Privacy Notice

1. Who is responsible for your information

Whack Art and Design CC (registration number 2008/127838/23) ("Whack Art and Design", "we", "us" or "our") supplies WorkTanx and is the data controller (or responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA")) for account administration, billing, service security, product improvement, benchmarking, marketing and enquiries, including under the UK General Data Protection Regulation ("UK GDPR") and the EU General Data Protection Regulation ("EU GDPR") where they apply. For personal information you enter about your clients, helpers or team, the workspace owner is the responsible party and determines its use, and we process it as an operator (a "processor" under the UK GDPR and EU GDPR) on the workspace owner's behalf under our Terms & Conditions (including the processing terms in clause 5). The workspace owner is responsible for telling those people how their information is used and for dealing with their requests, and we will assist where required.

Contact our Information Officer, Reg Pakari, with privacy questions or with requests to exercise your rights under section 6 through our Contact Us page (choose “Privacy / POPIA Request”). Please identify the account and request without including passwords or unnecessary sensitive information. We have not appointed a data protection officer, as we are not required to do so.

2. What we collect and why

• Account and workspace information: names, email addresses, sign-in credentials managed by our authentication service, workspace names, membership, roles, settings and invite records, to create accounts, authenticate you and manage access.
• Project information: tasks, messages, mentions, client and supplier contact details, quotes, costs, approvals, documents, photos, site addresses, contracts and activity records, to deliver the tracking, collaboration and reporting features you use.
• Location and time information: GPS coordinates, site-check locations, travel logs, odometer images and time entries when you choose to record them, to support maps, site verification, travel and time tracking. Photos may include metadata. We do not require continuous location tracking.
• Support and AI inputs: contact-form names, email addresses and messages, chatbot questions and supplier documents you submit for AI reading, to answer enquiries or return suggestions. Do not submit special personal information (such as information about health, religious beliefs, race, biometrics or criminal behaviour), children's personal information, passwords or banking details to AI features.
• Technical information: IP addresses, browser/device information and diagnostic, usage or error records, to operate the service, troubleshoot problems and prevent abuse.
• Subscription records: plan, subscription and transaction references, status, amounts, currency and billing dates, to manage your access and purchase history. Paddle handles payment details; WorkTanx does not store your full payment-card number.

Providing information to us is voluntary. However, if you do not provide information that we mark as required (such as your name and email address), we will not be able to create your account or provide the relevant features. We collect most information directly from you or your workspace, and some technical information automatically when you use the service.

3. Grounds for using information

We use information as necessary to perform our agreement with you (account access and requested features), for legitimate interests in running, securing and improving the service and responding to enquiries, to meet legal obligations, and on the basis of consent where required, such as optional device permissions. Where processing concerns someone else, you must have a lawful basis to provide their information. We do not use project content to send unsolicited marketing. We send electronic marketing about our own similar products and services only to existing customers, or otherwise with your prior consent, and you may opt out in every message, as required by section 69 of POPIA and, for UK or EEA users, applicable electronic marketing laws.

We also create aggregated and de-identified information from use of the service (including pricing, cost and workflow information) that does not identify you, your clients, your suppliers or any individual, and we use it to compile benchmark rates and to improve the service. Information that has been de-identified so that it cannot be re-identified is not personal information to which POPIA applies.

Lawful bases (UK and EEA users). Where the UK GDPR or EU GDPR applies, we rely on: the performance of our contract with you, to create and manage your account and provide the features you use (Article 6(1)(b)); our legitimate interests in operating, securing, supporting and improving the service, preventing abuse, analysing Tanko questions and creating de-identified benchmark data, which we have balanced against your rights (Article 6(1)(f)); compliance with our legal obligations, such as tax and accounting record-keeping (Article 6(1)(c)); and your consent, for optional device permissions such as location, for electronic marketing where consent is required and for any non-essential cookies (Article 6(1)(a)). Where we rely on our legitimate interests, you may object as explained in section 6.

4. Who information is shared with

• Authorised people in your workspace and clients to whom you or an administrator grant portal or review access, limited by the access settings you choose.
• Service providers for hosting, data storage, authentication, email, diagnostics, maps and AI processing, including Lovable Cloud and the providers it uses, and third-party AI model providers (such as OpenAI) for AI processing, to operate those features. These providers process information on our instructions and are bound by confidentiality and security obligations. Map and externally hosted resource providers may receive technical request information.
• Paddle, our Merchant of Record, for product sales, subscription management, payments, tax compliance and invoicing. Paddle also processes information independently under its Privacy Notice.
• Professional advisers, such as legal and accounting advisers, subject to confidentiality, and authorities when disclosure is required by law or necessary to protect legal rights.
• A company in our group, or a purchaser of, or investor in, all or part of our business, subject to confidentiality, if we sell or restructure our business.

