KONSTRUCTIVE™
Construction Administration
This policy explains what personal information we hold, why we hold it, who we share it with and what you may require of us. It is written to be understood by the people whose information it describes.
Kelo Group (Pty) Ltd, registration number 2014/207858/07, trading as Konstructive™, of Johannesburg, Gauteng, South Africa.
Contact: build@konstructive.africa
| Information Officer | Lindiwe Vilakazi, Director |
|---|---|
| Deputy Information Officer | Siphiwe Skosana |
| Contact for all privacy matters | build@konstructive.africa |
| Registration | Registration of the Information Officer and Deputy Information Officer with the Information Regulator is in progress. |
Under the Protection of Personal Information Act, read with the Promotion of Access to Information Act, the Information Officer of a private body is the head of that body. Deputy Information Officers are designated under section 56 to carry out the work and to be the point of contact for data subjects.
Any request, question or complaint about personal information should be sent to the address above and will be handled by the Deputy Information Officer.
We handle personal information in two distinct capacities, and your rights differ depending on which one applies.
| Capacity | What it covers | Who decides |
|---|---|---|
| Responsible party | Information about the people who sign up for and use Konstructive™, and people who contact us or join our waiting list. | We decide why and how it is processed. This policy governs it. |
| Operator | Personal information a customer enters into their own projects, for example the names of site staff in a site diary, subcontractor contact details, or client representative details. | The customer decides. We process it only on their instruction. Their own privacy policy governs it. |
If you are a site supervisor, subcontractor, client representative or employee whose details appear inside a project, and you want your information corrected or removed, please approach the contractor or project manager who runs that project. We will help them action it, but we cannot change their records without their instruction.
We do not collect payment card details. Subscriptions are invoiced and paid by electronic funds transfer, so your banking details stay with your bank and ours. We do not use advertising trackers, and we do not sell personal information to anyone.
Please read this if you record people's details on site. Site diaries, health and safety files and attendance records often contain identity numbers, medical fitness certificates, next of kin details and photographs of people. Under POPIA some of this is special personal information and carries stricter duties.
You are the responsible party for that information. Before you record it in Konstructive™, satisfy yourself that you are entitled to hold it, that the people concerned have been informed, and that you are recording no more than you genuinely need. Our advice is to record what the Construction Regulations require and nothing beyond it.
We do not ask for special personal information and we do not use it for any purpose of our own.
| Purpose | Lawful basis under POPIA |
|---|---|
| Creating and running your account, and providing the service | Necessary to perform our agreement with you |
| Sending service emails such as confirmation, password reset and invitations | Necessary to perform our agreement with you |
| Invoicing and keeping accounting records | Legal obligation and performance of the agreement |
| Support, fault investigation and security | Our legitimate interest in a service that works and is safe |
| Improving the product using anonymous, aggregated usage statistics | Our legitimate interest |
| Marketing and early access communications | Your consent, which you may withdraw at any time |
We share personal information only with the service providers we need in order to run Konstructive™, and only to the extent they need it. Each is bound to protect it.
| Provider | What for | Where it is processed |
|---|---|---|
| Supabase | Database, authentication and file storage | Ireland, European Union |
| Netlify | Hosting and delivery of the website and application | United States and its global network |
| Afrihost | Domain, email hosting and sending of service emails | South Africa |
| WhatsApp (Meta) | Only where you choose to contact us or receive an invitation by WhatsApp | Per WhatsApp's own terms |
We may also disclose personal information where the law requires it, where it is needed to establish or defend a legal claim, or to a professional adviser bound by confidentiality. If our business or the Konstructive™ service is transferred to another company, including the intended transfer to Konstructive (Pty) Ltd, personal information transfers with it and this policy continues to apply until you are told otherwise.
Some of the providers above process information outside South Africa, as shown in the table. In terms of section 72 of POPIA we do this on the basis that the receiving parties are bound by agreements upholding principles of lawful processing substantially similar to those in POPIA, and because it is necessary to perform our agreement with you. Ireland, where the database is hosted, is subject to the General Data Protection Regulation.
| Information | Retention |
|---|---|
| Account information | For as long as the account is open, then 12 months, unless you ask us to delete it sooner |
| Completed project records | Kept and available to the customer at no charge for as long as we operate the service, because they are the customer's evidence of work done. The customer may delete or export them at any time. |
| Invoices and accounting records | 5 years, as required by tax and company law |
| Waiting list and enquiry details | 24 months from your last contact with us, or until you withdraw consent |
| Technical and security logs | Up to 12 months |
Where the law requires us to keep something, we keep it for that period even if you ask us to delete it, and we tell you why.
No system is perfectly secure. If something goes wrong, clause 12 explains what we do.
Under POPIA you may:
Send any request to build@konstructive.africa. We will respond within 30 days. We may need to confirm your identity first, and we may charge the fee prescribed under the Promotion of Access to Information Act for a formal access request.
Where the information sits inside a customer's project and we act as operator, see clause 3.
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and the affected people as soon as reasonably possible after discovering it, as section 22 of POPIA requires. The notification will explain what happened, what information was involved, what we are doing about it and what you should do.
We send early access and product emails only to people who have asked for them. Every such email carries a way to unsubscribe, and you may also unsubscribe by emailing us. Service emails such as invoices, password resets and security notices are not marketing and continue for as long as you hold an account.
We use only what the service needs in order to work. That means a session token so you stay signed in, and storage on your own device holding a copy of work you have entered but which has not yet reached our servers, so that nothing is lost if your connection drops. We do not use advertising cookies and we do not track you across other websites.
Konstructive™ is a business tool and is not directed at children. You must be at least 18 to open an account. We do not knowingly collect personal information about a child, and we will delete it if we learn that we have.
We would prefer you raise a concern with us first, but you are entitled to approach the Regulator directly at any time.
| Information Regulator (South Africa) | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 |
|---|---|
| General enquiries | enquiries@inforegulator.org.za · 010 023 5200 · toll free 0800 017 160 |
| POPIA complaints | POPIAComplaints@inforegulator.org.za, using Form 5, or through the Regulator's eServices portal |
| Website | inforegulator.org.za |
We may update this policy. The version number and effective date at the top always show the current version. Where a change materially affects you, we will tell you by email at least 30 days before it takes effect.