Privacy policy

1. Who we are

WebScheduler (Pty) Ltd, registration number 2026/138798/07, is a South African technology company providing online scheduling, appointment-booking, business listing and related Software as a Service (SaaS) services.

This Privacy Policy explains how WebScheduler (Pty) Ltd collects, uses, stores, protects and otherwise processes personal information in connection with WebScheduler Local, our local business discovery and visibility platform.

WebScheduler Local provides a platform where businesses, professionals and service providers can create and maintain public business profiles that help people discover local services and businesses in South Africa.

We process personal information in accordance with applicable South African data-protection requirements, including the Protection of Personal Information Act, 2013 (POPIA).

2. Company details

• Registered name — WebScheduler (Pty) Ltd
• Registration number — 2026/138798/07
• Contact number — 076 829 7070
• Email — [email protected]
• Website — webscheduler.co.za

3. The WebScheduler Listing Service

The WebScheduler Listing Service allows businesses and service providers to create and maintain an online business profile.

A listing may contain information such as:

• Business or trading name
• Business category
• Business description
• Qualifications or professional credentials
• Operating hours
• Services offered
• Business location
• Contact details
• Website and social-media links
• Booking links
• Business logo and photographs
• Information about delivery, card payments and online bookings

Businesses and service providers are responsible for ensuring that information they submit to the service is accurate and that they have the necessary authority to provide any personal information included in their listing.

Because the purpose of WebScheduler Local is to provide a public business discovery platform, information included in a published listing may be visible to anyone and may be indexed by search engines.

You should therefore not submit personal information that you do not want to make publicly available.

The email address used to verify and manage a listing is not displayed publicly as part of the listing.

4. Hosting and technology infrastructure

Our services are hosted using infrastructure provided by Amazon Web Services (AWS).

Our application infrastructure is currently hosted in the AWS Asia Pacific (Mumbai) Region (ap-south-1). This means that information processed through our application infrastructure may be stored and processed outside South Africa.

We may also use third-party service providers that process information in other countries. These arrangements are described further under Cross-border transfers and Who we share information with.

We may change our hosting region, infrastructure or service providers as the platform develops. Where such changes materially affect the processing or cross-border transfer of personal information, we will update this Privacy Policy as appropriate.

The platform currently uses a PHP-based application architecture, including PHP and CodeIgniter 4, with MySQL/MariaDB databases and modern web technologies.

We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These measures include HTTPS/TLS encryption, access controls, application-level authorisation and other security controls appropriate to the services we provide.

Our technology stack and infrastructure may be updated, replaced or expanded from time to time.

5. Information you provide when creating a business listing

Creating a business listing is voluntary.

When you submit a business through Create your free business profile, we may collect:

Business information

• Trading or business name
• Business category
• Business description
• Qualifications or credentials
• Operating hours
• Whether you accept card payments
• Whether you offer delivery
• Whether you accept online bookings, and a link to your online booking page

Contact information

• Contact person's name and title (kept for administration and not published on your profile)
• Email address
• Telephone number
• Website address
• Social-media links

Location information

• Street address
• Suburb
• City
• Province
• Postal code
• Map coordinates derived from the submitted location information

Images

• Business logo
• Gallery photographs

Most of this information forms part of the public business profile and is therefore intended for publication.

6. Verified Business badge

Applying for a Verified Business badge is optional. A business listing can operate without verification.

If you choose to apply, we may request:

• A company registration document for the business; and
• An identity document for the business owner, such as an identity card, identity document or passport.

These documents are not published and do not form part of the public business profile.

Verification documents are stored separately from publicly accessible listing information and are protected against direct public access. Access is restricted to authorised personnel through the administrative system, with access activity recorded.

We seek to collect only the information reasonably necessary to perform the verification process. We do not intentionally reproduce or publish information contained in the submitted documents as part of the public listing.

The verification process records the outcome of the review, together with relevant administrative information such as who performed the review and when.

The Verified Business badge itself is the only verification information displayed publicly.

