Privacy Policy

1. Who we are
2. Information we collect
3. Special personal information
4. How we collect it
5. Why we process it
6. Lawful basis
7. Who we share it with
8. Cross-border transfers
9. How long we keep it
10. How we protect it
11. Your rights & deletion
12. Automated processing
13. Direct marketing
14. Cookies & notifications
15. Children
16. Contact & complaints

1 Who we are

GreenHand ("GreenHand", "we", "us") operates the online marketplace at www.greenhand.co.za that connects South African homeowners with independent garden service professionals. For the purposes of the Protection of Personal Information Act 4 of 2013 ("POPIA"), GreenHand is the Responsible Party for the personal information described in this policy.

This policy explains what personal information we collect, why, how we use and share it, how long we keep it, and the rights you have. It applies to everyone who uses GreenHand — homeowners ("Clients"), garden professionals ("Gardeners") and visitors.

Information Officer: privacy@greenhand.co.za

2 Information we collect

Depending on how you use GreenHand, we may collect:

Category	Examples
Account & identity	Name, email address, phone number, password (stored one-way hashed), user type (Client/Gardener), and nationality status where relevant to work authorisation.
Verification documents (Clients)	ID document or passport, proof of address (utility bill or bank statement not older than 3 months), and a clear photo of yourself — required before your first payment, to keep the community safe and to meet identity-verification obligations.
Verification documents (Gardeners)	ID document or passport, a clear photo of yourself, proof of address, SAPS police clearance certificate, a recent bank statement confirming your payout account, and optionally a work reference. Business Gardeners: CIPC registration, business bank confirmation and optionally tax clearance. Foreign nationals: a valid work permit/visa, Section 22 asylum permit or Section 24 refugee status document.
Location & property	Home or service address, suburb, city, province, property/garden details, approximate map coordinates used to match nearby Gardeners, and GPS check-in location (with an optional arrival photo) when a Gardener starts a job.
Banking & payment	For Gardeners: bank account details for payouts. Card details are entered directly with our payment provider (Paystack) and are never stored by GreenHand. If you choose to save a card for faster checkout, we store only a secure token issued by Paystack — not your card number, CVV or expiry date.
Marketplace activity	Job posts and photos, quotes, bookings (including recurring schedules), messages between users, reviews and ratings (Clients rate Gardeners publicly; Gardeners may rate Clients privately), work-completion photos, dispute and support-ticket information, and referral codes and reward history.
Technical & usage	IP address, device and browser type, log data, and actions taken on the platform (used for security and to improve the service).

3 Special personal information

Some verification information is treated by POPIA as special personal information or otherwise carries a higher duty of care, including:

Criminal-record information — the SAPS police clearance certificate we require from Gardeners, because Gardeners work in and around Clients' homes;
Identity numbers — contained in ID documents and passports; and
Immigration documents — work permits, asylum (Section 22) and refugee (Section 24) documents from foreign-national users.

We process this information with your consent (given when you upload the documents), and because it is necessary to protect the safety of users of the platform, to verify identity in line with anti-money-laundering and identity-verification practice, and to confirm the legal right to work in South Africa. It is used only for vetting and verification — never for marketing — is visible only to our verification team, and is stored and retained as described in sections 9 and 10.

4 How we collect it

Directly from you — when you register, complete your profile, upload verification documents, post a job, send a quote, message another user, leave a review, or contact support.
Automatically — through your device and browser as you use the platform (technical/usage data), and location data when a Gardener uses GPS check-in.
From third parties — our payment provider confirms payment, refund and payout status; address look-ups use mapping/geocoding services to convert your address into map coordinates.

5 Why we process your information

To create and manage your account, and to vet and verify users before they can transact (see section 3).
To match Clients with nearby Gardeners and enable job posting, quoting, booking (including recurring bookings) and messaging.
To process payments, hold funds in escrow, release payouts, apply referral or loyalty rewards, and handle refunds and cancellations.
To provide GPS check-in, job tracking and completion confirmation.
To resolve disputes and support tickets and enforce our Terms and Conditions.
To send transactional communications (verification, booking, payment, payout and support messages) by email, in-app notification and — where you enable them — browser push or phone-based messages.
To keep the platform secure, prevent fraud and abuse, and comply with our legal obligations.
To improve and maintain the service.

6 Lawful basis for processing

We process your personal information where it is:

Necessary to perform our contract with you (providing the marketplace and completing your bookings);
Based on your consent, which you give at registration and when uploading verification documents, and can withdraw at any time (withdrawing consent for verification documents may mean we can no longer offer you a verified account);
Necessary to comply with a legal obligation (including financial record-keeping and identity-verification obligations); or
Necessary for our legitimate interests (such as user safety, security, fraud prevention and improving the service), balanced against your rights.

