Privacy Policy

1. Introduction

This Privacy Policy explains how Exequtech (“we”, “us”, or “our”) collects, uses, stores, shares, and protects your personal information when you use any of our products and services (collectively, “the Services”). The Services currently include:

• ExequJobs Mobile Application — a field service management app available on Google Play, used by technicians to manage job cards, capture photos and signatures, and synchronise data with the cloud platform;
• Exequtech Web Application — a browser-based office and administration platform used to manage jobs, users, invoicing, quotations, inventory, and reporting;
• Any future Exequtech products that reference this Privacy Policy at the time of use.

We are committed to protecting your privacy and processing your personal information in accordance with the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) (“POPIA”), the Electronic Communications and Transactions Act, 2002 (Act No. 25 of 2002) (“ECTA”), and all other applicable South African legislation.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of the Services and contact your employer or our support team.

2. Responsible Party & Information Officer

In terms of Section 18(b) of POPIA, the responsible party for the processing of your personal information is:

All requests, enquiries, or complaints regarding the processing of your personal information may be directed to the contact details above. Our Information Officer is responsible for ensuring compliance with POPIA and for addressing any data subject requests.

3. Definitions & Glossary

3.1 Legal Definitions

The following terms, as used in this Policy, bear the meanings assigned to them under POPIA unless the context indicates otherwise:

• “Data Subject” — the natural or juristic person to whom the personal information relates. In the context of our Services, this refers primarily to users of the Services (such as technicians, office staff, and administrators) and, where applicable, the customers whose information is managed within the Services.
• “Personal Information” — information relating to an identifiable, living natural person or an identifiable, existing juristic person, including but not limited to names, contact details, location data, photographs, biometric information, and electronic communications.
• “Processing” — any operation or activity, whether automated or not, concerning personal information, including collection, receipt, recording, organisation, storage, updating, modification, retrieval, consultation, use, dissemination, merging, linking, restriction, degradation, erasure, or destruction.
• “Responsible Party” — the public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing personal information. In this context, Exequtech.
• “Operator” — a person who processes personal information for a responsible party in terms of a contract or mandate.
• “Information Regulator” — the body established under Section 39 of POPIA, responsible for the enforcement of the right to privacy.
• “Consent” — any voluntary, specific, and informed expression of will in terms of which permission is given for the processing of personal information.
• “POPIA” — the Protection of Personal Information Act, 2013 (Act No. 4 of 2013).
• “ECTA” — the Electronic Communications and Transactions Act, 2002 (Act No. 25 of 2002).
• “Services” — all Exequtech products and platforms, including the ExequJobs mobile application, the Exequtech web application, and any future products that reference this Privacy Policy.

3.2 Data Categories

Throughout this Policy, we refer to the following broad categories of personal information. These categories are used to describe what we collect, why, and how long we retain it:

4. Scope & Application

This Privacy Policy applies to all personal information processed through our Services, including data:

• Entered directly by you into any of our Services;
• Synchronised between the Exequtech cloud platform and client applications;
• Captured automatically by our Services (such as GPS coordinates on job status changes, or server access logs);
• Uploaded to cloud storage through our Services (such as photos, receipts, signatures, and documents).

This Policy applies to all users of our Services, including field technicians, office administrators, managers, and any other persons authorised by their employer to access the Services. Where the Services display customer contact information as part of job card or business data, this Policy also covers the processing of that customer data within the Services.

Our Services are typically provided to users through their employer. Your employer may have separate privacy policies and data processing agreements with Exequtech that govern additional aspects of data processing. This Policy covers Exequtech’s responsibilities as the developer and operator of the Services.

4.1 Platform-Specific Notes

• Mobile Application: Data is stored locally on the device in an encrypted database and synchronised with the cloud platform. Device permissions (camera, location, gallery, notifications) control access to certain features. The mobile app uses Google Firebase services for crash reporting and usage analytics, and Google ML Kit for on-device barcode scanning (see Section 9 for details).
• Web Application: Data is accessed and managed through a web browser. The web application uses cookies and browser storage as described in Section 7.