7. Information you provide when contacting us

If you contact us through a contact form, we may receive:

• Your name
• Your email address
• The subject of your message, if provided
• The contents of your message
• Technical information such as your IP address where required for security and abuse prevention

Messages submitted through the contact form are sent to our designated email system for handling.

We use this information to respond to your enquiry, provide assistance and address potential misuse of the service.

Newsletter

The newsletter sign-up in the footer of every page is a separate, deliberate opt-in. It sends your email address to our own mailing system at updates.webscheduler.co.za. We then email you a confirmation link, and you are added to the list only when you click it, so an address entered by somebody else never ends up subscribed. Adding a business listing does not subscribe you to this newsletter — the listing carries its own monthly analytics report instead, which is switched on by default and described under “Email services” below.

Once you are subscribed we keep your email address, the date you confirmed, and ordinary delivery records (whether a message reached you, and whether you opened it or clicked a link in it) so that the list works and unsubscribes are honoured. Every newsletter carries an unsubscribe link.

Recommending a business

If you use Recommend a business, we receive the business details you enter (its name, category, area, email address, phone number and, if you give one, its website) and your name, your email address, how you know the business and your reason for recommending it. We also keep a one-way hash of your IP address to limit abuse. Nothing you enter is published.

We review each recommendation. We do not contact the business automatically. If we decide to invite it, we send it one email. That email may mention your first name if you said you are a customer. It never includes your email address. The email contains a link that stops us ever sending another invitation to that address, whoever recommends it. If you asked us to, we email you once when the business is listed.

Businesses: if you received an invitation, the details in it came from the person who recommended you. You can ask us to delete them at any time through the contact form.

8. The Jobs board

The Jobs board carries job vacancies and requests for a service. What we receive depends on how you use it.

If you post a job or a request

• Your name, email address and, optionally, phone number. These are never published. We use them to confirm the post, to tell you when it is live, closing or declined, and to pass on applications and replies.
• The content of the post — title, description, area, company name, pay or budget — which is published while the post is open and may be indexed by search engines, including Google for Jobs.

If you post from a listed business, the post shows the business's name and links to its profile.

If you apply for a job

The name, email address, optional phone number, optional CV link and message you enter are sent by email to the address the employer gave for applications, with your email address set as the reply address. We do not store the application. You are asked to agree to this before it is sent. Once the employer receives it, the employer decides how it is used and is responsible for it under POPIA.

If your business replies to a request

Your message, together with your business name, profile link, phone number and email address, is sent to the person who posted the request. We keep your message and a record that you replied, so that each business replies only once and the reply limit is applied. The requester's own email address is not shown to you unless they reply.

Request alerts to listed businesses

When a request for a service is published, we may email it to a small number of listed businesses in the same category and province. The email contains the request as published and a link to it; it does not contain the requester's contact details. These alerts are on for listed businesses by default, and can be switched off from any alert or from Manage your profile.

Reports

If you report a post, we keep the reason you give and a one-way hash of your IP address, so that one visitor's reports count once. The hash cannot be turned back into your IP address.

9. Information collected automatically

When you use WebScheduler Local, certain information may be processed automatically.

IP addresses

We may process IP addresses for security purposes, including rate-limiting abusive traffic involving search, mapping, address lookup, owner login and administrative functions.

Where an IP address is hashed for rate-limiting or security purposes, it is not intended to be used to create a personal profile or associate browsing activity with a particular business listing.

Analytics

Analytics information is collected only where you have provided the applicable cookie consent.

Further information is provided in our Cookie Policy.

Approximate location

If you select Use my location on the search page, your browser may request permission to provide your approximate location.

You can refuse this request.

Where you allow access, the location information is used to help sort search results by distance for that search. We do not intentionally store your location for the purpose of building a personal location profile.

