Privacy Policy

Effective 6 November 2026 · Version 2026-11-06

This policy explains what personal information GigProQuo collects, why, who sees it, how long we keep it, and your rights under the Protection of Personal Information Act, 2013 (POPIA). [Operator legal name] is the responsible party.

1. What we collect

• Account: your name (or, for a company account, the company's name), email address, password (stored only as a secure hash; a new password waiting for you to confirm it by email is also stored only as a hash, and can no longer be used if you do not confirm it within 60 minutes), whether your email is verified, and when you agreed to these policies.
• Sign-in with Google, Apple or Facebook: if you use one of these, we receive from it your account ID with that provider, your name and your email address (and whether the provider has verified it). We do not receive your password with the provider or access to your contacts or posts.
• Contact details: your phone number, an optional WhatsApp number, and the ways you prefer to be contacted (email, phone call, SMS or WhatsApp). We use them only to contact you about your account and records.
• Profile: account type (individual or registered company), headline, photo, bio, location, whether you work remotely, on site or both, skills, availability and rate, the gig types you want with how you charge for each, your working hours, portfolio samples and images.
• Company details: registered name, CIPC registration number, and your company representative's name, position, email and phone.
• Payee check: your SARS Tax Compliance Status (TCS) PIN, its validity date and the result of our check. We do not store your tax reference number or ID number as data fields.
• Documents you upload: for example your ID or driver's licence, proof of address, SARS documents, qualifications and company registration certificate. We also keep a record of each time a document is opened or downloaded: by whom, when and from which IP address.
• Forms and contracts you sign online: consent forms confirming your personal or company details, and contracts we send you, signed with Documenso, the e-signing system we run on our own server. It receives the signer's name and email address and the details filled into the form (such as your name, phone, company name, CIPC number and your representative's details). We keep the title, who signed, when, and a copy of the signed PDF. It also records the signing itself (for example the time, IP address and browser) in a signing certificate attached to the signed document.
• Work records: your gigs, amounts, dates, and your clients' names and contact details that you enter so we can confirm the work with them.
• Credit records: your calculated credit rating, saved ratings, and credit applications with their outcome.
• Testimonials: testimonials and, when you ask a reference to write one, their name and email address.
• Two-factor authentication (if you turn it on): the secret key your authenticator app uses (stored encrypted) and your recovery codes (stored only as a secure hash). We never receive anything else from the app or your phone.
• Records of activity: notifications we send you, a log of staff decisions about your records, and an activity log of what is done on your account: each form you send (for example saving your profile, adding a gig or applying for credit), downloads, logins, failed logins (with the email address that was typed), when staff open your records, the time, your IP address and your browser. It never contains what you typed into a form, such as passwords, PINs or your details.
• Fonts: our pages load their fonts from Google Fonts, so your browser sends your IP address to Google when it loads them. Google does not receive any of your account information.
• Technical information: the cookies described in our Cookies Policy, and your IP address and browser details in our session records. These are also what we show you as your logged-in devices.
• Error reports: when something goes wrong on the platform, a short technical report (the error, the page, the time and your account ID, but not your name or email) is sent to Gotify, the error-alert system we run on our own server, so our team can fix it. It is not shared with anyone outside our team. An error message can sometimes include a piece of the information that was being processed.

2. Information about other people

When you enter a client's contact details, ask a reference for a testimonial, or name a company representative, you give us information about another person. Only do so if they would reasonably expect it and you have told them. We use it only to confirm your work, send the testimonial request, or contact your company.

If you send us an ownership claim ("Someone is using my details"), we collect your contact details and the documents you upload (such as your ID, director IDs, CIPC certificate and proof of address) to decide the claim. We also ask for a current photo of you holding your ID and a note with the date, taken with your phone through a private link (a QR code) after you send the claim, so that someone who only has copies of your documents cannot make a claim in your name. Our staff compare the photo with the ID by eye; we do not use automated facial recognition, and the photo is used for nothing else. Because a photo used to confirm who you are is sensitive, we only process it with your consent, given when you send the claim.

