Privacy Policy

Document Version: 2026.08 · Effective Date: 4 August 2026
Governing Law: Republic of South Africa · Registration Number: 2025/154379/07

BOSS GLOBAL (PTY) LTD, trading as Fixit by Bond Boss ("Company", "we", "us", "our"), respects your privacy and is committed to protecting your personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA).

This Privacy Policy explains:

• what personal information we collect;
• how we collect it;
• why we collect it (purposes);
• who we share it with;
• how we protect it;
• how long we keep it; and
• what rights you have regarding your information.

This Policy applies to:

• Customers (homeowners or property occupiers who request services);
• Contractors and Servicers (who provide repair services through our Platform);
• Site Inspectors (who review work on our behalf); and
• any other individual who interacts with our Platform, website, or app.

By using the Fixit by Bond Boss Platform, you confirm that you have read and understood this Privacy Policy.

Information Officer
The Company has appointed an Information Officer who is responsible for overseeing POPIA compliance. All privacy-related queries, access requests, or complaints should be directed to:
Information Officer
Email: support@bondboss.co.za
Postal Address: Shop 14, Gardens Mall, 170 Bram Fischer Drive, Randburg, Gauteng, 2194, Republic of South Africa.

2. What Personal Information We Collect

We collect different categories of personal information depending on whether you are a Customer, Contractor, or Inspector.

A. Information We Collect from Customers (Homeowners)

• Identity and Contact Details: Full name, email address, phone number, physical address (property location), and preferred contact method.
• Property Information: Details about your property (type, age, construction materials), specific problem descriptions (damp, cracks, leaks, and similar issues), photographs and videos of the issue, and access instructions.
• Job and Transaction Data: Service requests, job history, quotes, invoices, payment records, and warranty certificates.
• Communication Data: In-app messages, voice call records (duration only – calls are not recorded), and email correspondence.
• Device and Technical Data: IP address, device type, operating system, app version, and crash logs for diagnostic purposes.
• Location Data: Approximate location for service area matching (foreground location only – never collected in the background).
• Ratings and Feedback: Reviews, ratings, and feedback you provide about Contractors and services.

B. Information We Collect from Contractors and Servicers

• Identity and Contact Details: Full name, South African ID number or passport number, email address, phone number, physical address, and proof of address.
• Professional and Verification Data: Trade certifications, qualifications, references, criminal background check results (where legally permissible), proof of insurance, tax registration number (SARS), and bank account details for payouts.
• Job and Performance Data: Job history, acceptance rates, completion rates, inspection scores, customer ratings, uploaded photos of completed work, and warranty records.
• Communication Data: In-app messages, voice call records (duration only), and email correspondence.
• Device and Technical Data: IP address, device type, operating system, app version, and crash logs.
• Location Data: Foreground location to confirm attendance at job sites (never collected in the background).

C. Information We Collect from Site Inspectors

We collect identity, contact, verification, job, and performance data necessary to perform inspection duties, on the same basis as Contractors.

D. Information We Collect Automatically

When you use our Platform, we automatically collect:

• cookies and similar tracking technologies to improve app performance and user experience;
• usage data (pages visited, features used, time spent); and
• device information as described above.

3. How We Collect Your Information

We collect personal information through the following channels:

• Directly from you: when you register, create a profile, submit a service request, accept a Job, upload photos, complete forms, send messages, or contact us via support.
• Automatically: through your use of our Platform via cookies, logs, and device permissions.
• From third parties (with your consent or where lawful):
  • Contractors, when they provide feedback or updates on your Job;
  • payment service providers, to process transactions;
  • references or trade bodies, for Contractor verification;
  • credit bureaus or background check providers, for Contractor screening where legally permitted; and
  • referral partners who introduce you to our Platform.

4. Why We Process Your Information (Purposes) and Legal Bases

We process your personal information for the following purposes, each supported by a lawful basis under POPIA:

• To create and manage your account: based on your consent when you register and necessary for the performance of a contract.
• To match Customers with Contractors and facilitate service delivery: necessary for the performance of a contract (the service agreement).
• To process payments and issue invoices and receipts: necessary for the performance of a contract and compliance with legal obligations (tax and accounting laws).
• To communicate with you about your Job, quotes, updates, and receipts: necessary for the performance of a contract and legitimate interest in keeping you informed.
• To verify Contractor identity, qualifications, and insurance: necessary for the performance of a contract and legitimate interest in ensuring quality and safety.
• To manage Site Inspections and quality assurance: legitimate interest in maintaining service quality and brand reputation.
• To handle disputes, warranty claims, and revisions: necessary for the performance of a contract and legitimate interest.
• To send you marketing communications only where you have opted in: consent (opt-in is required for electronic marketing).
• To improve our Platform, analyse trends, and fix bugs: legitimate interest in improving our service.
• To comply with legal and regulatory obligations (SARS, POPIA, CPA, OHSA): compliance with a legal obligation.
• To detect, prevent, and investigate fraud or misconduct: legitimate interest in protecting our business and users.
• To defend or establish legal claims: legitimate interest in protecting our legal rights.

