Privacy Policy
This policy explains how SJG Enterprises (Pty) Ltd (“we”, “us”), the responsible party for Who's On, processes personal information in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Information we collect
- Account information: name, email address, password (hashed by our authentication provider) or Apple/Google sign-in identifier.
- Family content you enter: family name, members and roles, children's first names, ages and colour tags, activities, appointments, locations, notes, contacts (e.g. coach name and phone number), RSVP and gift notes.
- Device information: push-notification tokens, app version, basic diagnostics.
- Billing status (plan, renewal date). Card details are handled by Apple or SJG Payments Hub — we never see or store them.
2. Children's information
Children do not have accounts. A parent or guardian (a “competent person” under POPIA) adds limited information about their children and consents to its processing for organising the family schedule. Please add only what is needed (e.g. first name).
3. Why we process it
- To provide the service: shared schedules, reminders, check-ins and notifications.
- To manage subscriptions and support.
- To keep the service secure and improve it.
Our lawful bases are your consent, performance of our agreement with you, and our legitimate interests in running a secure service.
4. Who sees it
Only members of your family see its schedule. Caregivers see only duties assigned to them. When you belong to several families, other families only learn that you are “busy” at a time — never the details. We use operators (processors) such as Google Firebase (hosting, database, authentication, notifications) and Vercel (website hosting), bound by agreements requiring appropriate safeguards. Some processing happens outside South Africa (e.g. EU/US data centres) with adequate protection as required by section 72 of POPIA.
5. Retention
We keep your information while your account is active. Deleting a family or your account removes its data from our live systems within 30 days, and from backups within 90 days, unless the law requires otherwise.
6. Your rights
You may request access to, correction or deletion of your personal information, object to processing, and withdraw consent at any time by emailing info@sjgenterprises.co.za. You may also complain to the Information Regulator (South Africa): inforegulator.org.za.
7. Security
Data is encrypted in transit and at rest, and access is restricted by per-family security rules.
8. Contact
Information Officer, SJG Enterprises (Pty) Ltd, South Africa · info@sjgenterprises.co.za