Privacy Policy

Forgify (Pty) Ltd is the “responsible party” under POPIA for personal information we collect through our website and apps. Where a contractor uses Forgify to handle their own customers’ details (for example, on a quote or invoice), the contractor decides why and how that information is used, and Forgify acts as their operator.

Our Information Officer can be contacted at admin@forgify.co.za for any question about this policy or your information.

We collect the following, depending on how you use Forgify:

• Account details: name, email address, phone number, password (stored only in hashed form by our authentication provider) and whether you have enabled multi-factor authentication.
• Contractor profile: trade and services, business name, service area, bio, years of experience, photos, and public registration or VAT numbers you choose to show.
• Verification information (contractors): identity document, a selfie or liveness check, and business or trade registration documents where we run verification. A selfie or liveness check can involve biometric information, which POPIA treats as special personal information. We process it only with your explicit consent, which we ask for before you submit it.
• Payout details (contractors): bank name, account holder name and account number, used only to pay out money owed to you.
• Work records: quote requests, quotes, invoices, jobs, photos, reviews, reports, and the customer and contractor details that appear on them.
• Payment records: transaction references and status. We never see or store full card numbers.
• Technical data: IP address, browser and device type, log-in times, and security and error logs.
• Messages to us: support requests, complaints and feedback.

We collect information from you directly, from the payment provider (payment status), and, where we run verification, from the verification process. We do not knowingly collect information from anyone under 18.

We process personal information only for a specific, lawful purpose, and only what is needed for it.

• To provide Forgify (create and secure your account, list contractors, send quote requests, generate quotes, invoices and job documents, track jobs, collect and pay out money). Basis: it is necessary to carry out our contract with you.
• To verify contractors so customers can judge who they are hiring. Basis: our legitimate interests and customers’ legitimate interests in trust and fraud prevention; your consent for biometric information.
• To keep Forgify safe: prevent fraud and abuse, detect security incidents, and enforce our Terms. Basis: legitimate interests.
• To meet legal duties such as tax, VAT and accounting record-keeping. Basis: legal obligation.
• To communicate with you: service messages (quote and invoice notices, security alerts, reminders you request). Basis: contract and legitimate interests.
• To improve Forgify using aggregated or de-identified usage information. Basis: legitimate interests.

We do not sell your personal information. We do not make decisions that have legal consequences for you based solely on automated processing.

We send you promotional messages only if you have opted in, or, where POPIA allows it, as an existing customer about similar services, and only after giving you a chance to refuse. Every marketing message includes a simple way to opt out, and you can also email admin@forgify.co.za. Service messages such as security alerts and messages about your own quotes and invoices are not marketing.

We share personal information only as needed, with:

• Other users. A contractor’s public profile is visible to anyone. When you request a quote, or a quote or invoice is issued to you, the other party sees the details needed for the job, such as your name and contact details.
• Service providers (operators) who process information on our behalf under written agreements that require them to keep it secure and use it only for our purposes: Amazon Web Services (hosting, database, file storage, user authentication and email), Cloudflare (network security and content delivery), Paystack (payments), and, when we switch them on, a WhatsApp messaging provider, an identity-verification provider and an error-monitoring provider.
• Authorities and advisers where the law requires it, or to protect rights, safety or against fraud, including SARS, the Information Regulator, law enforcement, and our professional advisers.
• A successor to the business if Forgify is sold or restructured, on terms that keep your information protected.

Our database, file storage and authentication run in Amazon Web Services’ Africa (Cape Town) region. However, some processing happens outside South Africa:

• Our website is rendered on servers in Ireland (eu-west-1). Pages that display your information are prepared there from data fetched from South Africa. We do not store personal information in Ireland, but it passes through and is processed there temporarily.
• Our traffic passes through Cloudflare’s global network, so requests may be handled in data centres in other countries.
• Some of our other providers may process limited information abroad.

Where information leaves South Africa, we transfer it only to a recipient that is subject to law, binding rules or a binding agreement that gives a level of protection substantially similar to POPIA (section 72), or where the transfer is necessary to perform our contract with you or you have consented.

Card and bank payments are handled by our payment provider, Paystack, using its hosted checkout. Your card details go to Paystack, not to Forgify, and are subject to Paystack’s own privacy policy. We keep the transaction reference, amount and status so we can match a payment to an invoice. Contractor bank details are stored so that we can pay you out, and are never shown on a public profile.

We use only cookies that are strictly necessary to run Forgify. They keep you logged in (session and refresh cookies, which are marked HTTP-only and secure so scripts cannot read them) and protect against attacks. We do not use advertising or cross-site tracking cookies. If we add analytics or any non-essential cookies in future, we will update this policy and ask for your consent where the law requires.

We keep personal information only as long as we need it for the purpose it was collected for, or as the law requires, and then delete or de-identify it.

• Account and profile information: while your account is active, and for a short period after closure to handle disputes and queries.
• Invoices, quotes, payment and audit records: for at least five years, because tax and VAT legislation, including the Tax Administration Act 28 of 2011 and the VAT Act 89 of 1991, requires it. This continues after an account is closed.
• Verification documents and biometric information: only as long as needed to complete and evidence the verification decision, after which they are deleted or restricted, unless the law requires longer.
• Security and access logs: for a limited period, to investigate incidents.

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised access to your information (POPIA section 19). They include encryption in transit and on our hosting infrastructure, role-based access controls, restricted and logged access to verification data, hashed passwords, optional multi-factor authentication, rate-limiting of log-in attempts, and tamper-evident invoice records. No system is perfectly secure, and you should use a strong, unique password and enable multi-factor authentication.

If there are reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.

Under POPIA you have the right to:

• ask whether we hold your personal information and get a copy of it;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• ask us to delete information we are no longer entitled to keep (we must still keep some records where the law requires it, as explained in section 9);
• object, on reasonable grounds, to our processing, and object at any time to direct marketing;
• withdraw consent where we rely on it, without affecting processing done before you withdrew;
• not be subject to a decision with legal effect based solely on automated processing;
• complain to the Information Regulator, and take civil action for interference with your information.

To use these rights, email admin@forgify.co.za from the address on your account. We may need to verify your identity, and we will respond within a reasonable time, normally within 30 days. You can update most of your details yourself in your account settings.

Information Regulator (South Africa): inforegulator.org.za, complaints: POPIAComplaints@inforegulator.org.za.

Forgify is for people aged 18 and over. We do not knowingly process the personal information of children. If you believe a child has given us information, contact us and we will delete it.

Forgify may link to sites and services we do not run, such as our payment provider’s checkout. This policy does not cover them, so please read their policies.

We may update this policy as our services or the law change. We will post the new version with an updated date and, for material changes, give reasonable notice, for example by email or in the app. Our Terms of Service explain the rest of how Forgify works.

Forgify (Pty) Ltd, Information Officer: admin@forgify.co.za.