10. Why we process personal information

We process personal information for purposes including:

Purpose	Basis for processing
Creating and publishing a business profile	Consent provided when you submit and verify the listing
Sending verification and profile-management links	Necessary to provide the service you requested
Responding to enquiries submitted through the contact form	Necessary to respond to your request
Reviewing documents for a Verified Business badge	Consent provided when you submit the documents and processing necessary to provide the requested verification service
Processing payment for the Verified Business badge	Necessary to perform the agreement for the service
Confirming, reviewing and publishing a Jobs board post, and emailing the poster about it	Consent provided when you submit the post, and processing necessary to provide the service you requested
Passing a job application to the employer	Your consent, given on the application form before it is sent
Passing a listed business's reply to the person who asked for a service	Necessary to provide the service both of you requested
Emailing listed businesses about matching service requests	Our legitimate interest, and theirs, in connecting requests with businesses that offer the service. On by default and can be switched off at any time
Security, rate-limiting and fraud prevention	Necessary for the security, integrity and availability of the service
Sending a profile owner the monthly analytics report about their own listing	Necessary to provide the service you requested, and our legitimate interest in showing you how your listing performs. It is on by default and you can switch it off at any time, at signup, in Manage your profile, or from any report
Sending the newsletter to people who signed up for it	Your consent, confirmed by clicking the link we email you, which you can withdraw at any time
Analytics	Consent, where applicable

We do not sell personal information.

11. Who we share information with

We do not sell personal information or share personal information with third parties for their own advertising purposes.

Information may be disclosed or made available in the following circumstances:

Public business listings

Information that you choose to publish as part of a business profile is publicly accessible and may be indexed by search engines.

Mapping and address services

We may use mapping and geocoding services to convert an address into geographic coordinates and display or support location-based search functionality.

For example, the address entered on a listing form, including as you type it, may be sent to Mapbox for address suggestions and geocoding. See Mapbox's privacy policy. The address may also be sent to OpenStreetMap's Nominatim service. See the OSM Foundation privacy policy. These requests are made by our server, not your browser, so neither service receives your IP address from them.

Mapping services such as CARTO may also receive technical information, including your IP address, when your browser loads map content directly from their infrastructure. See CARTO's privacy policy.

Analytics

Where you have provided the required cookie consent, we may use Google Analytics or another analytics service to understand how the service is used.

Email services

We use an email service provider to deliver verification, profile-management and other necessary service communications.

The newsletter, and the monthly analytics report to profile owners who have it switched on, are sent through our own mailing system at updates.webscheduler.co.za. While the report is switched on we pass the owner's email address, contact name and business name to that system; when it is switched off, we mark them there as not to be contacted.

Employers, requesters and listed businesses

On the Jobs board, a job application is sent to the employer it is addressed to, and a business's reply is sent to the person who asked for the service, as described in section 8. A request for a service, as published, may be emailed to listed businesses; the requester's contact details are not included.

Payment processing

If you purchase a Verified Business badge, payment processing is handled by PayFast. See PayFast's privacy policy.

Payment information is processed through PayFast's payment environment. We do not store your full card details on our servers.

Verification documents, including identity and company-registration documents, are not provided to PayFast for payment processing.

Legal requirements

We may disclose information where required or permitted by applicable law, including in response to a valid court order, legal process or lawful request from an authorised authority.

12. Cross-border transfers

Because our application infrastructure is currently hosted in the AWS Asia Pacific (Mumbai) Region, personal information processed through that infrastructure may be transferred to and processed outside South Africa.

Some third-party service providers used by WebScheduler Local may also process information outside South Africa.

Where personal information is transferred across borders, we take reasonable steps to ensure that the transfer is undertaken in accordance with applicable requirements of POPIA, including the requirements applicable to cross-border transfers under section 72.

Depending on the service involved, this may include reliance on contractual protections, data-processing terms, applicable regulatory safeguards and other appropriate measures provided by our service providers.

13. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the relevant service, to comply with legal obligations, resolve disputes, enforce agreements and protect the security of our services.

Business listings

A published business profile may remain available until:

• You request its removal;
• You remove it using the available profile-management functionality; or
• We remove it in accordance with our terms or applicable requirements.