5. Who We Share Your Information With (Recipients)

We may share your personal information with the following categories of recipients, only to the extent necessary to fulfil the purposes listed above:

• Contractors and Servicers (as Operators under POPIA): We share Customer name, address, contact details, property problem description, photos, and access instructions. This allows the Contractor to perform the Job. Contractors are contractually bound to use this data only for that specific Job and for no other purpose, as set out in Clause 12 of our Contractor Service Agreement.
• Site Inspectors: We share Customer address, job details, and Contractor work records to perform inspections and quality assurance.
• Payment Processors (for example, banks and EFT gateways): We share payment information, including amounts and account details, but we do not store full card details. This enables us to process payouts and payments.
• Regulators and Government Bodies: We share data as legally required, for example with SARS, the Information Regulator, or the CCMA, to comply with legal obligations.
• Third-Party Service Providers (for example, IT hosting, cloud storage, analytics, and email delivery providers): We share limited data as necessary for the service, such as email addresses for transactional emails. These providers are contractually bound to keep data secure and process it only on our instructions.
• Legal Advisors and Courts: We share relevant data as required for disputes or legal proceedings, to establish, exercise, or defend legal claims.
• Law Enforcement: We share data as required by valid legal process, such as a court order or subpoena, to comply with legal obligations.

Important: We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes. We do not share data with data brokers.

6. Cross-Border Transfers

Our servers and primary data storage are located in South Africa. However, some of our third-party service providers, for example cloud hosting, analytics, and email services, may operate in jurisdictions outside South Africa.

If we transfer your personal information outside South Africa, we will ensure that:

• the recipient country has adequate data protection laws that are substantially similar to POPIA; or
• we have entered into legally binding agreements with the recipient that include appropriate safeguards, such as standard contractual clauses; and
• the transfer is necessary for the performance of the contract or is otherwise lawful under POPIA.

You may request details of the safeguards in place for cross-border transfers by contacting our Information Officer at support@bondboss.co.za.

7. Security Measures

We take the security of your personal information seriously. We implement appropriate technical and organisational measures to protect against unauthorised access, loss, damage, or disclosure. These include:

• Encryption: data is encrypted in transit using TLS or SSL and at rest where feasible.
• Access Controls: strict role-based access to personal information – only authorised employees, contractors, and service providers who need access to perform their duties have access.
• Authentication: multi-factor authentication for administrative and critical systems.
• Regular Security Assessments: we conduct periodic vulnerability assessments and penetration testing.
• Device Security: we require Contractors and Inspectors to use secure devices and to keep their Platform access credentials confidential.
• Employee Training: our staff receive regular privacy and security awareness training.

While we strive to protect your information, no security system is one hundred percent infallible. You are also responsible for keeping your login credentials and account secure.

8. Data Retention Periods

We will retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention schedule is as follows:

• Account Profile Data (name, contact details, address, preferences): retained for as long as your account is active, plus 30 days after account deletion to allow for final processing.
• Job Records (job descriptions, photos, checklists, communications): retained for 5 years from the date of Job completion, to support warranty claims, disputes, and quality reporting.
• Invoices, Payment Records, and Tax Documents: retained for 7 years from the end of the relevant tax year, as required by the South African Income Tax Act and Companies Act.
• Warranty Certificates: retained for the duration of the warranty period plus 3 years for record-keeping and potential claims.
• Contractor Verification Documents (ID, qualifications, insurance, background checks): retained for as long as the Contractor's account is active, plus 5 years thereafter for audit and legal compliance purposes.
• Marketing Consent Records: retained for as long as you have consented to receive marketing communications, plus 1 year after you unsubscribe to demonstrate proof of consent history.
• Logs and Analytics Data (IP addresses, device information, usage patterns): retained for a maximum of 18 months, after which it is anonymised or deleted.
• Deleted Account Data: all non-statutorily required data is permanently deleted within 30 days of account deletion. Required records such as invoices and warranties are retained as per the periods above, and access to them is restricted to authorised personnel only.