Questions you ask Tanko, our in-app assistant, are recorded with your workspace name, account email and the date so we can improve guidance and fix gaps in help content. Do not include passwords, banking details or other sensitive information in Tanko questions.

We do not sell your personal information.

5. Retention and deletion

Account and workspace records are retained for the duration of your subscription. After cancellation or termination, we give you an opportunity to export your content, and we delete or anonymise it 90 days later. Closing or archiving a project, or cancelling a subscription, is not a deletion request. Support and diagnostic information is retained only as long as needed to resolve enquiries, secure the service or meet legal requirements, and in any event for no longer than 12 months unless needed for an ongoing investigation or legal requirement. Tanko questions are retained for 24 months. Billing and approval records may be retained for applicable tax, accounting, dispute or legal obligations (generally for 5 years, as tax legislation requires).

You can delete eligible content using the available controls or request deletion from our Information Officer (see section 1). Information no longer needed is deleted or anonymised, subject to legal retention obligations and the normal expiry of backup copies (within 35 days). Some shared records belong to a workspace; contact its administrator about those records.

6. Your rights

Subject to applicable law, you may request access to your information, correction, deletion, restriction of processing or an objection to processing, and withdraw consent without affecting earlier lawful processing. Where applicable, you may request portability. We may need to verify your identity and consider the rights of others before fulfilling a request. You may also request access to records we hold under the Promotion of Access to Information Act 2 of 2000 by submitting a request through our Contact Us page. We respond to requests within a reasonable time and, where that Act applies, within the periods it prescribes.

South African users may complain to the Information Regulator at inforegulator.org.za. Where UK or EEA data-protection law applies, you also have the rights of access, rectification, erasure, restriction, portability, objection and consent withdrawal, the right to object at any time to processing for direct marketing purposes and to processing based on our legitimate interests, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and may complain to your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk). We respond to those requests within one month, with lawful extensions notified where necessary.

7. Security and international processing

Your workspace content is confidential to your workspace. We restrict access to your project information, costs, messages, approvals and uploaded media to our personnel and service providers who need it for technical maintenance, to resolve a support issue you have raised, to secure the service or to comply with a legal obligation, and who are bound by confidentiality obligations. That access is controlled and reviewed.

We use appropriate technical and organisational safeguards, including encrypted connections, access controls and workspace-scoped permissions. No system can guarantee absolute security; keep your sign-in details private and report suspected unauthorised access. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected persons as section 22 of POPIA requires or, where we process the information as an operator, notify the workspace owner immediately.

Our providers may process information outside South Africa, including in the United States, and, for UK or EEA users, outside the UK or EEA. We transfer personal information outside South Africa only as section 72 of POPIA permits, including where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection. Where personal information of UK or EEA users is transferred to a country that has not been recognised as providing adequate protection (which currently includes South Africa), we rely on the European Commission's standard contractual clauses and, for the UK, the International Data Transfer Agreement or the International Data Transfer Addendum, or on another lawful transfer mechanism. Contact us for information about safeguards relevant to your data.

8. Cookies and browser storage

Essential cookies or browser storage support sign-in, security, preferences, device-local timers and installation state. Your browser can clear or block these, but doing so may sign you out, reset local settings or prevent features from working. Embedded payment checkout and external services may use their own cookies under their privacy notices.

WorkTanx does not currently provide optional advertising-cookie controls. If optional analytics or marketing cookies are introduced, we will explain them and request consent where required before using them. You can manage cookies and site storage in your browser settings and change device permissions there.

9. Changes to this notice

We may update this notice as the service or legal requirements change. The date above identifies the latest version; we will notify you of material changes by email or in WorkTanx before they take effect. Previous versions are available on request.

10. Children, special personal information and automated decisions

WorkTanx is not intended for use by anyone under 18, and we do not knowingly collect children's personal information. Do not upload special personal information (such as information about health, religious beliefs, race, biometrics or criminal behaviour) or children's personal information unless you have a lawful basis under POPIA to do so. AI features provide suggestions only. We do not make decisions about anyone based solely on automated processing that have legal consequences or a similarly significant effect, as contemplated by section 71 of POPIA.