Version 1.6, effective 13 October 2026
This policy explains what personal information SkeduloX collects, why we collect it, what we do with it, and what rights you have. It is issued in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), and constitutes the notification required by section 18 of that Act.
1. Who is responsible
| Responsible Party | STACKBOU (PTY) LTD, trading as SkeduloX |
| Registration number | 2026/674140/07 |
| Physical address | As listed in section 1 of our Terms of Service |
| Information Officer | privacy@stackbou.co.za |
| Contact for privacy matters | privacy@stackbou.co.za |
Our Information Officer is registered with the Information Regulator (South Africa), which you can contact at:
Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
complaints.IR@inforegulator.org.za
https://inforegulator.org.za
2. Two different roles
2.1 Where we are the Responsible Party. For information about you as a SkeduloX customer, workspace user, billing contact, support contact or website visitor, we decide why and how it is processed. This policy governs that.
2.2 Where we are an Operator. The records your organisation keeps in its workspace, such as job cards, photos, signatures and customer details, are processed by us on your organisation's instruction. In that case your organisation is the Responsible Party and we are the Operator. Our obligations are set out in clause 9 of the Terms of Service, and your organisation's own privacy policy, not this one, governs how that information is used.
3. What we collect and why
3.1 Signup and user accounts
| Information | Why | Lawful basis |
|---|---|---|
| Company name, your name, email address | Creating and running your workspace, signing you in, sending service emails | Contract, s 11(1)(b) |
| Password | Signing you in. Stored only as a one-way hash, never in readable form | Contract, s 11(1)(b) |
| Role and access settings | Controlling what each user may do | Contract, s 11(1)(b) |
| Profile settings, such as theme and notification preferences | Applying your choices | Contract, s 11(1)(b) |
3.2 Billing
| Information | Why | Lawful basis |
|---|---|---|
| Plan, billing cycle, amounts, payment dates and payment status | Charging the subscription and keeping financial records | Contract, s 11(1)(b), and legal obligation, s 11(1)(c) |
| PayFast card reference (a token, not the card number) | Charging the subscription, pro-rata amounts and renewals | Contract, s 11(1)(b) |
| Billing email address | Sending billing notices | Contract, s 11(1)(b) |
| Record of your acceptance of these terms, with date and IP address | Proving the agreement was concluded | Legitimate interest, s 11(1)(f) |
Card details are collected and stored by PayFast, never by us. We do not receive or store card numbers.
3.3 Security and usage
| Information | Why | Lawful basis |
|---|---|---|
| IP address, browser and device type, sign-in times | Security, abuse prevention and fault diagnosis | Legitimate interest, s 11(1)(f) |
| Account activity, such as plan changes and support sessions | The Account Activity log in your workspace | Legitimate interest, s 11(1)(f) |
3.4 Support
When you email support@stackbou.co.za, we keep the correspondence to resolve your request and to maintain a support history.
Lawful basis: performance of a contract, s 11(1)(b), and legitimate interest, s 11(1)(f).
3.5 Information stored on your device
The SkeduloX app stores job cards captured without a connection on your device until they reach our servers. Queued job cards are removed from the device once they sync. The app also keeps copies of its own files on your device so that pages load without a connection.
3.6 What we do not collect
We do not collect card numbers or banking PINs. We do not use advertising, analytics or cross-site tracking tools.
4. Who we share information with
| Recipient | Purpose |
|---|---|
| Our hosting provider | Running our servers, located in South Africa |
| PayFast | Storing your card and processing card payments |
| Our email service provider | Sending account, billing and job card emails |
| Our accountant and bank | Invoicing, payment and statutory records |
| SARS and other regulators | Where the law requires it |
| Law enforcement | Where compelled by valid legal process |
We do not sell personal information. We do not share it with advertisers or data brokers.
A customer who needs the names of our current providers for its own POPIA records may request the list from privacy@stackbou.co.za.