Unverified submissions may expire and be deleted if they are not completed within the applicable verification period.

Consent records

We keep a record of when you accepted our terms and of your analytics email choice — when you switched it on or off, and where — for as long as your business listing exists, so that we can show what you chose and make sure an opt-out is respected.

Verification links

Verification and profile-management links are designed to expire after limited periods for security purposes.

Deleted profiles

Where technically appropriate, deleted profiles may initially be soft-deleted before being permanently removed. This allows us to address accidental deletion and maintain appropriate system integrity.

Jobs board

• A post whose email address is never confirmed is deleted about a week after its confirmation link expires.
• A poster's name, email address and phone number, and the address applications were sent to, are deleted 12 months after the post closes, expires or is declined. The published text of the post may be kept as a record.
• Replies to service requests are kept with the request, and their messages are deleted 12 months after it ends.
• Job applications are not stored.

Recommendations

The contact details in a recommendation, both the business's and yours, are deleted 12 months after it is submitted, or 30 days after we decide not to invite the business, whichever is sooner. If a business asks not to be invited again, we keep only a one-way hash of its email address so that we can honour the request.

Verified Business documents

Verification documents are retained while the Verified Business badge remains active or paused, where reasonably necessary to support the verification status.

Where a Verified Business subscription lapses or an application is rejected, the associated verification documents are retained for up to 12 months from that point and are then deleted automatically. This period allows us to answer a billing or verification query raised after the fact.

If you submit replacement verification documents, the documents they replace are retained for up to 90 days and are then deleted automatically.

Verification documents are deleted in full when the associated business listing is deleted.

You may request deletion of verification documents. Where appropriate, we will process the request while considering any applicable legal, contractual or operational requirements.

14. Your rights under POPIA

Subject to applicable legal requirements and limitations, you may have the right to:

• Request confirmation of whether we hold personal information about you;
• Request access to personal information we hold about you;
• Request correction or updating of inaccurate or incomplete information;
• Request deletion of personal information where applicable;
• Withdraw consent where processing is based on consent;
• Object to certain processing activities where applicable; and
• Lodge a complaint concerning the processing of your personal information.

Where profile-management functionality is available, you can also update or remove your business listing directly using Manage your profile.

You can stop the monthly analytics report at any time, free of charge, using the unsubscribe link in any report or the email preferences in Manage your profile. Opting out does not stop the service emails your listing needs, such as profile-management links.

You may contact us using the details provided below if you wish to exercise a right or make a privacy-related request.

15. Complaints

If you believe that your personal information has been processed unlawfully or that your privacy rights have not been adequately addressed, you may contact us first so that we can investigate and attempt to resolve the matter.

You may also lodge a complaint with the Information Regulator of South Africa through its official channels — inforegulator.org.za.

16. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, loss, alteration, misuse or destruction.

The WebScheduler Local website is served using HTTPS/TLS.

Where available, profile-management access may use single-use, time-limited emailed links rather than a traditional stored password.

However, no internet-based service can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of information transmitted to or stored by the service.

17. Children

WebScheduler Local is intended for businesses, professionals and service providers and is not directed at children.

We do not knowingly seek to collect personal information from children under the age of 18 through the business listing service.

If you believe that a child has provided personal information to us, please contact us so that we can investigate and take appropriate action.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or information-processing practices.

When we make changes, we will update the Last updated date displayed at the beginning of this policy.

Where we make a material change that affects how we process personal information already provided to us, we may provide additional notice where appropriate, including by email to affected profile owners.

19. Contact us

If you have questions about this Privacy Policy, want to exercise a privacy right, or have a concern about how your personal information is being processed, please contact us:

• WebScheduler (Pty) Ltd
• Registration number — 2026/138798/07
• Telephone — 076 829 7070
• Email — [email protected]
• Website — webscheduler.co.za

We will consider and respond to privacy-related requests in accordance with applicable legal requirements.