Privacy policy

This Privacy policy explains how InstallPass, trading as InstallPass ("InstallPass", "we", "us" or "our"), handles personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA").

It applies to:

• installers and trade businesses who use InstallPass ("Subscribers"), and people who use their accounts;
• homeowners, tenants, property owners and other customers whose details installers record, and anyone who scans a tag, looks up their units or submits a booking request; and
• website visitors, including people who send us a contact or demo enquiry.

In short: installers use InstallPass to keep records of the units they install and service. We host that information, show a public passport page when a tag is scanned, pass on booking requests and send reminders. We don't sell personal information, and we don't use installers' customer details for our own marketing.

"Personal information" has the meaning given in POPIA. It covers information about an identifiable, living person and, where applicable, an identifiable existing juristic person such as a company.

InstallPass is operated by:

• Name: InstallPass, trading as InstallPass
• Registration number: available on request
• Address: available on request
• Email: info@installpass.com
• Phone: available on request
• Website: https://installpass.com

Our Information Officer is our Information Officer, who can be contacted at info@installpass.com. Please contact our Information Officer with any questions about this policy, requests to exercise your rights, or privacy complaints.

POPIA distinguishes between a "responsible party", which decides why and how personal information is processed, and an "operator", which processes personal information on behalf of a responsible party. Our role depends on the information concerned.

Installers' customer and unit records: the installer is the responsible party and InstallPass is the operator. When an installer loads a customer's name, mobile number, email address, property address, unit details, photos or documents, the installer decides what to record and why. We process that information on the installer's instructions under our Terms and conditions. If you are an installer's customer, the installer should tell you how they use your information and is usually the best first point of contact. We will help you reach them, or help them respond to you.

Booking requests. When you submit a booking request, you are sending your details to the installer, who is responsible for how they use them to respond to you. We deliver the request and store it in the installer's account as their operator. We may also use limited information about requests to keep InstallPass secure and prevent abuse.

InstallPass is the responsible party for:

• installer and subscriber account, billing and order information;
• contact and demo enquiries sent through our website;
• scan logs, homeowner look-ups, and usage and technical information that we use to run, secure and improve InstallPass; and
• our own marketing communications.

When you sign up for or use InstallPass as an installer, we collect:

• Account and business information: your name, business name, email address, mobile or phone number, login details, trade, and business details you choose to show on passport pages, such as your logo and business contact details.
• Subscription and billing information: your plan, billing history, invoices, and payment confirmations and references from our payment provider. We don't receive or store your full card number.
• Tag order information: delivery name, address and phone number, so that our courier can deliver your order.
• Records you create: units, photos, documents, customer details, booking requests and service history. Where these contain personal information about your customers, we process it as your operator.
• Usage and device information: sign-ins, the features you use, IP address, browser and device type, and error logs.
• Communications: emails, support requests and feedback you send us.
• Integration information: API usage, and data exchanged with services you connect, such as QuoteGenio.

Information marked as required when you sign up, subscribe or place an order is needed to create your account, provide the service, process your payment or deliver your order. If you don't provide it, we won't be able to do those things. Other information is voluntary. We also keep billing records because tax and accounting laws require us to.

Records loaded by installers. An installer may record your name, mobile number, email address, property address, details and service history of units at your property, photos and documents (such as Certificates of Compliance), and whether you have agreed to receive reminders. We receive this information from the installer, not directly from you, and process it as the installer's operator.

Booking requests. When you submit a booking request from a passport page, we collect your name, mobile number, email address (optional), the reason for your request, your description, preferred dates, any photos you add, and your confirmation that you consent to your details being shared with the installer. Your name and mobile number are required so that the installer can respond. Without them we can't send your request.

Tag scans. When a passport page is opened, we record the time and your device and browser information (the "user agent"), and we count the number of scans. Our hosting providers may also record IP addresses in server logs for security purposes. We use scan logs to run and secure InstallPass and to show installers how often their tags are scanned. We don't use them to identify you.

Homeowner look-ups and one time codes. (For legal review.) Before we show you the units linked to your details, we check that the details are yours. You enter a mobile number or email address, and we email a six digit code to the address the installer has on file. We store the destination you entered, a one way hash of the code, a one way hash of the internet address the request came from, the time, and how many times a code was tried. We never store the code itself, and the hashed internet address is used only to stop the code system being abused. The code lasts 10 minutes and the session it opens lasts 30 minutes, after which you verify again. Codes and look-up records are kept for up to 24 months and then deleted or turned into de-identified statistics. Units belonging to our own demo company are shown without a code, because they contain no real customer information.

Contact and demo enquiries. When you send us an enquiry, we collect your name, email address, phone number, company and message. We use this information to respond to you, arrange a demo if you asked for one, and follow up on your enquiry. Your name, email address and message are needed so that we can respond.

Browsing information. When you visit our website, we collect general technical and usage information, such as the pages you view, the time of your visit, the referring page, and your browser and device type. We use privacy-friendly analytics for this, and essential browser storage to keep you signed in. Our Cookie policy has the details.

