← Back to EquipTrail

Privacy Policy

Last updated: 31 August 2026

This policy explains how EquipTrail collects, uses, stores and protects personal information, and your rights under the Protection of Personal Information Act, 2013 (POPIA).

Our Role: Responsible Party and Operator

POPIA distinguishes between two roles, and EquipTrail occupies both:

  • For your account: we are the responsible party for the information you give us to open and run your subscription — your name, email address, company details and billing records.
  • For the data you enter: we are an operator processing on your behalf. The equipment records, locations, crew and contractor details you load remain yours. You are the responsible party for them, and we process them only on your instruction. If one of your employees or contractors wants to know what is held about them, that request goes to you, and we will help you answer it.

Information We Collect

  • Account information: name, email address, company name, and a password stored only as a bcrypt hash. We never see or store your password.
  • Company information: trading name, contact email and phone, and address.
  • Operational data you enter: equipment, locations, movement history, and the names, employee numbers, contact details and allocations of the crew and contractors you track.
  • Payment information: handled by PayFast. We receive a payment reference, amount and status. We never see or store card details.
  • Technical information: server logs recording requests, timestamps and IP addresses, kept for operational and security purposes. Passwords, email addresses and payment credentials are filtered out of these logs.

How We Use It

  • To provide the service and its features.
  • To process subscription payments through PayFast.
  • To send transactional email — account, security and billing notices. We do not send marketing email to your crew or contractors.
  • To diagnose faults, prevent abuse, and keep the platform secure and available.

Where Your Data Is Held

EquipTrail is hosted on servers in Nuremberg, Germany, operated by Hetzner Online GmbH. Transactional email is delivered through Resend, using Amazon Web Services in Ireland. Both are in the European Union and subject to the GDPR, which provides protection substantially similar to POPIA. Payment processing is performed by PayFast in South Africa.

This means personal information is transferred outside South Africa, as permitted by section 72 of POPIA. By using EquipTrail you acknowledge this transfer. If your organisation requires data to remain in South Africa, please contact us before subscribing.

Who We Share It With

We do not sell your data or share it for advertising. We use the following service providers, each only to the extent needed to run the service:

  • Hetzner Online GmbH (Germany) — server hosting.
  • PayFast (South Africa) — payment processing and recurring billing.
  • Resend / Amazon Web Services (Ireland) — transactional email delivery.
  • Backblaze, Inc. — off-site storage of encrypted database backups. Backups are encrypted before they leave our server, with a key Backblaze does not hold.

We may also disclose information where the law requires it.

How We Protect It

  • All connections are encrypted with TLS. The site is HTTPS-only.
  • Passwords are hashed with bcrypt and are never recoverable, by us or anyone else.
  • Each company's data is isolated from every other company's, enforced independently at the database, authorisation and application layers.
  • Passwords, email addresses and payment credentials are filtered out of application logs.
  • The server accepts only HTTPS and SSH traffic. Database access is not exposed to the internet.
  • Databases are backed up nightly. Backups are encrypted with AES-256 before they leave the server and a copy is held off-site, so a failure of any single machine does not lose your data.

No system is perfectly secure, and we do not claim otherwise.

How Long We Keep It

  • While your account is active: for as long as you use the service.
  • After cancellation: your data is retained so you can reactivate. You may ask us to delete it at any time, and we will do so within 30 days unless the law requires us to keep it.
  • Billing records: retained as long as tax and company law require.
  • Backups: encrypted backups are kept for 14 days on our server and 5 days off-site, then destroyed. Deleted data may persist in a backup until then.

You can clear your company's operational data yourself at any time from Settings.

Your Rights

Under POPIA you may:

  • ask what personal information we hold about you, and why;
  • ask us to correct information that is wrong or incomplete;
  • ask us to delete information we no longer have grounds to keep;
  • object to processing, on reasonable grounds;
  • complain to the Information Regulator.

Write to info@equiptrail.co.za and we will respond within 30 days. We may need to verify your identity first.

If you are an employee or contractor whose details appear in EquipTrail because your employer uses it, please contact your employer — they control that data and we process it on their instruction.

Security Breaches

If personal information is accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected parties as soon as reasonably possible, as section 22 of POPIA requires.

Changes

We may update this policy. The revision date at the top always reflects the last change, and we will notify account holders by email of any material change.

Contact

Information Officer, EquipTrail
info@equiptrail.co.za

You also have the right to complain directly to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — POPIAComplaints@inforegulator.org.za, inforegulator.org.za.