1. Who we are

ServicePro SA (Pty) Ltd. ("ServicePro SA", "we", "us") operates the ServicePro SA platform — a booking, job management and invoicing system used by vehicle service centres ("Centres") and their customers.

Registration number: 2026/679194/07
Physical address: to be confirmed

2. Our Information Officer

POPIA requires every organisation processing personal information to designate an Information Officer, registered with the Information Regulator of South Africa. Ours is:

Warren Pottas
Email: warren.pottas@serviceprosa.co.za
Information Regulator registration reference: registration in progress

3. What personal information we collect

Depending on how you use ServicePro SA, we may collect:

• Contact details — name, phone number, email address
• Vehicle details — registration, make, model, year, mileage, service history
• Booking and job information — service type, dates, photos taken during inspection, quotes, invoices
• Payment information — processed by our payment provider (PayFast); we do not store full card details ourselves
• Account information — for Centre staff: name, email, role, employment status
• Location information — for staff clock-in/out, to confirm the device is at the service centre at the time (Centre staff only, not customers)
• Communications — messages sent via WhatsApp, SMS or email for booking confirmations, quotes, invoices and service reminders

4. Why we process your information (our lawful basis)

We process personal information where it is necessary to:

• Perform a contract with you or the Centre you're dealing with (e.g. booking and completing a service, generating an invoice)
• Comply with a legal obligation (e.g. financial record-keeping, tax)
• Pursue our or a Centre's legitimate business interests (e.g. sending a service-due reminder), balanced against your rights
• Where required, with your consent (e.g. marketing communications, if ever introduced — none are sent today beyond transactional booking/service messages)

5. Who we share information with

We share personal information only where necessary to operate the service:

• The Centre you're dealing with — your booking, vehicle and job information is visible to the staff of the specific service centre you booked with.
• Service providers we use to run the platform:
  • Google Firebase / Google Cloud Platform — hosting, database and authentication
  • Cloudinary — storage for photos taken during vehicle inspections
  • Twilio and/or Meta (WhatsApp Business) — sending booking, quote and invoice messages
  • SendGrid — sending emails
  • PayFast — processing online payments
  • Sage, Xero or Zoho Books — only where a Centre has connected one of these for its own accounting
• We do not sell personal information to third parties.

6. Where your information is processed (cross-border transfer)

Some of the service providers listed above operate infrastructure outside South Africa (for example, Google Cloud and Cloudinary use international data centres). Where personal information is transferred outside South Africa, we take reasonable steps to ensure it remains protected to a standard consistent with POPIA, including relying on these providers' own data protection commitments and standard contractual safeguards. Our Firebase / Google Cloud infrastructure is hosted in the us-central1 and europe-west1 regions.

7. How long we keep your information

We keep booking, job and invoice records for as long as needed to meet our tax and legal record-keeping obligations (generally 5 years, in line with SARS record-keeping requirements), and for as long as your account with a Centre remains active. You can ask us to delete information that we are not legally required to keep — see Section 9.

8. Security safeguards

We use industry-standard technical and organisational measures to protect personal information, including encrypted connections (HTTPS) throughout the platform, access controls so that Centre staff can only see information relevant to their role and centre, and restricted access to payment and banking details. No system is completely secure, and we continuously review and improve these safeguards.

9. Your rights

Under POPIA, you have the right to:

• Ask us what personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete information we no longer have a lawful basis to keep
• Object to our processing of your information in certain circumstances
• Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za) if you believe we have not handled your information properly

To exercise any of these rights, contact us at warren.pottas@serviceprosa.co.za.

10. Data breach notification

If we become aware of a security compromise that has led, or is likely to have led, to unauthorised access to your personal information, we will notify the Information Regulator and affected individuals as required by POPIA, as soon as reasonably possible.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect the most recent change.

12. Contact us

Questions about this policy or how your information is handled: warren.pottas@serviceprosa.co.za