Fair use of free tools. So that the free rating plate reader can't be run up by one visitor or a bot, we record a one-way hash of your internet address with the outcome of each read, and count those records against an hourly and a daily limit. The hash is salted, can't be turned back into an address, and isn't used to identify you or to build any profile. We never store your actual internet address for this.

POPIA requires a lawful ground for processing personal information (section 11). We use personal information on the following grounds:

1. To perform a contract. We create and manage accounts, host unit records, show passport pages, deliver booking requests, send reminders and service emails, process payments, deliver tag orders and provide support. For installers' customer information, we do this on the installer's instructions.
2. With consent. Examples include booking requests submitted with the consent checkbox, reminder opt-ins and marketing to people who aren't our customers. You can withdraw your consent at any time. Withdrawing consent doesn't affect processing that happened before you withdrew it.
3. For legitimate interests. We keep InstallPass secure, prevent fraud and abuse, log scans, analyse usage to improve our service, respond to enquiries, enforce our Terms and establish or defend legal claims. Reminding a homeowner that a service is due or a warranty is ending also protects their own legitimate interests. We balance these interests against your rights, and you can object (see section 15).
4. To comply with the law. We keep tax and accounting records, respond to lawful requests from authorities and meet our obligations under POPIA and other laws.

We only collect information that is adequate, relevant and not excessive for these purposes. We don't use it for purposes that are incompatible with the reasons we collected it.

Reminders to installers' customers. On the installer's behalf, InstallPass sends automated reminder emails when a service is due within 30 days, when a service is 14 days overdue, and when a warranty ends within 60 days. These go to customers whom the installer has recorded as opted in. Otherwise, they go to the installer.

Each reminder identifies the installer and explains how to stop receiving reminders. You can opt out at any time by following the instructions in the email, by asking the installer, or by emailing info@installpass.com. We will act on your request promptly. We never use installers' customer details to market InstallPass or any other business.

Our own marketing. Section 69 of POPIA regulates direct marketing by electronic communication. We only send marketing by email or other electronic messages, never by SMS, and only if:

• you have consented; or
• you are an existing customer, we obtained your details when you bought a product or service from us, the marketing is about our own similar products or services, and you were given a chance to object when we collected your details.

If you are not a customer, we may contact you once to ask for your consent, and we won't contact you again for marketing if you refuse.

Every marketing message identifies us and includes a free, easy way to opt out. You can also unsubscribe at any time by emailing info@installpass.com. On request, we will tell you where we obtained your contact details.

Service messages, such as billing notices, security alerts, booking notifications and notices of changes to our Terms, are not marketing. You will continue to receive them while you have an account.

When an installer uploads a photo of a unit's rating plate, we send the image to an AI service provider. The provider reads the printed text, such as brand, model, serial number and capacity, and returns it to pre-fill the unit details. The installer reviews the details and can correct them before saving.

Rating plates don't usually contain personal information, but photos can accidentally show people, addresses or other details. We ask installers to frame photos on the rating plate only.

The AI provider processes images on our behalf so that it can return the results, and it may be located outside South Africa (see section 12). We don't use automated reading to make decisions about any person. In particular, InstallPass does not make decisions based solely on automated processing that have legal consequences for you or affect you to a substantial degree (section 71 of POPIA).

The free plate reader on our website. Anyone can use the reader at What is this? without signing in. We don't store the photo at all: it is sent inside a single request to the AI service, read once, and the result is returned to your browser and to nobody else. It is never saved to our file storage, never published, never attached to a record and never linked to you, and no account or unit is created from it. We don't keep the values that were read either. If you then start a trial from that page, those values travel in your own browser only, and the installer app clears them once it has filled in the form. Please don't photograph anything other than a rating plate.

A passport page can be viewed by anyone who scans the tag, or who has the page link or tag code. The page shows unit details, the installer's business details, warranty status, the next service date and service history.

The installer chooses how much else is shown:

• Standard visibility also shows photos, documents and the property address.
• Basic visibility hides photos, documents and the property address.

We don't show the customer's name, mobile number or email address on the public page.

If you own or live at the property and are concerned about what a passport page shows, including if you have recently bought the property, you can ask the installer to switch the unit to basic visibility or remove a document. You can also contact us at info@installpass.com, and we will work with the installer to address your concern. Where there is a risk of harm, we may restrict the page ourselves.

We don't sell personal information. We share it only as follows:

• The installer who owns the unit record. Booking requests, reminder activity and scan counts are shared with the installer linked to the tag, and homeowner look-up results come from installers' records.
• People viewing public passport pages, as described in section 10.
• Service providers (operators) who host our website and database, deliver emails, provide automated image reading, provide analytics or help us support users. They may only use the information to provide their services to us and must keep it confidential and secure.
• Our payment provider (currently Paystack), to process payments. The payment provider also processes some payment information under its own privacy policy.
• Couriers, who receive delivery details for tag orders.
• Integrations you connect, such as QuoteGenio, when you instruct us to share information with them.
• Professional advisers, such as lawyers, auditors and insurers, who are bound by confidentiality.
• Authorities, where the law, a court order or a regulator requires it, or where it is necessary to protect the rights, property or safety of InstallPass, our users or the public, or to prevent fraud.
• A buyer or successor, if our business or part of it is sold or restructured. They must protect personal information in line with this policy.

