Handley Privacy Policy

Last updated: 30 October 2026

This Privacy Policy explains what personal information MONT TECHNOLOGIES (Pty) Ltd, trading as Handley ("Handley", "we", "us"), collects through the Handley mobile app and related services (the "Service"), why we collect it, who we share it with, and the rights you have.

1. Who we are (the responsible party)

2. What we collect

2.1 Information you give us

• Account details — name, email address, mobile number, date of birth, and password (stored only as a hash by Firebase Authentication; we never see it).
• Profile details — profile photo and, optionally, gender.
• Service addresses — the home / work / other addresses you save or book at, with their map coordinates.
• Booking details — the service, date and time, instructions and notes you add.
• Payment details — your card is tokenised by Paystack. We never see or store your full card number, CVV or PIN; we keep only the card brand, last 4 digits and expiry to show in your wallet. When you add a card, Paystack places a R1 verification charge that is refunded.
• Provider verification — for Providers: a copy of your SA ID, passport or driver's licence, and a selfie (see §2.4 on biometrics), plus skills and certifications you choose to add.
• Bank details — for Providers requesting payouts: bank, account number, branch code and account holder name.
• Emergency contacts — if you add them for SOS / location sharing.
• Waitlist sign-ups — if you join the waitlist on handley.co.za, or tap "Notify me" in the app where we don't have providers yet: your name, email and/or phone number, suburb, the services you're interested in and whether you want to book or to work as a Provider. We use these only to tell you when Handley is available in your area (and, for Providers, to contact you about joining), and keep a hashed — never raw — record of your connection to stop spam.
• Communications — in-app chat messages with the other party to a booking, messages to our support team (in the app or on WhatsApp), ratings and reviews.

2.2 Information we collect automatically

• Location — clients: your device location to suggest an address (only if you allow it). Providers: your location when you accept a job (to check the distance limit) and, while a job is active, at intervals — including in the background — so the client can follow your arrival. Background location stops when the job ends. You can turn location off in your device settings, but live tracking and job acceptance will not work.
• Device and app information — device model, OS and app version, language, time zone, push-notification token.
• Usage information — screens viewed and actions taken in the app, used in aggregate to improve the Service. We do not record exact prices or addresses in usage analytics.
• Crash data — when the app crashes we receive the error, stack trace, device model, OS and app version. Crash reports are not linked to your name, email or account.

2.3 Information from others

• Verification results from our identity-verification provider (verified / pending / rejected, and the fields read from your document).
• Payment events from Paystack (charge succeeded, declined, refunded).
• The other party to a booking — e.g. the rating and review a Provider leaves about a client, and vice versa.

2.4 Special personal information (biometrics)

Provider verification compares your selfie with the photo on your identity document. A face template derived from that comparison is biometric information, which POPIA treats as special personal information. We process it only with your consent, given when you submit verification, and only to confirm your identity and prevent fraud. You may withdraw consent at any time, but we then cannot verify you as a Provider.

We keep a one-way (hashed) reference derived from your identity-document number — never the number itself in plain text — so that an account removed for serious or repeated breaches cannot simply be re-created under the same identity (see Terms of Service §10).

2.5 What is required and what is optional

Your name, email address, mobile number, date of birth and a service address are required to book; without them we cannot provide the Service. Provider verification documents and bank details are required for Providers to accept jobs and be paid. Your photo, gender and emergency contacts are optional. We collect some information to meet legal duties, including tax-record keeping under the Tax Administration Act 28 of 2011.

3. Why we use it

• To provide the Service — bookings, matching nearby Providers, pricing, payments and payouts, chat, live tracking, ratings, receipts and support.
• To keep people safe and prevent fraud — Provider identity verification, the arrival PIN, SOS and location sharing, detecting payment fraud, fake reviews and banned-account abuse.
• To communicate with you — booking updates, receipts and safety alerts (service messages), and, only if you have agreed, offers and news (see §8).
• To improve the Service — aggregated analytics and crash reports.
• To meet legal obligations — tax and accounting records, responding to lawful requests from authorities.

4. Who we share it with

The other party to your booking. A Provider sees your first name, booking details and approximate area before accepting, and your full address, phone number and live chat after accepting. A client sees the Provider's name, photo, rating and live location while the job is active.

Service providers (operators) who process data for us, only as needed to run the Service and under contractual confidentiality and security obligations:

Authorities, where the law requires it (for example a court order or a request from SARS or SAPS), or to protect someone's safety in an emergency.

We do not sell your personal information and do not share it with advertisers.

Cross-border transfers. Several providers above process data outside South Africa. Under POPIA s72 we transfer it only where the recipient is bound by law, binding corporate rules or a contract that gives protection substantially similar to POPIA, or where the transfer is needed to perform our contract with you.

5. How long we keep it

You can ask us to delete information earlier (see §7); we will, unless the law requires us to keep it.

6. How we protect it

• Data is encrypted in transit (TLS) and at rest.
• Card data never reaches our servers — Paystack tokenises it.
• Database security rules restrict each user to their own data, and money-related records can only be written by our servers.
• Access to personal information is limited to the people who need it to run and support the Service.
• We do not log passwords, full card numbers, full ID numbers or biometric data.
• If we have reasonable grounds to believe your personal information has been accessed by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as POPIA s22 requires.

7. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and get a copy (you can also use Download My Data in the app);
• ask us to correct or delete information that is inaccurate, out of date, excessive or unlawfully obtained;
• object to processing, including direct marketing (§8);
• withdraw consent where we rely on consent (e.g. biometrics, marketing) — this does not affect processing already done;
• not be subject to a decision based solely on automated processing that significantly affects you (§9);
• complain to the Information Regulator — inforegulator.org.za, complaints: POPIAComplaints@inforegulator.org.za.

To exercise these rights, email support@handley.co.za from the address on your account, or use the in-app Settings. We respond within 30 days. Our PAIA manual describes how to request records and is available on request at the same address.

8. Marketing

We send service messages (booking updates, receipts, safety alerts) because they are part of the Service. We send offers and news only if you opt in, or — where you are already a customer — about similar services, always with a simple way to opt out in every message and in Settings.

9. Automated decisions

We use automated rules to match bookings to nearby Providers and to flag possible fraud. Decisions that significantly affect you — such as suspending an account for a low rating or suspected fraud — are reviewed by a person, and you can contact support@handley.co.za to make representations before or after such a decision.

10. Children

Handley is for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

For material changes — to what we collect, why, or who we share it with — we will give at least 14 days' notice by in-app notice or email before they take effect.

12. Contact

Information Officer: Wesley Montgomery, MONT TECHNOLOGIES (Pty) Ltd t/a Handley — support@handley.co.za General: info@handley.co.za