Privacy policy
Last updated 2 October 2026
1. Who we are
WebScheduler (Pty) Ltd, registration number 2026/138798/07, is a South African technology company providing online scheduling, appointment booking, business listing and related Software as a Service (SaaS) services. We collect, use, store, protect and otherwise process the personal information of individuals who use those services, including the WebScheduler application, the online booking platform and the business listing service.
Company details
- Registered name: WebScheduler (Pty) Ltd
- Registration number: 2026/138798/07
- Contact number: 076 829 7070
- Email address: [email protected]
- Website: webscheduler.co.za
This policy explains what personal information this website: webscheduler.co.za, collects, why, and what you can do about it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
Two things this policy does not cover, because they are separate:
- WebScheduler Local, our local business discovery and visibility platform for South Africa, has its own policy at local.webscheduler.co.za/privacy.
- The WebScheduler product itself, which you can run on your own infrastructure or have us host for you. The two arrangements put us in different positions under POPIA. See section 4.
2. What this site collects
Very little. This is a brochure site. There is no account to create and nothing to sign in to.
- Analytics, and only if you accept cookies. We use Google Analytics 4 to see which pages people find useful. Nothing is measured or stored until you press Accept. See our cookie policy.
- Two browser storage entries: one remembering whether you chose light or dark mode, one remembering your answer to the cookie banner so we stop asking. Neither is sent to us; both stay in your browser.
- Standard web server logs kept by our hosting provider, including IP addresses, used to keep the site available and to investigate abuse.
- What you type into the demo request form on our contact page. Your name, business name, email address, phone number if you give one, and your message. You send it deliberately, by pressing the button and ticking the consent box; nothing on this site collects any of it otherwise.
- Your email address, if you subscribe to our newsletter using the signup field in the footer. Nothing is added to the list until you confirm by clicking a link we email you. See section 3.
3. What happens to a demo request, and to a newsletter subscription
The form emails your enquiry straight to our own mailbox and keeps no copy on the website. There is no database behind this site and no record of your submission is stored on the web server, once the email is on its way, the only copy is in our inbox, handled as described in sections 6 and 8.
We record the time and the sending IP address alongside the message, purely to trace abuse if the form is used to send spam, and we limit how often the form may be used from one address. If you would rather not use the form at all, email us directly. The address is on the contact page.
We use what you send only to reply to you and to arrange the demo you asked for. We do not add you to a marketing list off the back of it. We do not use advertising cookies, we do not build visitor profiles, and we do not sell or rent personal information to anyone.
The newsletter is a separate, deliberate opt in. The signup field in the footer of every page sends your email address to our own mailing system at updates.webscheduler.co.za, which runs on our own infrastructure. We then email you a confirmation link, and you are added to the list only when you click it, so an address entered by somebody else never ends up subscribed. Requesting a demo does not subscribe you, and nothing else on the site does either.
Once you are subscribed we keep your email address, the date you confirmed, and ordinary delivery records, whether a message reached you, and whether you opened it or clicked a link in it, so that the list works and unsubscribes are honoured. We do not use any of it to build a profile of you, and we do not pass it to anyone else. Every newsletter carries an unsubscribe link, and you can also ask us to remove you using the contact details in section 14.
4. Where the product runs, and who is responsible for what
WebScheduler can be deployed two ways, and which one you choose decides our position under POPIA. In both cases you remain the responsible party for your own customers' appointment records, what changes is whether we touch them at all.
Self hosted
WebScheduler runs on your own infrastructure, under your own brand. That has a direct privacy consequence worth stating plainly: your customers' appointment records, contact details and booking history never reach us. They live on servers you control.
For that data you are the responsible party under POPIA, and we are not a processor of it. We cannot read it and we cannot produce it on request, because we never hold it.
Hosted by us
Where you ask us to run the instance for you, it is hosted on the infrastructure described below. Your customers' records do pass through systems we operate, so for that data we act as an operator under POPIA sections 20 and 21. We process it on your documented instruction, only to provide the service, and not for our own purposes. You stay the responsible party towards your customers.
Hosting and technology infrastructure
Our services are hosted on Amazon Web Services (AWS) infrastructure. Our servers currently run in the AWS Asia Pacific (Mumbai) Region, ap-south-1, so the information you give us is stored and processed outside South Africa. We may change our hosting region, infrastructure or service providers as the platform develops; where such a change materially affects the processing or cross border transfer of personal information, we will update this page. The platform is built on a PHP based technology stack:
- Backend: PHP and CodeIgniter 4
- Database: MySQL / MariaDB
- Frontend: JavaScript, Vite, Tailwind CSS and SCSS
- Client side libraries: Chart.js and Luxon, where applicable
- Authentication: session based authentication
- Web server: Apache
- Hosting and cloud infrastructure: Amazon Web Services (AWS)
- Security: access controls, application level authorisation, encrypted connections (HTTPS/TLS), and other appropriate technical and organisational security measures
This stack may be updated, replaced or expanded from time to time as we develop and improve our services.