5. Cross-border transfer
SkeduloX runs on servers in South Africa. Some services in clause 4, notably email delivery, may process data outside the Republic. Such transfers take place only as permitted by section 72 of POPIA: the recipient is subject to a law or binding agreement giving substantially similar protection, or the transfer is necessary to perform our contract with you.
6. How long we keep it
| Category | Retention |
|---|---|
| Workspace data and user accounts | For the life of the subscription, then 90 days, then deleted |
| Invoices, payment and billing records | 5 years, as required by the Tax Administration Act 28 of 2011 |
| Record of acceptance of these terms | 5 years after the subscription ends |
| Support correspondence | 5 years after the subscription ends |
| Encrypted backups | Overwritten on a rolling schedule |
We delete or de-identify personal information once its retention period ends and no lawful purpose for keeping it remains, in accordance with section 14 of POPIA.
7. How we protect it
We apply the security safeguards required by section 19 of POPIA, including:
- TLS encryption on every connection to SkeduloX;
- separate storage for each workspace: every workspace's records sit in their own database schema;
- one-way hashing of all passwords;
- key-only server access and a firewalled server perimeter;
- least-privilege access for our staff, with time-limited support sessions recorded in your Account Activity log;
- daily encrypted backups; and
- no card data on our servers.
If a compromise occurs, we notify the Information Regulator and every affected person as soon as reasonably possible after discovering it, as required by section 22 of POPIA.
8. Cookies
8.1 SkeduloX uses essential cookies only: session cookies that keep you signed in, a security token that protects forms, and a cookie that remembers you have seen our cookie notice. These cannot be disabled without breaking sign-in.
8.2 We do not use advertising, analytics or cross-site tracking cookies, and our fonts are served from our own servers.
8.3 Our Cookie Policy at skedulox.co.za/cookies lists every cookie by name, what it does and how long it lasts, together with what the app stores on your device to keep working without signal.
8.4 We count visits to our public pages (the home page, signup, sign-in and these legal pages) on our own server, to see how many people find us and how. We record the page, the website that linked to it, any campaign tag in the link, and whether it was a phone, tablet or computer. No cookie is set and no IP address is stored. A visitor code made from it changes every day and cannot identify you. Visit records are deleted after 13 months.
9. Service emails and marketing
9.1 Service emails, such as trial reminders, billing notices, job assignments and security messages, are part of the service.
9.2 We send marketing messages only to existing customers about SkeduloX, or where you have consented. Every marketing message includes an unsubscribe mechanism, as required by section 45 of ECTA and section 69 of POPIA.
9.3 We do not sell or rent our contact list.
10. Your rights
Under POPIA you have the right to:
10.1 be told what personal information we hold about you;
10.2 access that information, on request, subject to the procedures in the Promotion of Access to Information Act 2 of 2000;
10.3 correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, under section 24;
10.4 object to processing based on legitimate interest, under section 11(3);
10.5 withdraw consent at any time, where processing was based on consent, without affecting processing already carried out;
10.6 not be subject to a decision based solely on automated processing that significantly affects you, under section 71; and
10.7 complain to us, and to the Information Regulator.
To exercise any of these rights, email privacy@stackbou.co.za. We respond within 30 days. We may ask you to verify your identity first.
Where your information sits in a workspace that belongs to your employer or to a business you deal with, that organisation is the Responsible Party. We refer your request to it, and assist it in responding.
11. Complaints
11.1 Email privacy@stackbou.co.za. We acknowledge within 5 business days and respond substantively within 15 business days.
11.2 You may also complain to the Information Regulator using the contact details in clause 1.
12. Access to information
Our PAIA manual, compiled under the Promotion of Access to Information Act 2 of 2000, is published at stackbou.co.za/paia and is available free on request.
13. Children
SkeduloX is a business service. We do not knowingly collect personal information of children under 18, as section 34 of POPIA requires. If you believe we hold information about a child, contact us and we delete it.
14. Changes
We may update this policy. The current version is always published at app.skedulox.co.za/privacy. Where a change materially affects how we use your information, we notify you by email.
SkeduloX Privacy Policy, version 1.3, 9 October 2026.