5. Information We Collect

In compliance with Section 18(a) of POPIA, the following describes the personal information we collect and process through our Services. The specific data collected depends on which Service you use and which features you access.

5.1 Data Categories by Service

5.2 Conditional Collection

Not all data categories apply to every user. Where a feature requires additional personal information beyond what is described above, you will be informed at the point of collection and, where required by law, asked to provide your consent before that information is processed.

5.3 Data We Do Not Collect

For clarity, our Services do not collect, access, or transmit the following:

• Device contacts, calendar, SMS, or call log data;
• Clipboard contents;
• Continuous or background location tracking;
• Biometric templates (biometric authentication, where available, is handled entirely by the device’s secure hardware; no biometric data is stored or transmitted by our Services);
• Advertising identifiers or data for marketing or ad-targeting purposes.

6. How and Why We Use Your Data

In compliance with POPIA Section 13 (purpose specification), Section 11 (lawfulness of processing), and Section 18(c) and (f), the following table describes the purposes for which we process each data category and the legal basis on which we rely:

We process your personal information only for the purposes described above or for compatible purposes permitted by law. We do not sell your personal information to third parties. We may send you service-related communications; where these constitute direct marketing, we will provide an easy way to opt out.

You may withdraw consent at any time where processing is based on consent. For mobile device permissions (camera, location, gallery, notifications), you can withdraw consent by revoking the relevant permission in your device’s system settings. Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal. See Section 13 for full details on exercising your rights.

7. Cookies & Browser Storage

7.1 Web Application

The Exequtech web application uses a limited number of cookies and browser storage mechanisms that are strictly necessary for the operation and security of the Service:

Our web application currently uses only strictly necessary cookies for security and authentication, as described above. We do not use advertising cookies. If we introduce analytics cookies in the future, we will update this policy and obtain your consent where required by applicable law.

7.2 Mobile Application

The ExequJobs mobile application does not use cookies or web-based tracking technologies. Authentication tokens are stored in encrypted device storage and are not cookies.

8. Voluntary vs Mandatory Information

In terms of POPIA Section 18(d) and (e), we disclose which information is mandatory and which is voluntary, along with the consequences of not providing it:

8.1 Mandatory Information

The following information is required for the Services to function:

• Authentication Data (email, password, and where applicable, PIN) — required to verify your identity and grant access. Without this, you cannot use the Services.
• Identity and Profile Data — automatically provisioned upon account creation; necessary for the Services to identify you, assign roles, and associate records with your account.
• Content Data (core work records, job data, status changes) — central to the purpose of the Services. Not providing work completion data may mean jobs cannot be marked as complete.

8.2 Voluntary Information

The following information is optional. You may choose not to provide it, with the noted consequences:

• Location Data (mobile app) — if location permission is denied, GPS coordinates will not be recorded with job status events. Your employer may require this for service verification.
• Camera and gallery access (mobile app) — if denied, you will be unable to capture photos, scan barcodes, or photograph receipts within the mobile app.
• Notification permission (mobile app) — if denied, you will not see sync progress notifications. Sync will still function in the background.
• Biometric authentication (mobile app) — if not enabled, PIN entry will be required on every app unlock.
• Free-text fields (photo notes, feedback, follow-up notes) — optional across all Services. Not providing them has no effect on core functionality.

9. Data Sharing & Third Parties

In terms of POPIA Section 18(h)(i), we disclose the categories of recipients of your personal information:

We do not:

• Sell, rent, or trade your personal information to any third party;
• Share your personal information with advertisers or marketing platforms.

Where we engage third-party service providers, they process your data on our behalf under contractual obligations to protect your information.

Your Employer

Your employer, who has contracted Exequtech for service management, has access to the data you enter through the Services via the Exequtech cloud platform. This includes job records, status changes, photos, signatures, location data, financial records, and other work-related information. Your employer’s access to this data is governed by their agreement with Exequtech and their own privacy and employment policies.