Some of our service providers, such as our hosting, infrastructure, email delivery, AI and analytics providers, store or process information on servers outside South Africa.

Section 72 of POPIA allows personal information to be transferred outside South Africa only in certain cases, including where:

• the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, substantially similar to POPIA;
• you consent to the transfer;
• the transfer is necessary to perform a contract with you, or a contract concluded in your interest; or
• another condition in section 72 applies.

We take reasonable steps to choose providers that protect personal information appropriately and to ensure that transfers meet these requirements. Contact our Information Officer if you'd like more information about where your information is processed and the safeguards in place.

We keep personal information only for as long as we need it for the purposes described in this policy, unless the law requires or allows us to keep it for longer (section 14 of POPIA). As a guide:

• Account and business information is kept while your account is active, and for up to 12 months after it ends, unless we need it for longer to resolve disputes or meet legal obligations.
• Billing and transaction records are kept for at least five years, or longer where tax or company laws require it.
• Unit and customer records are kept for as long as the installer's account is active, and in line with the installer's instructions. After the account ends, they are handled as described in our Terms and conditions. They remain available for export for 30 days and are then deleted or de-identified, except for limited unit information needed to keep a basic passport page (without customer contact details) and information we must keep by law.
• Booking requests form part of the installer's records while the account is active.
• Scan logs, look-up records and one time verification codes are kept for up to 24 months, after which they are deleted or turned into de-identified statistics. Verification codes hold a hash of the code and of the requesting internet address, never the code itself.
• Enquiries are kept for up to 24 months after our last contact with you, unless you become a customer.
• Marketing opt-outs are kept so that we continue to respect your choice.

Deleted information may remain in secure backups for a limited period until those backups are overwritten.

Section 19 of POPIA requires us to take appropriate, reasonable technical and organisational measures to protect personal information. Our safeguards include:

• encrypting data in transit (HTTPS);
• access controls, so that installers can only see their own records and our staff access information only when they need to;
• account authentication;
• using a payment provider to handle card payments, so we don't store full card details;
• written agreements requiring our operators to keep information secure and confidential; and
• monitoring our systems and reviewing our safeguards regularly.

No system is completely secure, so please keep your password safe and tell us immediately at info@installpass.com if you suspect unauthorised access to your account.

Security compromises. If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible, as required by section 22 of POPIA, unless a law enforcement agency or the Information Regulator tells us to delay notification. Where we act as an installer's operator, we will notify the installer immediately and help them meet their obligations.

Under POPIA, you have the right to:

• Access your information (section 23). You can ask us to confirm, free of charge, whether we hold personal information about you, and ask for a record or description of it. A prescribed fee may apply to some requests under the Promotion of Access to Information Act 2 of 2000 ("PAIA"). If so, we will tell you the fee before we process your request.
• Correct or delete your information (section 24). You can ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to delete information we are no longer allowed to keep.
• Object. You can object, on reasonable grounds, to processing based on legitimate interests, and you can object at any time to direct marketing.
• Withdraw consent where we rely on your consent.
• Not be subject to decisions based solely on automated processing that have legal consequences for you or affect you to a substantial degree.
• Complain to the Information Regulator.

How to make a request. Email our Information Officer at info@installpass.com. We will need to verify your identity before acting on your request. We will respond within a reasonable time, and within 30 days where PAIA applies. Where we are required to have a PAIA manual, it is available on request.

Requests about installers' records. Where we hold your information as an installer's operator, we will pass your request on to the installer or help them respond. Where appropriate, for example to prevent harm, we may also act directly, such as by restricting what a passport page shows.

Complaints. We'd appreciate the chance to resolve your concern first, so please contact our Information Officer. You also have the right to lodge a complaint with the Information Regulator of South Africa. Its website is www.inforegulator.org.za.

InstallPass is not directed at children under 18. Installer accounts are only available to people aged 18 or older, and booking requests should be submitted by an adult.

We don't knowingly collect personal information directly from children. Installers should not upload information about children. If you believe that a child's personal information has been provided to us without the consent of a parent or guardian, please contact us at info@installpass.com and we will delete it.

We use essential browser storage, for example to keep you signed in, and privacy-friendly analytics to understand how our pages are used. We don't use advertising cookies.

Our Cookie policy explains what we use and how you can control it.

We may update this policy from time to time, for example when we add features or when the law changes. We will publish the updated policy on this page with a new effective date. If we make material changes, we will tell subscribers by email or in the app, and we may ask you to acknowledge the updated policy when you next sign in.

For questions, requests or complaints about privacy, please contact:

• Information Officer: our Information Officer, info@installpass.com
• General support: info@installpass.com or available on request
• Address: available on request

You can also read our Terms and conditions and Cookie policy.