Privacy policy
What we hold, why we hold it, who else sees it, and what you can make us do about it. Written under the Protection of Personal Information Act 4 of 2013.
Who is responsible for what
Most of the personal information in Tenvar is not ours and is not the account holder's either — it belongs to the people who work for him. That makes the split worth stating plainly:
- The contractor who subscribes is the responsible party
- He decides which of his employees are captured, what their rates are, and how long the records are kept. His duty to tell his staff that this system exists is his, and we cannot discharge it for him.
- We are the operator
- We process that information on his instruction, to run the service. We do not sell it, we do not use it to advertise, and we do not use it to train anybody's model.
- We are the responsible party for our own dealings with you
- Enquiries you send us, the account and billing details of the subscriber, and the support correspondence between us.
What we hold
People who use the app
- Full name, the short username the office issues, and the roles assigned to them.
- A PIN or password, stored only as an Argon2 hash. We cannot read it, recover it or tell you what it is — a forgotten one is reset, never retrieved.
- Which sites a person is assigned to, and a session record while they are signed in.
Employment information the costing depends on
- Hourly rate, employment start date, and leave taken and accrued.
- Hours worked per site per day, as ticked off on the daily diary.
- Cash advances issued to a driver and what he has spent against them.
Documents captured on site
- Photographs of delivery notes and fuel slips, and whatever happens to appear on them — a signature, a driver's name, a vehicle registration.
- Odometer readings and litres, per vehicle.
Supplier contacts
- Business name, contact person, email address and telephone number, so that a purchase order can be sent.
Technical
- A single session cookie so that a signed-in person stays signed in. There is no advertising cookie and no third-party analytics on the application. See cookies and tracking.
- The IP address of a request, in the ordinary server logs, for security and fault-finding.
Identity documents, where an employer chooses to hold them
An employer can file a copy of an employee's identity document, driver's licence or work permit against that person. It is optional and no part of the app requires it — but where it is used, the copy will contain an identity or licence number, so it is the most sensitive information in the system and is treated accordingly:
- Only an administrator or the owner can view one. Ordinary office access is not enough.
- It is never sent for reading by any model. The extraction feature applies to delivery notes and nothing else, and these are excluded by name rather than by convention.
- It should be removed once the reason for holding it has passed. Removing it hides the document and keeps the record of who filed it and when, so the removal is itself auditable.
Whether to collect these at all is the employer's decision and the employer's responsibility under POPIA — including telling the employee, and having a lawful reason. We provide the place to keep them; we do not decide that they should be kept.
What we deliberately do not have. No bank account details, no addresses for employees, no location tracking of a person or a vehicle, and no access to the phone's camera roll beyond the photograph the user chooses to take. Identity numbers appear only inside a document an employer has chosen to upload, as described above — the app never asks for one as a field and never reads one out of an image.
Why we hold it, and on what basis
| Information | Why | Lawful basis (POPIA §11) |
|---|---|---|
| Name, username, PIN hash, roles | So that a person can sign in and only see what their job needs. | Necessary to perform the contract with the subscriber |
| Rates, hours, leave | They are the labour cost of a site, and the leave register is a statutory record. | Contract, and compliance with an obligation of law |
| Document photographs | Evidence of what was delivered and what was paid, attached to the cost it created. | Legitimate interests of the responsible party |
| Supplier contacts | To send a purchase order to the right person. | Contract, and legitimate interests |
| Enquiries you send us | To reply to you. | Consent, by sending it |
Who else sees it
Only the services below, each for one job, and none of them for their own purposes. We do not sell personal information and we do not share it for anyone else's marketing.