10. Cross-Border Data Transfers

In compliance with POPIA Section 72 and Section 18(g), we disclose that your personal information is transferred outside of the Republic of South Africa as follows:

Your personal information is primarily stored and processed within the EU/EEA via the Exequtech cloud platform. In the course of providing our Services, limited personal information may be transferred to other countries where our service providers operate. Where such transfers occur, we ensure appropriate safeguards under POPIA Section 72, including binding data processing agreements with contractual obligations substantially similar to POPIA’s conditions.

11. Data Retention

In terms of POPIA Section 14 (retention limitation), we retain your personal information only for as long as is necessary for the purpose for which it was collected, or as required by law:

When data is no longer required, it is deleted or anonymised. On the mobile app, local data is removed when the app is uninstalled or when the local database is cleared. You or your employer may request deletion of cloud-stored data as described in Section 13.

11.1 Aggregated and Anonymised Data

We may retain anonymised or aggregated data — from which no individual can be identified — indefinitely for business analysis, service improvement, and reporting purposes. Such data is no longer personal information as defined by POPIA and is not subject to the retention limitations above.

12. Data Security

In compliance with POPIA Condition 7 (Security Safeguards), we implement appropriate technical and organisational measures to protect your personal information against loss, damage, unauthorised access, or unlawful processing:

12.1 Encryption

• At rest: Data stored on mobile devices is held in an encrypted database. Credentials and tokens are stored in secure, encrypted device storage. PINs are stored as one-way cryptographic hashes and are never kept in cleartext.
• In transit: All network communications between our Services and servers are encrypted using HTTPS. Unencrypted connections are not permitted. File uploads use time-limited secure links with encrypted transfer.

12.2 Access Controls

• Authentication: Our Services require authentication via email and password. The mobile app adds a second layer of local authentication via PIN or biometric verification.
• Session management: Sessions are managed with short-lived access tokens and automatic refresh. The mobile app enforces idle timeouts and automatic locking. The web application uses secure session cookies.
• Account lockout: Repeated failed authentication attempts result in automatic account lockout.
• Role-based access: Users can only access data appropriate to their role and assignments.

12.3 Infrastructure & Organisational Measures

• Access to the Exequtech cloud platform and its infrastructure is restricted to authorised personnel.
• Operators (third-party service providers) are contractually required to maintain appropriate security measures in accordance with POPIA.
• Sensitive data is never written to application logs.
• On the mobile app, authentication credentials and encryption keys are excluded from device cloud backups.

12.4 Data Breach Notification

In the event of a security compromise involving your personal information, we will notify the Information Regulator and affected data subjects as required by POPIA Section 22, and take immediate steps to contain the breach and mitigate harm.

12.5 Your Responsibilities

You are responsible for keeping your login credentials, PIN, and any other authentication information confidential. You should not share your account credentials with any other person. If you believe your credentials have been compromised, you should change your password immediately and contact your employer or our support team at support@exequtech.com.

We regularly review and update our security practices to reflect current industry standards and evolving threats. Specific technical details regarding our security measures are available on request by contacting support@exequtech.com.

13. Your Rights as a Data Subject

Under POPIA Section 5 and Condition 8, and in compliance with Section 18(h)(iii)–(v), you have the following rights regarding your personal information:

13.1 Right of Access (POPIA s23)

You have the right to request confirmation of whether we hold personal information about you, and to request a copy of that information. We will respond to access requests within a reasonable time, and no later than the timeframes prescribed by POPIA.

13.2 Right to Correction (POPIA s24)

You have the right to request that we correct or update personal information about you that is inaccurate, misleading, or incomplete. Certain information (such as your user profile) may be managed by your employer through the cloud platform; corrections to employer-managed data should be directed to your employer.

13.3 Right to Deletion (POPIA s24)

You have the right to request the deletion or destruction of personal information that we are no longer authorised to retain, or that is no longer necessary for the purpose for which it was collected. Note that we may be required to retain certain records for legal or contractual compliance.