5. Why we process what we do, and on what basis
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Analytics, to understand which pages are useful | Your consent, which you can withdraw at any time |
| Remembering your theme and cookie choices | Necessary to provide the site as you asked for it |
| Server logs, to keep the site available and investigate abuse | Our legitimate interest in a working, secure service |
| Replying to an enquiry you emailed us | Necessary to take steps you requested |
| Replying to a demo request you sent through the contact form | Your consent, given by ticking the box, and necessary to take steps you requested |
| Rate limiting the contact form and keeping the sender's IP with the message | Our legitimate interest in preventing abuse of the form |
| Sending you the newsletter you asked for | Your consent, confirmed by clicking the link in the confirmation email, which you can withdraw at any time |
| Keeping newsletter delivery records, and a record of who has unsubscribed | Our legitimate interest in running a mailing list correctly and not emailing people who asked us to stop |
6. Who else sees it
- Google, for analytics, and only once you have accepted cookies. Google's own privacy policy governs what it does with that data.
- Amazon Web Services, our hosting provider, which necessarily handles the requests your browser makes.
- Our email provider, if you email us or send a demo request through the contact form. The form delivers it as an ordinary email.
- Where the law requires it, such as a valid court order.
- No third party mailing platform. The newsletter runs on software we host ourselves, so subscribing does not hand your address to an external email marketing service. It is still stored on the AWS infrastructure described above.
Fonts, stylesheets, scripts and images on this site are served from our own domain, so browsing it does not quietly hand your IP address to a content delivery network or a font host.
7. Information leaving South Africa
Google processes analytics data outside South Africa. POPIA section 72 permits this where the recipient is subject to comparable protection; we rely on Google's own contractual and regulatory commitments. If you decline cookies, no analytics data is generated at all.
Hosting is a separate question from analytics. Our servers run in the AWS Asia Pacific (Mumbai) Region, so that processing takes place outside South Africa. POPIA section 72 permits this where the recipient is subject to comparable protection; we rely on AWS's own contractual and regulatory commitments.
Depending on the service involved, the safeguards we rely on may include contractual protections, data processing terms, applicable regulatory safeguards and other appropriate measures provided by our service providers.
8. How long we keep it
Analytics data is retained for the period configured in our Google Analytics property and is aggregated for reporting. Email correspondence, including demo requests sent through the contact form, which reach us as ordinary email, is kept for as long as it is useful for the enquiry and our records. Server logs are kept on our provider's standard rotation. The two browser storage entries stay until you clear your browser data.
The contact form itself stores nothing, so there is nothing on the website to delete. It does keep small counters for a couple of days to rate limit submissions; those hold a one way hash of the sender's address, not the address itself, and no message content.
Newsletter subscriptions are kept until you unsubscribe or ask us to delete the record. After that we retain only the minimum needed to make sure we do not email you again. Signups where the confirmation link was never clicked are discarded rather than kept.
9. Your rights under POPIA
Subject to applicable legal requirements and limitations, you may:
- Ask us to confirm whether we hold personal information about you;
- Request access to the personal information we hold about you;
- Ask us to correct or update information that is inaccurate or incomplete;
- Ask us to delete personal information where applicable;
- Withdraw a consent you previously gave, where processing is based on consent;
- Object to certain processing activities where applicable; and
- Lodge a complaint about how your personal information is processed.
Withdrawing analytics consent takes one click: open cookie preferences and press Decline. Unsubscribing from the newsletter takes one click too. Use the link at the bottom of any newsletter we send. To exercise any other right, use the contact details in section 14.
10. Complaints
If you believe your personal information has been processed unlawfully, or that your privacy rights have not been adequately addressed, contact us first so we can investigate and try to resolve it.
You may also lodge a complaint with the Information Regulator (South Africa) through its official channels: inforegulator.org.za.
11. Security
This site is served over HTTPS and is a set of static pages apart from the single script that sends the contact form. There is no database attached to it, no visitor account to compromise, and no store of past enquiries to breach. The form forwards your message by email and retains nothing. No system is perfectly secure, and we cannot guarantee absolute security.
12. Children
This site is aimed at businesses and is not directed at children. We do not knowingly collect information from anyone under 18.
13. Changes
We may update this policy from time to time to reflect changes to our services, technology, legal requirements or information processing practices. When we do, we will update the date at the top of this page. Material changes affecting how we use information you have already given us will be described here.
14. Contact us
If you have a question about this policy, want to exercise a privacy right, or have a concern about how your personal information is being processed, contact us:
- WebScheduler (Pty) Ltd, registration number 2026/138798/07
- Privacy requests: [email protected]
- General enquiries: [email protected] or 076 829 7070
- Anything else: our contact page
We will consider and respond to privacy related requests in accordance with applicable legal requirements.