3. Why we use it

• To provide your account and profile, and to keep it secure, including two-factor authentication, showing you where you are logged in, and the activity log we use to investigate misuse, unauthorised access and disputes (contract and our legitimate interest in keeping accounts and records secure).
• To find and fix errors on the platform (legitimate interest).
• To verify you: your email, your SARS tax compliance, your company registration, your documents, the consent forms you sign and your work with clients (contract and our legitimate interest in keeping records accurate).
• To enter into agreements with you that are signed online, and keep a record of them (contract and legal obligation).
• To calculate your credit rating and record and review your credit applications (contract).
• To keep financial records for audit and to meet legal obligations (legal obligation).
• To send you service emails and in-app notifications about your account (contract).
• To investigate ownership claims and misuse of the platform (legitimate interest and legal obligation).

We do not sell your personal information and we do not use it for advertising.

4. Who sees it

• Our staff, who need it to check and decide your records. Every staff decision is logged, and staff can see the activity log, including when other staff opened your records. Staff can only view your documents on the platform, marked with their name and the time; they cannot download or print them. You can see on each document how often our team has opened it.
• SARS and CIPC: staff enter your TCS PIN on the SARS TCS Verify website and look up company numbers on the CIPC register.
• Your clients and references: when we contact them to confirm your work or ask for a testimonial, they learn your name and the work concerned.
• Google, Apple or Facebook, if you choose to sign in with them: they learn that you use GigProQuo. Their own privacy policies apply to what they do.
• Your company's representative, for a company account: when a company details consent form or contract is sent to them to sign, they see the company details filled into it.
• Our service providers, such as our hosting and email providers, who process information only on our instructions.
• Authorities, when the law requires it.

Your profile is visible only to you and our staff. There is no public profile page.

5. Where it is stored and how we protect it

Our servers are in [Country where the servers are]. We protect your information with access controls, encrypted connections, hashed passwords, optional two-factor authentication, and encryption of your TCS PIN, two-factor key and uploaded documents. You can see the devices logged in to your account and log any of them out. Photos and documents can only be opened by you and our staff. Our copy of each signed form is stored encrypted with your documents. Our e-signing system (Documenso) runs on our own server and keeps its copy of each signed document and its signing certificate there.

6. How long we keep it

• Accounts with no financial activity (no credit applications or completed gigs) can be deleted by you at any time; everything is removed.
• Accounts with financial activity are kept for audit. You can close such an account; once the retention period has passed after its last financial activity, its personal details, documents and images are removed and only the financial figures remain.
• The activity log is deleted after 365 days. Deleting your account deletes your activity log straight away; when a closed account's personal details are removed, its activity log is removed too.
• The record of who opened a document is deleted together with the document.
• Signed forms and contracts are kept like your other documents and are deleted with them. The copies in our e-signing system are not deleted automatically yet; ask our Information Officer and we will remove them when we no longer need to keep them.
• Unanswered testimonial requests are deleted 30 days after the link expires.
• Ownership claims, their documents and the photo of you holding your ID are deleted 90 days after the decision (unconfirmed claims after 7 days).

7. Your rights

• Access: download a copy of your information at any time from your account ("Download my data"), including your activity log and logged-in devices.
• Correction: update your details on your work profile or the My account page, or ask us to correct records you cannot change.
• Deletion or closure: delete or close your account from the My account page, as described above.
• Objection: object to processing based on our legitimate interests.
• Complaints: contact our Information Officer first. You may also complain to the Information Regulator (South Africa): inforegulator.org.za.

8. Changes

If we change this policy we will update the version and date above and ask you to agree again before you continue using GigProQuo.

Contact us

[Operator legal name] (registration number [Company registration number]), [Physical address].
Email: hello@example.com · Information Officer: [Information Officer name], hello@example.com