Privacy Policy

This Privacy Policy explains how OpDesk (Pty) Ltd (registration number 2026/648649/07, "OpDesk", "we", "us") collects, uses, and protects personal information, in compliance with the Protection of Personal Information Act, 2013 ("POPIA"). This policy covers both the OpDesk operations management platform and RollingRover Productions, our web design service — RollingRover operates under OpDesk (Pty) Ltd rather than as a separate legal entity, and this single policy applies to both.

OpDesk is registered with the Information Regulator of South Africa under registration number 2026-066318.

1. An important distinction: when OpDesk is the "responsible party" vs. the "operator"

Under POPIA, this distinction matters, and we want to be upfront about it rather than blur the two together:

• For information you give us directly — creating an OpDesk account, your business details, billing information, or a RollingRover web design enquiry — OpDesk is the responsible party. We determine why and how that information is processed, and this policy describes that processing.
• For guest, booking, and staff information that an OpDesk customer (a lodge, tour operator, or other business using our platform) enters into their own OpDesk account — OpDesk acts only as an operator (broadly equivalent to a data processor) on that customer's behalf. That customer is the responsible party for their own guests' and staff's personal information, and their own privacy policy — not this one — governs how they use it. We process it only on their instructions, to provide the platform, and do not use it for our own separate purposes.

2. Information we collect

Depending on how you interact with us, we may collect:

• Account information: name, email address, phone number, business name, operator type, and password (stored in encrypted/hashed form, never in plain text).
• Billing information: billing currency, subscription plan, and payment confirmation records. We do not directly store your card details — payments are handled by PayFast, a licensed South African payment gateway.
• RollingRover enquiries: name, email, phone, business name, and project details submitted through our web design quote request form.
• Support and communication records: support tickets, and the content of emails or messages you send us.
• Technical information: IP-derived approximate location (used only to suggest a likely local currency on our pricing page), browser type, and general usage data.

3. Why we process your information

We process personal information for the following purposes, consistent with POPIA's conditions for lawful processing:

• To create and administer your account, and to provide the OpDesk platform (necessary to perform our contract with you).
• To process billing and subscription payments.
• To respond to support requests and RollingRover project enquiries.
• To send service-related communications (e.g. billing notices, support updates) and, where you have consented, product or marketing updates.
• To maintain the security, integrity, and reliability of the platform.
• To comply with our legal obligations, including tax, accounting, and regulatory recordkeeping.

4. Who we share information with

We do not sell personal information. We share it only with service providers who help us operate the platform, each acting under our instruction as an operator in POPIA terms:

• Supabase — database hosting and authentication.
• Vercel — application hosting and infrastructure.
• PayFast — payment processing.
• Resend — transactional email delivery (billing notices, support updates).

Some of these providers may process information on servers located outside South Africa. Where this occurs, we rely on the safeguards POPIA permits for cross-border transfer, including that the recipient is subject to a law, binding agreement, or contractual terms that provide an adequate level of protection substantially similar to POPIA's conditions.

5. How we protect your information

We use technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, role-based access control, row-level database security so one customer's data is never visible to another, and restricted administrative access. No system is perfectly secure, but we take reasonable steps to prevent loss, unauthorised access, and unlawful processing.

6. How long we keep it

We retain personal information for as long as your account is active, plus a reasonable period afterward to meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When no longer needed, we take reasonable steps to delete or anonymise it.

7. Your rights

Under POPIA, you have the right to:

• Be notified that we hold your personal information, and what we hold.
• Request access to the personal information we hold about you.
• Request correction of inaccurate, outdated, or incomplete information.
• Request deletion or destruction of personal information we no longer have a lawful basis to retain.
• Object to processing of your personal information in certain circumstances, including for direct marketing.
• Withdraw consent, where processing is based on consent, at any time.
• Lodge a complaint with the Information Regulator (contact details below) if you believe we've handled your information unlawfully.

To exercise any of these rights, contact our Information Officer using the details in section 9. We may need to verify your identity before acting on a request.

8. Cookies

We use essential cookies required for the platform to function (such as keeping you signed in), and limited technical data to detect your approximate region for currency display purposes. We do not use third-party advertising or tracking cookies.

9. Our Information Officer

Douw Gerbrand Grobler is OpDesk's registered Information Officer (appointed 1 September 2026), registered with the Information Regulator under registration number 2026-066318.

To make a request, ask a question, or raise a concern about how we handle personal information, contact: central@opdesk.app

10. Complaints to the Information Regulator

If you're not satisfied with our response, you may lodge a complaint with the Information Regulator of South Africa:

Website: inforegulator.org.za
Email: complaints.IR@justice.gov.za

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. We'll update the "last updated" date above when we do. Material changes will be communicated to registered account holders by email.