7 Who we share it with

We do not sell your personal information. We share it only as needed to run the service, with:

Other users, as required by the transaction — e.g. a Client and the Gardener they book share relevant contact, location and job details so the work can be done. Verification documents are never shared with other users; other users see only your verification status.
Operators (service providers) acting on our instructions, including:
- Paystack — payment, escrow, refund and card-token processing;
- Vultr — cloud hosting, with our servers located in Johannesburg, South Africa;
- our transactional email delivery provider;
- OpenStreetMap/Nominatim and Google Maps — address geocoding and maps;
- Sentry — error monitoring (technical error data); and
- our uptime monitoring provider (no personal information — it only checks that the site is up).
Authorities or advisors where required by law.

Operators may access personal information only as needed to deliver their service to us, strictly on our instructions, and are bound to keep it secure.

8 Cross-border transfers

Our application and database servers are located in South Africa (Johannesburg). Some Operators process limited data outside South Africa — for example, error-monitoring and email-delivery providers process technical data and email addresses on servers in the United States or Europe. Where personal information is transferred across borders, we take reasonable steps to ensure it receives a level of protection comparable to POPIA, including through the provider's contractual and security commitments (section 72 of POPIA).

9 How long we keep it

Identity-verification records (ID, proof of address and related documents) are retained for 5 years in line with South African financial-sector identity-verification and record-keeping practice (FICA), measured from the end of the relationship or the relevant transaction.
Booking, payment, payout and dispute records are retained for the period required by tax and accounting law.
Messages, reviews and job content are kept while your account is active, to preserve the integrity of the marketplace history.
Other information is kept only as long as necessary for the purposes in section 5.

When information is no longer needed, we securely delete or de-identify it. We use soft-deletion for some records to preserve the integrity of booking and financial history; soft-deleted records are no longer visible on the platform.

10 How we protect it

All traffic to the platform is encrypted using HTTPS/TLS.
Passwords are stored using strong one-way hashing — we never store them in plain text.
GreenHand never stores your card number, CVV or expiry date — saved cards are held as secure Paystack tokens only.
Verification documents are stored outside the public web root and are accessible only to authorised verification staff through authenticated admin routes.
Access to personal information is restricted to authorised personnel who need it, with role-based admin permissions.
We maintain security monitoring, automated error alerting and off-site database backups, and take reasonable technical and organisational measures to guard against loss, unauthorised access and misuse, as required by section 19 of POPIA.

            No system is perfectly secure. If we become aware of a compromise of your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.
        

11 Your rights & account deletion

You have the right to:

Access the personal information we hold about you;
Correct or update inaccurate or incomplete information (much of which you can edit in your profile);
Request deletion or destruction of your information, subject to the retention obligations in section 9;
Object to processing in certain circumstances, and withdraw consent you previously gave;
Not be subject to a decision based solely on automated processing that significantly affects you (see section 12); and
Lodge a complaint with the Information Regulator (see section 16).

Deleting your account: you can request account deletion from within the platform or by emailing our Information Officer. We will action the request within a reasonable time, retaining only what section 9 and applicable law require us to keep, and will confirm the outcome to you.

For any request we may need to verify your identity before acting on it.

12 Automated processing

We use automated processing to suggest matches (for example, showing Gardeners jobs within their chosen service radius) and to route notifications. Decisions that significantly affect you — such as approving verification documents, resolving disputes, or suspending an account — are made by a person, not solely by automated means.

13 Direct marketing

We send transactional messages (bookings, payments, verification, support) as part of operating the service — these are not marketing. We will only send you direct marketing by electronic means in line with section 69 of POPIA: where you are an existing customer and the message concerns similar services, or where you have consented. Every marketing message will include a working opt-out, and we will honour opt-outs immediately. Referral invitations are sent by you, not by us, when you choose to share your referral link.

14 Cookies, local storage & notifications

We use essential cookies and local storage to keep you signed in, keep the platform secure (session and CSRF protection), and remember basic preferences. These are necessary for the site to function. We do not use them to build advertising profiles. You can control cookies through your browser settings, but disabling essential cookies may prevent parts of the platform from working.

If you install GreenHand as an app (PWA) or enable browser push notifications, your browser stores app data locally and may receive notifications; you can revoke notification permission in your browser or device settings at any time.

15 Children's privacy

GreenHand is intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

16 Contact us & complaints

GreenHand Information Officer

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with:

The Information Regulator (South Africa)
Website: inforegulator.org.za
Email: enquiries@inforegulator.org.za · complaints: POPIAComplaints@inforegulator.org.za

This Privacy Policy should be read together with our Terms and Conditions, Refund & Cancellation Policy and Delivery Policy.

Table of Contents