13.4 Right to Object (POPIA s11(3))

You have the right to object, on reasonable grounds relating to your particular situation, to the processing of your personal information. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

13.5 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw consent at any time. For mobile device permissions (camera, location, gallery, notifications), you can withdraw consent by revoking the relevant permission in your device’s system settings. Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal.

13.6 Data Portability

Upon request, we can provide you or your employer with an export of your personal information in a commonly used, machine-readable format. To request a data export, please contact us at support@exequtech.com.

13.7 Right to Complain to the Information Regulator

You have the right to lodge a complaint with the Information Regulator if you believe that your personal information has been processed in violation of POPIA. See Section 21 for the Information Regulator’s contact details.

How to Exercise Your Rights

To exercise any of the rights described above, please contact us at support@exequtech.com. We may need to verify your identity before processing your request. We will respond within a reasonable period, and in any event within the timeframes required by POPIA.

14. Children’s Privacy

Our Services are workplace tools intended for use by employed or contracted personnel. They are not directed at, designed for, or intended for use by children under the age of 18. We do not knowingly collect personal information from children.

If we become aware that we have inadvertently collected personal information from a person under 18, we will take steps to delete such information promptly. If you believe a child has provided personal information through our Services, please contact us immediately at support@exequtech.com.

15. Automated Decision-Making

Our Services may use automated tools to assist with operational functions such as scheduling or workload management. All final decisions with legal or similarly significant effects are made by human operators—you, your employer, or your team.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the functionality of our Services, or applicable law. When we make material changes:

• The updated policy will be published at the same URL where this policy is hosted;
• The “Effective Date” and “Last Updated” dates at the top of this policy will be revised;
• Where practicable, we will notify you through our Services (e.g., via an in-app notice, a banner in the web application, or update notes) or via your employer.

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes your acceptance of the updated policy.

17. Third-Party Links

Our Services may contain links to, or integrations with, third-party websites, applications, or services that are not operated by Exequtech. If you follow a link to any third-party service, please note that the third party has its own privacy policy and practices.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We encourage you to read the privacy policy of every website or service you visit or use.

18. Business Transfers

In the event that Exequtech is involved in a merger, acquisition, reorganisation, sale of assets, or similar business transaction, your personal information may be transferred as part of that transaction. In such circumstances:

• We will ensure that the acquiring or successor entity is bound by the terms of this Privacy Policy until a new or amended privacy policy is communicated to you;
• You will be notified of any such transfer and any changes to the processing of your personal information, in accordance with applicable law;
• Your rights under POPIA will continue to be respected throughout and after any such transfer.

19. Limitation of Liability & Warranty Disclaimer

19.1 Warranty Disclaimer

Our Services are provided “as is” and “as available” without warranties of any kind, whether express or implied, to the fullest extent permitted by applicable South African law, including the Consumer Protection Act, 2008 (Act No. 68 of 2008) (“CPA”). We do not warrant that the Services will be uninterrupted, error-free, or free of harmful components.

19.2 Limitation of Liability

To the maximum extent permitted by law, Exequtech shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising out of or related to your use of the Services, including but not limited to loss of data, loss of profits, or business interruption.

Nothing in this section excludes or limits liability for:

• Fraud or fraudulent misrepresentation;
• Gross negligence or wilful misconduct;
• Any liability that cannot be excluded or limited under South African law, including the CPA where applicable;
• Death or personal injury caused by negligence.

19.3 Indemnification

You agree to indemnify and hold harmless Exequtech, its directors, employees, and agents from and against any claims, damages, losses, or expenses (including reasonable legal fees) arising from your misuse of the Services or violation of this Privacy Policy, to the extent permitted by applicable law.

20. Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of South Africa, including POPIA, ECTA, and the CPA where applicable.

Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Republic of South Africa.

21. Information Regulator

If you are dissatisfied with our handling of your personal information, you have the right to lodge a complaint with South Africa’s Information Regulator:

22. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal information, please contact us:

We will endeavour to respond to all enquiries within a reasonable timeframe.