| Service | What it does | What it sees | Where |
|---|---|---|---|
| Railway | Application hosting and the PostgreSQL database that holds all of your data. | Everything captured in the app. | Available on request |
| Railway object storage (Tigris Data) | Stores the photographs of delivery notes and fuel slips captured on site. | Document images, and whatever appears on them. | Available on request |
| Anthropic | Reads a photographed delivery note or fuel slip and proposes the figures on it, so the person on site does not have to type them. Optional — it can be switched off, and the app works without it. | The image of the document, and nothing else. It is not used to train any model. | United States |
| IntelliDesk | The support widget on the office screens. It renders a "Help" button and a ticket form; a ticket only reaches IntelliDesk when somebody fills it in and submits it. The widget does ask IntelliDesk for its own configuration when an office page loads, so they see the request even when no ticket is raised. | The name, email address, subject and description typed into the ticket, any screenshot pasted into it, and the app screen it was raised from. It sets no cookie and stores nothing in the browser. | Available on request |
| Twilio SendGrid | Sends purchase orders to your suppliers and the weekly digest to you. | Recipient email address, the message, and the purchase-order PDF. | United States |
If you came to us through an i60 sales partner, we record the partner's code against your account and share your company name, contact email and payments with i60's partner programme to pay their commission.
We will also disclose information where a law or a court order requires it. If that happens and we are permitted to tell you, we will.
Information that leaves South Africa
Section 72 of POPIA restricts sending personal information out of the Republic, so this is stated rather than implied: some of it does leave.
- Photographed delivery notes and fuel slips are sent to Anthropic in the United States to be read, so that the figures on them do not have to be typed. The image is processed and returned; it is not used to train a model. This feature can be switched off entirely, in which case nothing is sent and the figures are typed by hand.
- Emails to suppliers are sent through Twilio SendGrid in the United States.
- Support tickets raised from the Help button on an office screen go to IntelliDesk, together with whatever the person typed and any screenshot they pasted in. The widget also requests its own configuration when an office page loads, so IntelliDesk sees that request — and the IP address it came from — even when no ticket is submitted. It is on the office screens only, never on the site manager's or driver's phone, and never on the public pages.
- Hosting and storage are provided by Railway, in the region named in the table above.
Each of these is bound by terms that require a level of protection substantially similar to POPIA's conditions for lawful processing, which is the basis on which the transfer is made.
How long we keep it
While the subscription is running, and afterwards for as long as the law requires records to be kept. Accounting records in South Africa must generally be retained for seven years, and most of what is in Tenvar is an accounting record.
The cost ledger is append-only, and that is deliberate. A wrong figure is corrected by posting an equal and opposite entry, never by editing or deleting the original, so that a number can always be explained six months later. It means that a request to erase a ledger entry cannot be met in the ordinary way — we can remove or mask the personal identifiers attached to it, but the financial record itself stays. If you need something removed, say so and we will tell you exactly what can and cannot be done before you rely on it.
When an account is closed we will, on request, provide an export and then delete or anonymise what we are not required to keep.
Your rights
Under POPIA you may:
- Ask whether we hold information about you, and ask for a copy of it.
- Ask us to correct or complete anything that is wrong or misleading.
- Ask us to delete or destroy information that is inaccurate, irrelevant, excessive, obtained unlawfully, or that we are no longer authorised to keep — subject to the ledger note above.
- Object to processing that relies on legitimate interests.
- Complain to the Information Regulator.
Ask by emailing support@tenvar.co.za. We will respond within 30 days. There is no charge for a reasonable request, and we will tell you before doing anything that would carry one.
A formal request for access is made on Form 2 under PAIA — the PAIA manual sets out how.
If you are an employee, not the subscriber
If your employer uses Tenvar, your name, your rate and the hours you worked are in it. Your employer decided that and is the responsible party for it — so the first place to take a question about it is your employer, not us.
We will always help. If you write to us we will tell you what the system holds about you and pass your request to your employer, but we cannot change or delete his records on your say-so any more than a filing cabinet could.
How it is protected
Set out in full on the security page. In short: everything travels over TLS, PINs and passwords are stored as Argon2 hashes, certain fields are encrypted at rest, access is by role, and the database is backed up by the hosting platform.
If personal information under our control is accessed or acquired by an unauthorised person, POPIA §22 requires us to notify the Information Regulator and the people affected as soon as reasonably possible. We will.
Information Officer
- Information Officer
- Available on request
- support@tenvar.co.za
- Telephone
- Available on request
- Company
- I-Sixty Group — see contact and company details
Not satisfied? You may complain to the Information Regulator (South Africa): POPIAComplaints@inforegulator.org.za, or https://inforegulator.org.za. JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.