited to the staff who actually make payouts;
• an immutable, append-only audit log of privileged and administrative actions;
• access controls, fraud detection and least-privilege service design.

If your information is compromised. No system is perfectly secure. If there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after discovering it, as section 22 requires. Our notice to you will describe the possible consequences, what we are doing about it, what you can do to protect yourself, and the identity of the unauthorised person if we know it.

8. Your rights (POPIA section 5)

You have the right to:

• be notified that we are collecting your information, and if it is ever compromised;
• ask whether we hold information about you, and to get access to it (section 23) — we confirm free of charge, and may charge a prescribed fee for copies, telling you the fee first;
• request correction, or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• object, on reasonable grounds relating to your situation, to processing we base on legitimate interests (section 11(3)(a));
• opt out of direct marketing at any time (sections 11(3)(b) and 69);
• withdraw consent where processing is based on it — this does not affect processing already carried out lawfully, and may mean you can no longer use features that depend on it;
• not be subject to a decision based solely on automated processing that significantly affects you (section 71 — see clause 10);
• complain to us and to the Information Regulator (clause 13); and
• institute civil proceedings under section 99.

To exercise any of these, contact our Information Officer at support@runitt.co.za. You can access and update much of your profile, addresses and settings directly in the app. We respond within a reasonable time, and will tell you what we have done (section 24(4)).

8.1 Deleting your account

You can delete your account yourself, from inside the app — Customers at Profile → Delete my account, Workers at Business → Settings & support → Delete my account. If you have uninstalled the app or cannot sign in, email support@runitt.co.za with the subject "Delete my account" and we will verify the request and action it, within 30 days at the latest. The same instructions are published at https://www.runitt.co.za/delete-account so you can reach them without installing anything.

Deletion takes effect immediately and cannot be undone. Your sign-in stops working at once.

Permanently removed: your saved addresses (including your home map pin), your push notification tokens, the contents of messages you sent, any review comments you wrote, your verification records including your ID photograph, selfie and police clearance certificate (except where we are required to keep a record that a check was done), and your name, phone number, email address and profile photo. Your sign-in credentials are detached and permanently disabled.

Retained, but anonymised — no longer linked to your identity: booking and payment records and the money ledger (a minimum of seven years, per section 24 of the Companies Act and SARS requirements), audit and fraud logs, and the rows of messages in a conversation so that the other person's chat history is not left with gaps — the message content itself is replaced with [deleted].

Deletion is refused only while something is genuinely outstanding, and the app tells you which applies: you have an active booking, a payment still held, or an open dispute. This protects you — it prevents money being stranded and stops a dispute losing the evidence needed to decide it. Once none apply, deletion proceeds immediately.

In short: everything that identifies you is removed; the financial record of transactions that actually happened is kept, without your identity attached, because the law requires it of any business that handles payments.

Formal access to records (PAIA). Requests for formal access to company records must be made in accordance with our PAIA Manual at runitt.co.za/legal/paia-manual, or by request to our Information Officer. The Promotion of Access to Information Act 2 of 2000 applies to RunIT's records in addition to your POPIA rights above, and the two are separate routes — you do not need to use PAIA to exercise the POPIA rights in this clause.

9. Direct marketing (POPIA section 69)

We send electronic marketing only where you have opted in, or where you are already our customer and the marketing is for our own similar services — in which case we give you a free and easy chance to refuse, both when we collect your details and in every message we send.

Every marketing message identifies us as the sender and carries an address you can use to tell us to stop (section 69(4)). You can also change your preferences in the app at any time. We never share your details with anyone else for their marketing.

10. Automated processing and automated decisions (POPIA section 71)

We use automated processes to match bookings to nearby Workers, to calculate ratings and standing, and to flag possible fraud. These do not make decisions with legal or similarly significant consequences for you without human involvement: fraud flags are reviewed by a person before any account is suspended.

One automated step does act on its own: when a Worker's police clearance certificate reaches its expiry date, they automatically stop receiving new bookings until they upload a current one. They are warned 30 days beforehand and told again when it happens, work already accepted is unaffected, and it reverses as soon as a valid certificate is supplied. We consider this permitted under section 71(2)(a) as a step in performing our contract, and we apply the safeguards in section 71(3): you may make representations about it and ask a person to look at it, by contacting us.

Wherever an automated outcome significantly affects you, you may request human review at support@runitt.co.za, and we will tell you the reasoning behind the outcome.

11. Cookies and similar technologies

Our apps do not use advertising or behavioural-analytics SDKs. They use device identifiers to deliver push notifications, keep you signed in and remember your preferences, and a crash-reporting SDK as described in clause 2.

Our website uses only the cookies needed to serve the pages. It sets no advertising or tracking cookies, and the legal pages you are reading load no third-party scripts at all.

12. Changes to this Policy

We may update this Policy. We will post the updated version in the app and at https://www.runitt.co.za, and for material changes we will give reasonable notice. The Effective date at the top shows when it last changed.

13. Complaints

Please come to us first — contact our Information Officer at support@runitt.co.za. We acknowledge complaints within 1 business day and aim to resolve them within 5 business days.

You may also complain directly to the Regulator at any time:

Information Regulator (South Africa)

• Complaints: complaints.IR@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Website: https://inforegulator.org.za
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

This Policy forms part of the RunIT Terms of Service.