Once the retention period expires, we will securely delete or anonymise your personal information so that it can no longer be linked to you.

9. Your Rights Under POPIA

As a data subject, you have the following rights under POPIA. For step-by-step instructions on how to exercise each right, please refer to our separate guide: "Your Privacy Choices", which is available on our Platform.

• Right of Access: You may request confirmation of whether we hold your personal information and request a copy thereof. To exercise this right, email support@bondboss.co.za. We will respond within 30 days.
• Right to Correction: You may request that we correct or update inaccurate, incomplete, or outdated information. Edit your information in-app under Profile or email us. We will respond within 30 days.
• Right to Deletion: You may request that we delete your personal information, subject to legal retention obligations. Use the "Delete Account" function in-app or email us. We will respond and take action within 30 days.
• Right to Object: You may object, on reasonable grounds, to the processing of your personal information where we rely on legitimate interest. Email support@bondboss.co.za with your specific grounds of objection. We will assess and respond within 30 days.
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time. Unsubscribe from marketing emails, adjust app permissions, or email us.
• Right to Lodge a Complaint: You may lodge a complaint with the Information Regulator if you are unhappy with how we have handled your information. Contact the Information Regulator directly as set out in Section 13 below.

We may ask you to verify your identity before responding to any request, to ensure that we do not disclose your information to anyone else.

10. Data Breach Notification

In the event of a security breach that compromises, or is reasonably suspected to have compromised, your personal information:

• we will immediately take steps to contain the breach and mitigate any potential harm;
• we will notify both the Information Regulator and the affected data subjects as soon as reasonably possible, but no later than within 72 hours of becoming aware of the breach, as required by POPIA Section 22; and
• the notification will describe the nature of the breach, the categories of personal information affected, the steps we have taken and plan to take, and recommendations on how you can protect yourself.

You can help us by promptly reporting any suspicious activity or potential breaches you become aware of by emailing support@bondboss.co.za.

11. Direct Marketing and Opt-Out Registry

We only send marketing communications, such as newsletters and promotions, if you have explicitly opted in to receive them. You will be asked to tick a box or toggle a switch to opt in to marketing communications when you register or at any later time. You may withdraw your consent at any time by clicking the "unsubscribe" link at the bottom of any marketing email or by emailing support@bondboss.co.za.

Transactional messages, including job updates, quotes, receipts, warranty notices, and service alerts, are not marketing. They are part of the service you requested, and you cannot opt out of them while you have an active Job or account.

Opt-Out Registry Compliance: As required by South African law, we will register with and maintain access to the national Direct Marketing Opt-Out Registry administered by the National Consumer Commission. We will cease all marketing communications to any individual whose contact details appear on that Registry, or who has otherwise objected to marketing from us.

12. PAIA Manual

In accordance with the Promotion of Access to Information Act, 2000 (PAIA), we have compiled a PAIA Manual which sets out our contact details; the categories of records we hold; the procedure for requesting access to records; the grounds for refusing access; and the fees applicable to accessing records. You may request a copy of our PAIA Manual by emailing support@bondboss.co.za. It is also available on request at our registered office.

13. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information or a privacy request, you have the right to lodge a complaint with:

The Information Regulator (South Africa)
Postal Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: enquiries@inforegulator.org.za
Website: www.inforegulator.org.za

We would greatly appreciate the opportunity to resolve your concerns first. Please contact our Information Officer at support@bondboss.co.za before approaching the Regulator.

14. Updates to This Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any material changes will be communicated to you via an in-app notification or email for significant changes, and by updating the Effective Date at the top of this Policy. We encourage you to review this Policy periodically to stay informed. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

15. Children's Privacy

Our Platform is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you are under 18, please do not use the Platform or provide any personal information. If we become aware that we have inadvertently collected personal information from a child, we will delete it promptly.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Information Officer:

Email: support@bondboss.co.za
Postal Address: BOSS GLOBAL (PTY) LTD, Shop 14, Gardens Mall, 170 Bram Fischer Drive, Randburg, Gauteng, 2194, Republic of South Africa.

For general inquiries, you can also reach us via the Platform's in-app support channels.

17. Acknowledgement

By using the Fixit by Bond Boss Platform, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

To act on any of the rights in section 9 — request a copy of your data, correct it, delete your account, withdraw consent, or turn off notifications — see Your Privacy Choices.

© 2026 BOSS GLOBAL (PTY) LTD. All rights reserved.